CVE-2022-31014

CVE-2022-31014 affects Nextcloud Server; SMTP command injection via iCalendar attachments through newline handling. Affected versions are Nextcloud Server up to 22.2.7/8, 23.x up to 23.0.5, and 24.x up to 24.0.1 (per sources). The root cause is insufficient sanitization of newline characters in S...

CVE-2022-31014 SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...

CVE-2022-31014

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...

NextCloud injection vulnerability

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an injection vulnerability that stems from susceptibility to SMTP command injection attacks...

CVE-2022-31014: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...

SMTP Command Injection in iCalendar Attachments to emails via newlines

None...

Nextcloud: SSRF via potential filter bypass with too lax local domain checking

Summary: Hi. Reviewing the code for filtering for ssrf, in preventLocalAddress, we can see that it calls the function ThrowIfLocalAddress. It has three common checks, first, it checks if the string is localhost, or if it ends in .local or .localhost php // Disallow localhost and local network if...

MAL-2022-4831 Malicious code in nextcloud-register (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2317f28ae6ccf882edcce4b84c415b83e74e907d70fdbef61abccbcad87095b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-register (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2317f28ae6ccf882edcce4b84c415b83e74e907d70fdbef61abccbcad87095b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4829 Malicious code in nextcloud-mail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49b707040d71b3da11b82122e52723a5f64ca6b9384db7ab5b48995623e258af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-mail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49b707040d71b3da11b82122e52723a5f64ca6b9384db7ab5b48995623e258af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4830 Malicious code in nextcloud-news (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8505e1d287500e7ff318e12f512cecdc2558579d1ebfbca10e7ab5ce53d1cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-activity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5be14942e4baffb9148a1ef55abac43b46bee3da640df6498632a2980795cf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-cookbook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67a05fe7110f0b29da6c76fc1534cc2fcf9ff752fdc542306e5b83641defc79c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-news (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8505e1d287500e7ff318e12f512cecdc2558579d1ebfbca10e7ab5ce53d1cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4827 Malicious code in nextcloud-cookbook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67a05fe7110f0b29da6c76fc1534cc2fcf9ff752fdc542306e5b83641defc79c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4826 Malicious code in nextcloud-activity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5be14942e4baffb9148a1ef55abac43b46bee3da640df6498632a2980795cf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nextcloud-js-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b16d1ebcc082e0916e1ebfbf2a580ae6ef9e6167138c0df20449a63917dcd6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4828 Malicious code in nextcloud-js-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b16d1ebcc082e0916e1ebfbf2a580ae6ef9e6167138c0df20449a63917dcd6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Nextcloud: @nextcloud/logger NPM package brings vulnerable ansi-regex version

Summary: Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the sub-patterns \;? and ?:;-a-zA-Z\d\/&.:=?%@. Details: Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate...