Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data

Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...

EUVD-2016-10266

Malware in sbrugna...

EUVD-2016-10272

Malware in sbrugna...

EUVD-2016-10274

Malware in sbrugna...

EUVD-2019-6569

Malware in sbrugna...

EUVD-2019-15036

Malware in sbrugna...

EUVD-2020-29129

Malware in sbrugna...

EUVD-2021-19503

Malware in sbrugna...

EUVD-2019-15057

Malware in sbrugna...

EUVD-2017-18222

Malware in sbrugna...

EUVD-2021-19475

Malware in sbrugna...

EUVD-2021-19512

Malware in sbrugna...

EUVD-2017-1247

Malware in sbrugna...

EUVD-2021-19473

Malware in sbrugna...

EUVD-2020-29079

Malware in sbrugna...

EUVD-2020-29044

Malware in sbrugna...

EUVD-2019-6580

Malware in sbrugna...

EUVD-2020-29057

Malware in sbrugna...

EUVD-2021-19514

Malware in sbrugna...

EUVD-2021-24187

Malware in sbrugna...