6234 matches found
CVE-2021-39225: Authorization Bypass Through User-Controlled Key
Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3...
CVE-2021-39220: Improper Input Validation
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommend...
NextCloud input validation error vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. Nextcloud Mail applications prior to versions 1.10.4 and 1.11.0 are vulnerable to an information disclosure vulnerability that stems from a privacy filt...
NextCloud information leakage vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. nextcloud Richdocuments application in versions prior to 3.8.6 and 4.2.3 is vulnerable to an information disclosure vulnerability where the vulnerable...
NextCloud information leakage vulnerability
Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Nextcloud Germany. nextcloud OfficeOnline applications prior to version 1.1.1 are vulnerable to an information disclosure vulnerability in which the vulnerable application returns...
NextCloud security vulnerabilities
Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. Nextcloud Deck is vulnerable to an access control error in versions prior to 1.2.9, 1.4.5 and 1.5.3. The vulnerability stems from a lack of permission...
NextCloud security vulnerabilities
Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Germany-based Nextcloud. Nextcloud has a security vulnerability that stems from an improperly designed or implemented problem in the code development process of the network system or...
NextCloud path traversal vulnerability
Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. nextcloud has a file traversal vulnerability in versions prior to 20.0.13, 21.0.5, and 22.2.0, which stems from a lack of authentication, access contro...
CVE-2021-41178: Relative Path Traversal
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...
CVE-2021-41177: Improper Control of Interaction Frequency
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits as as AnonRateThrottle or UserRateThrottle was thus not rat...
Nextcloud: When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
Summary: This report is similar to 1337178 In Nextcloud Deck a user can post their decks in to a conversation via nextcloud talk. The link in metaData can be manipulated to point to a another URL. Steps To Reproduce: 0. Setup burpsuite to proxy 1. Go to Nextcloud Deck and pick a board 2. Pick any...
Nextcloud: Read-only users can restore old versions
Read-only users were able to restore old versions of files in Nextcloud...
Nextcloud: Error in Deleting Deck cards attachment reveals the full path of the website
Summary: An error in deck cards when deleting an attachment reveals the full path of the website. DELETE /apps/deck/cards/11/attachment/file:1 HTTP/2 Host: ctulhu.me/nc Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99" Accept: application/json, text/plain, / Sec-Ch-Ua-Mobile: ?0 User-Agent:...
MGASA-2021-0421 Updated nextcloud-client packages fix security vulnerability
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. CVE-2021-22895 In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to...
Updated nextcloud-client packages fix security vulnerability
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. CVE-2021-22895 In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to...
Nextcloud Desktop Authentication
The vulnerability of the Nextcloud desktop synchronization tool’s client lies in the lack of SSL certificate verification when using the “Register with a Provider” protocol. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...
Debian: Security Advisory (DSA-4974-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 4974-1] nextcloud-desktop security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4974-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 19, 2021 https://www.debian.org/security/faq -...
Debian DSA-4974-1 : nextcloud-desktop - security update
The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4974 advisory. - Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the Register...