Nextcloud: help.nextcloud.com: Session Management Issue

Hey, I've found a session management in help.nextcloud.com, which can lead to session takeover! Issue: ======== When the password of an account is changed from a session, other sessions doesn't expire! Steps to Reproduce: -------------- + We need to use two different browsers. Login to both...

Nextcloud: help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running

The https://help.nextcloud.com sub-site is running Nginx/1.10.0 which is vuln to a known issue CVE-2016-4450 which allows a remote malformed HTTP request to cause the Nginx process to crash. DoS testing is mentioned as not requested, but if you know of an issue give it a go .. You can determine t...

Nextcloud: No permission set on Activities [Android App]

Android app version: 1.0.0 Issue Details: ----------------- The following activities are exported and it does not have a permission set. 1 com.owncloud.android.ui.activity.FileDisplayActivity 2 com.owncloud.android.ui.activity.ReceiveExternalFilesActivity 3...

Nextcloud: Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe

Hello, The mentioned URL contains a form that, when supplied correct user emails, unsubscribes users from the newsletters they're subscribed to. If the user is not subscribed, the form returns a message that says that the user is not subscribed if this is the case. Regards...

Nextcloud: Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11

Hi, I noticed that the redirecturi used to redirect users to any location on the page, passes in all data into a header"Location.. without any validation. The problem is that PHP current PHP-versions of Debian/Ubuntu, there seem to be a patch properly in place in other dists actually built the...

Nextcloud: Content Spoofing

Hi i got content spoofing vulnerability . Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. POC Link :- https://nextcloud.com/.htacess%20THIS%20IS%20CONTENT%20SPOOFING...

Nextcloud: Stored XSS on Share-popup of a directory's Gallery-view

Hi, Nice with the program launch! Congrats! I noticed that there was a Share-icon when toggling to the Gallery-view of a directory under "Nextcloud Files": F99938 If your directory has a malicious name such as a HTML-payload: , this HTML will run when clicking on the Share-icon: F99937 I see that...

Nextcloud: nextcloud.com: Content Injection Custom 404 Error

Hello Team , Request: if u think the reported issues have acceptable risk and u r not going to make changes then kindly request to mark as Informative . Description : This report is about how an attacker is able to spoof the content of 404 page and can add thr own Text in way that the Current...

Nextcloud: Possible RCE

Hello, I just quickly took a glance, I am not entirely sure or didn't get a chance to test it but it seems there are some serious bugs. In /apps/userldap/ajax/wizard.php: php 36: $action = string$POST'action'; and it is called in multiple places. including line 83 & 99. one being $action$loginNam...