Nextcloud Security Breach

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from the presence of a cross-site scripting XSS vulnerability. Affected products and versions: Deck 1.9.0 a...

Nextcloud Code Issues Vulnerabilities

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A code issue vulnerability exists in versions of Nextcloud server prior to 28.0.0 that stems from an OAuth2 authorization code that is valid indefinitely,...

PT-2024-19392 · Nextcloud · Nextcloud Guests App

Name of the Vulnerable Software and Affected Versions: Nextcloud Guests app versions prior to 2.4.1 Nextcloud Guests app versions prior to 2.5.1 Nextcloud Guests app versions prior to 3.0.1 Description: The Nextcloud guests app is a utility to create guest users which can only see files shared wi...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud files Zip 1.2.0 and later, which originates from an attacker being able to download view-only files by...

PT-2024-19394 · Nextcloud · Nextcloud Files Zip App

Name of the Vulnerable Software and Affected Versions: Nextcloud files Zip app versions prior to 1.2.1 Nextcloud files Zip app versions prior to 1.4.1 Nextcloud files Zip app versions prior to 1.5.0 Description: The Nextcloud files Zip app is a tool to create zip archives from one or multiple fil...

CVE-2024-22401: Improper Preservation of Permissions

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from improper handling of request URLs, which allows users to load unallowed application pages...

PT-2024-19393

Name of the Vulnerable Software and Affected Versions Nextcloud guests app versions prior to 2.4.1 Nextcloud guests app versions prior to 2.5.1 Nextcloud guests app versions prior to 3.0.1 Description The Nextcloud guests app is a utility to create guest users which can only see files shared with...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud guests that stems from the ability for all users to reset the application list for guest users. Affected...

CVE-2024-22404: Improper Preservation of Permissions

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to...

CVE-2024-22213: Improper Neutralization of Input During Web Page Generation

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the...

CVE-2024-22403: Insufficient Session Expiration

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no...

CVE-2024-22402: Improper Preservation of Permissions

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22212: Missing Authentication for Critical Function

Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector i...

Nextcloud Server < 28.0.0 Improper Authorization Vulnerability (GHSA-wppc-f5g8-vx36)

Nextcloud Server is prone to an improper authorization vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-19280

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.9.5 Nextcloud Deck versions prior to 1.11.2 Description The issue allows users to be tricked into executing malicious code in their browser via HTML sent as a comment. This is a problem with the way the...

CVE-2024-22400: URL Redirection to Untrusted Site

Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no...

PT-2024-1285 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.0 Description: The issue concerns the expiration of OAuth codes in Nextcloud Server, a self-hosted personal cloud system. In affected versions, OAuth codes did not expire, allowing an attacker who gains...

Nextcloud: Directory Listing of publicly available assets

The directory listing was configured to publicly display the files in the directory. This configuration is not recommended, as it may expose sensitive or confidential information...

Nextcloud: Code injection in Nextcloud Desktop Client for macOS

The Nextcloud Desktop Client for macOS was found to be vulnerable to code injection. The vulnerability allowed untrusted input to be executed as code, potentially leading to a security breach...