Design/Logic Flaw

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

CVE-2022-35932

CVE-2022-35932 describes a missing rate limit in Nextcloud Talk for password-protected conversations. Before versions 12.2.7, 13.0.7, and 14.0.3, an attacker with the conversation link/token can brute-force the password due to lack of rate limiting. Public sources (NVD/Red Hat/GSAs) confirm the i...

CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

Nextcloud Talk 安全漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. A security vulnerability exists in Nextcloud Talk versions prior to 12.2.7, 13.0.7, and 14.0.3. An attacker exploited the vulnerability to disclose sensitive information...

CVE-2022-35932: Exposure of Private Personal Information to an Unauthorized Actor

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

openSUSE: Security Advisory for MozillaThunderbird (SUSE-SU-2022:2748-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Akamai Has Addressed Browser-Powered Desync Attacks

On August 10, 2022, security researcher James Kettle presented a set of novel HTTP request smuggling attacks in his Black Hat talk,...

SUSE-SU-2022:2748-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 91.12 changed: Support for Google Talk chat accounts removed fixed: OpenPGP signatures were broken when 'Primary Password' dialog remained open fixed: Various security fixes - Security fixes MFSA 2022-31...

Missing rate limit when trying to join a password protected Nextcloud Talk conversation

None...

Reddit: Reddit talk promotion offers don't expire, allowing users to accept them after being demoted

Description: When promoting a user to a speaker/host, an offerId is created which can be accepted by the user. However, after accepting them the offerIds don't expire. This means that after the user is demoted back to a listener, they can still use the offerIds to go back to their previous promot...

blackwomentalktech.com Cross Site Scripting vulnerability OBB-2665350

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in tinkoff-talk-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c76741d903b6ba3173fc55b46fad124d52dd7f5d23c73107d5d43afb73db4a06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Nextcloud: Lack of Brute force protection while joining video call in talk section which is password protected

Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq...

Nextcloud: Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate

Summary: Call to registerReceiver misses the broadcastPermission argument - no permissions will be checked for the broadcaster, which allows a malicious application to communicate with the broadcast receiver. Supporting Material/References: Screenshot Snyk report references to fixes in other repo...

Me on Public-Interest Tech

Back in November 2020, in the middle of the COVID-19 pandemic, I gave a virtual talk at the International Symposium on Technology and Society: "The Story of the Internet and How it Broke Bad: A Call for Public-Interest Technologists." It was something I was really proud of, and its finally up on...

CVE-2022-24890

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

Code injection

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

CVE-2022-24890

CVE-2022-24890 (Nextcloud Talk) affects Nextcloud Talk prior to versions 13.0.5 and 14.0.0, where a call moderator could indirectly enable a user's webcam by granting permissions that were removed. The underlying issue is exposure of webcam permissions that could be re-enabled without user consen...