6247 matches found
CVE-2020-8179
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
CVE-2020-8179
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
Improper access control
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
CVE-2020-8179
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
CVE-2020-8179
CVE-2020-8179 affects Nextcloud Deck 1.0.0. The root cause is an improper access control in the deck task/move flow: updating a card’s stackId via /apps/deck/cards/{id} does not enforce that the destination belongs to the requester, allowing an attacker to inject tasks into another user’s deck. T...
CVE-2020-8179: Improper Access Control
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
PT-2020-20004
Name of the Vulnerable Software and Affected Versions Nextcloud Deck version 1.0.0 Description The issue is related to improper access control, allowing an attacker to inject tasks into other users' decks. Recommendations For Nextcloud Deck version 1.0.0, update to a version that includes a fix f...
Nextcloud: Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki
Github wikis on the following projects https://github.com/nextcloud/bookmarks/wiki can be edited by any logged in user in the system. This poses security and reputation risk for the company. Impact As wikis listed above can be edited by any person on the internet, a malicious actor can accurately...
nextcloud.com Improper Access Control vulnerability OBB-1202341
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Nextcloud: SSL certificate not validated when registering with a provider
Description When running the desktop client for the first time, users can click the "Register with a provider" button to sign up for a Nextcloud account with a Nextcloud cloud provider. Clicking "Register..." opens a web page in a Nextcloud desktop client window with content from...
PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...
Nextcloud: Reflected XSS when renaming a file with a vulnerable name which results in an error
Hi, It looks like Nextcloud team will accept the XSS protected by the CSP. Report 896511 Here is another XSS. 1. Rename an existing filename to .jpg. 2. Anyone tries to rename this .jpg with an invalid filename, like add a "" in it, will trigger the XSS attack. 3. Need bypass the CSP. Thanks...
Nextcloud: XSS in image metadata field
Hi, Will you confirm the XSS vulnerability blocked by the CSP? On Nextcloud 19.0.0 1. Upload the PoC.jpg 2. Check the PoC.jpg metadata 3. Need bypass the CSP to trigger it Impact Cross-Site Scripting...
Nextcloud: Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers
In two Nextclouds A and B, in settings/admin/sharing, these settings are enabled: Restrict users to only share with users in their groups Restrict username autocompletion to users within the same groups Add server automatically once a federated share was created successfully Some user on A now...
Nextcloud: XSS through image upload of contacts using svg file
This is a bypass of report 808287 Upload the attached file for the image of a contact, right click "Open image in new tab" and you will see the xss. Impact The person viewing the image of a contact can be victim of XSS...
Nextcloud Talk Code Injection Vulnerability
Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. A code injection vulnerability exists in Nextcloud Talk versions 6.0.4, 7.0.2, and 8.0.7, which stems from the program failing to properly clean up Talk commands. An attacker could exploit the...
CVE-2020-8180
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...
CVE-2020-8180
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...