The vulnerability of cloud software for creating and using Nextcloud Server’s data storage solution lies in the incorrect expiration time of sessions, which allows attackers to bypass authentication processes.

The vulnerability of cloud software for creating and using Nextcloud Server storage solutions is related to incorrect session expiration times. Exploiting this vulnerability can allow a malicious actor to bypass authentication processes remotely...

The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage solution lies in the lack of authentication attempt limits, which allows attackers to bypass the authentication process.

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the lack of restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor to bypass the authentication process remotely...

The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage solution lies in the lack of authentication attempt limits, allowing attackers to bypass passwords.

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the absence of restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor to bypass any password restrictions...

The vulnerability of cloud software for creating and using Nextcloud Server’s data storage system lies in insufficiently checking incoming requests, allowing attackers to execute SSRF attacks.

The vulnerability of cloud software for creating and using Nextcloud Server storage solutions is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of the software for creating and using the Nextcloud Server’s data storage solution lies in its use of open redirection, which allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of cloud software for creating and using Nextcloud Server storage relates to the use of open redirection. Exploiting this vulnerability could allow a malicious actor to redirect users to an arbitrary URL address...

SUSE CVE-2024-22403

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no...

Nextcloud: Deck app allows to spoof file extensions by using RTLO characters

The Deck app was found to allow spoofing of file extensions by using RTLO characters...

CVE-2024-22401

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...

CVE-2024-22404

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to...

CVE-2024-22402

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

Code injection

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to...

Design/Logic Flaw

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...

Authentication flaw

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402

CVE-2024-22402 concerns the Nextcloud Guests app. The issue is an improper handling of request URLs that lets guest users load pages of apps they should not access, effectively bypassing the app allowlist. Affected Nextcloud Guests versions include 2.4.x, 2.5.x, and 3.0.x (with mitigation guidanc...

CVE-2024-22402 Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402 Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22402 Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22401 All users can reset the allowed apps list for Nextcloud Guest App users

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...

CVE-2024-22401

The CVE-2024-22401 issue affects the Nextcloud Guests app, where non-admin users could alter the allowed-list of apps, enabling use of unintended apps. Affected Nextcloud Guests versions include prior to 2.4.1, prior to 2.5.1, and prior to 3.0.1. Upgrades to 2.4.1, 2.5.1, or 3.0.1 are recommended...