Default credentials

A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares...

CVE-2018-16467

CVE-2018-16467 (Nextcloud Server before 14.0.0) is an improper access‑control vulnerability enabling unauthenticated attackers to bypass password protection for previews of single-file shares via the vulnerable publicpreview.php endpoint. The issue can disclose previews (notably image files) with...

CVE-2018-16463

CVE-2018-16463 describes a session-fixation bug in Nextcloud Server, affecting versions prior to 14.0.0, 13.0.3, and 12.0.8, which could allow an attacker to access password-protected shares. Core details provided indicate a vulnerability in Nextcloud Server’s session handling, with the public Ne...

CVE-2018-16467

A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares...

MGASA-2018-0422 Updated unzip packages fix security vulnerabilities

Updated unzip packages fix security vulnerabilities Heap-based out-of-bounds write CVE-2018-1000031. Heap/BSS-based buffer overflow Bypass of CVE-2015-1315 CVE-2018-1000032. Heap out-of-bounds access in efscanforstream CVE-2018-1000033. Multiple vulnerabilities in the LZMA compression algorithm...

CVE-2018-16464: Improper Authentication

A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password...

PT-2018-13589

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 14.0.0 Description A missing access check in the software could lead to continued access to password-protected link shares when the owner had changed the password. Recommendations For versions prior to 14.0.0...

CVE-2018-16463: Session Fixation

A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares...

CVE-2018-16467: Exposure of Sensitive Information to an Unauthorized Actor

A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares...

PT-2018-13592

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 14.0.0 Description A missing check in the software could give unauthorized access to the previews of single file password protected shares. Recommendations For versions prior to 14.0.0, update to version 14.0...

Improper access control checks for single share previews (NC-SA-2018-014)

A missing check could give unauthorized access to the previews of single file password protected shares...

Nextcloud: Talk / spreed: Disclosure of Room names and participants for password protected rooms

CVSS ---- 5.3 Medium CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS isn't always as fine-grained as I'd like; personally, I would rate the issue somewhere between low and medium Description ----------- The API of the official spreed/talk extension reveals potentially sensitive information such...

[SECURITY] Fedora 29 Update: python-pycryptodomex-3.6.6-1.fc29

PyCryptodome is a self-contained Python package of low-level cryptographic primitives. It's a fork of PyCrypto. It brings several enhancements with respect to the last official version of PyCrypto 2.6.1, for instance: Authenticated encryption modes GCM, CCM, EAX, SIV, OCB Accelerated AES on Intel...

Chaturbate: Users may still able to view chat room panel of password protected rooms

The hacker found that the chat room panel could be accessed without the user having the room password. This was resolved. An attacker may able to view a password protected chat room panel by requesting the api endpoint for room panel. It discloses information depends on what app they use...

Directory Traversal

wordpress is vulnerable to denial of service DoS attacks. The vulnerability exists in wp-includes/class-phpass.php where a large password can be used to attempt to cause DoS attacks in a password protected post...

PT-2018-13588

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 14.0.0 Nextcloud Server version 13.0.3 and earlier Nextcloud Server version 12.0.8 and earlier Description A bug in the software causes session fixation, potentially allowing an attacker to obtain access to...

Microsoft Office: Protect document metadata for password protected files

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013protectpasswdprotectedfilesmetadata.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Protect document metadata for password protected files Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks...

Microsoft Office: Encryption type for password protected Office 97-2003 files

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013encrtypepasswdprotectedfiles.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Encryption type for password protected Office 97-2003 files Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks...

CVE-2018-1000072

iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password protected secret GPG key file and other important configuration files.. This attack appear to be exploitable via network connectivity. This...

Design/Logic Flaw

Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode...