6245 matches found
CVE-2021-22913: Exposure of Sensitive Information to an Unauthorized Actor
Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has been explicitly chosen by the user...
NextCloud server processing logic vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A processing logic error vulnerability exists in the Nextcloud server, which stems from the fact that the Nextcloud server is vulnerable to brute-force attack...
CVE-2021-22915: Improper Restriction of Excessive Authentication Attempts
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection...
CVE-2021-22906: Uncontrolled Resource Consumption
Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users...
CVE-2021-22905: Exposure of Sensitive Information to an Unauthorized Actor
Nextcloud Android App com.nextcloud.client before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user...
CVE-2021-22896: Missing Authorization
Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users...
CVE-2021-22912: Exposure of Sensitive Information to an Unauthorized Actor
Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user...
PT-2021-15260
Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 1.9.5 Description The issue is related to improper access control due to a missing permission check. This allows other authenticated users to create mail aliases for other users. Recommendations For versions...
PT-2021-15272
Name of the Vulnerable Software and Affected Versions Nextcloud server versions prior to 19.0.11 Nextcloud server versions prior to 20.0.10 Nextcloud server versions prior to 21.0.2 Description The issue is related to brute force attacks due to the lack of inclusion of IPv6 subnets in rate-limiti...
NextCloud Mail access control vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Mail that stems from a lack of permission checking in Nextcloud Mail.Nextcloud Mail version 1.9.5 an...
PT-2021-15270
Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.2.7 Nextcloud Deck versions prior to 1.4.1 Description The issue arises from an information disclosure vulnerability. When searching for sharees, the lookup server is utilized by default instead of only the...
Nextcloud: Sensitive files/ data exists post deletion of user account
In the latest android app ,I created an account in the name of [email protected]. After few activities,deleted the account . Files containing user emails and tokens still exist.Relevant files not deleted upon deletion of account. Content of files post deletion of account:...
Nextcloud Android Information Disclosure Vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud Android suffers from an information disclosure vulnerability that stems from the fact that due to a timeout issue, the Android client may fail to...
CVE-2021-32658
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...
CVE-2021-32658
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...
Code injection
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...
CVE-2021-32658 Sensitive data may not be removed from storage on account removal
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...
CVE-2021-32658
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that...
CVE-2021-32658
The CVE-2021-32658 entry concerns the Nextcloud Android app. A timeout issue may prevent proper cleanup of sensitive data on account removal, potentially leaving key material such as End-to-End encryption keys accessible. Affected software: Nextcloud Android client (versions prior to 3.16.1). Und...
