CVE-2024-52515: Use of Incorrectly-Resolved Name or Reference

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from Nextcloud Tables allowing users to create tables with separate columns...

PT-2024-35347

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.8.1 Description The issue concerns the sharing of table information in Nextcloud Tables, where the details about which table identified by a numeric ID is shared with specific groups and users, along with t...

Nextcloud Desktop Client 信任管理问题漏洞

Nextcloud Desktop Client is an open source file synchronization and sharing tool from Nextcloud GmbH. A trust management issue vulnerability exists in Nextcloud Desktop Client that stems from the fact that if a manipulated server sends an empty initial signature, the desktop client does not stop...

Nextcloud 信息泄露漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an information disclosure vulnerability that originates when a malicious user downloads attachments referenced in a text file without...

Nextcloud 授权问题漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an authorization issue vulnerability that originates when an attacker gains access to a user or administrator session to create, change...

Nextcloud Mail 访问控制错误漏洞

Nextcloud Mail is an email from Nextcloud Germany. An access control error vulnerability exists in Nextcloud Mail that stems from allowing shared files without download permissions to be attached as attachments...

Nextcloud Mail 信息泄露漏洞

Nextcloud Mail is an email from Nextcloud Germany. An information disclosure vulnerability exists in Nextcloud Mail. An attacker who exploits this vulnerability by registering autoconfig.tld will have the email details used sent to the attacker's server...

CVE-2024-52521: Use of Weak Hash

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 t...

CVE-2024-52525: Cleartext Storage of Sensitive Information

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage Redis or disk, but it would allow a malicious process that gains access to t...

CVE-2024-52514: Improper Access Control

Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from a security vulnerability that stems from the fact that OAuth2 client secrets are stored in a recoverable manner so that an attacker...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud has a security vulnerability that stems from an MD5 hash being used to check the uniqueness of background jobs. This increases the likelihood tha...

CVE-2024-52516: Improper Privilege Management

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 o...

PT-2024-35351 · Nextcloud · Nextcloud User Oidc

Name of the Vulnerable Software and Affected Versions: Nextcloud User OIDC app versions prior to 6.1.0 Description: A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. This issue is related to the user oidc app, an...

CVE-2024-52510: Improper Certificate Validation

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Deskt...

CVE-2024-52520: Uncontrolled Resource Consumption

Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and...

CVE-2024-52523: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...

PT-2024-35349

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop Client versions prior to 3.14.2 Description The issue concerns the Nextcloud Desktop Client, a tool used to synchronize files from Nextcloud Server with a computer. It was found that the Desktop client did not stop with an...

CVE-2024-52519: Insecure Storage of Sensitive Information

Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgrade...