XSS in Talk

None...

CVE-2021-41179: Missing Critical Step in Authentication

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

Design/Logic Flaw

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

The CVE-2021-22952 issue affects UniFi Talk applications prior to 1.12.5. Affected: UniFi Talk app versions 1.12.3 and earlier. Description: if an attacker already has network access, they can subsequently control Talk devices assigned to that network that are not yet adopted. Impact: device cont...

UniFi Talk 代码注入漏洞

The Ubiquiti UniFi Talk Application is a plug-and-play VoIp telephony system from Ubiquiti USA. A security vulnerability exists in UniFi Talk that allows a malicious participant who has gained access to the network to subsequently take control of Talk devices assigned to the network if they have...

CVE-2021-22952: Improper Control of Generation of Code

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

PT-2021-15295 · Ubiquiti · Unifi Talk

Name of the Vulnerable Software and Affected Versions: UniFi Talk application versions 1.12.3 and earlier Description: A vulnerability in the UniFi Talk application permits a malicious actor who has already gained access to a network to control Talk devices assigned to said network if they are no...

Nextcloud: objectId in share location can be set to open arbitrary URL or Deeplinks

Summary: The NextCloud Talk app allows a user to share their location in the Mobile App. The objectId= in /ocs/v2.php/apps/spreed/api/v1/chat/$token/share Can be set to a URL or Deeplink, While the metaData= will render the map, Once a user clicked the map it will open the defined URL or Deeplink...

Beers with Talos, Ep. #109: We have not secured our society — Or, working out a conference talk in realtime

Beers with Talos BWT Podcast episode No. 109 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. Most of the Beers with Talos guys got a chance to take... This is only the...

CVE-2021-32689

Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and...

CVE-2021-32689

Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and...

CVE-2021-32689 Nextcloud Talk not properly disassociating users from chats after account deletion

Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and...

CVE-2021-32689

Nextcloud Talk suffered a vulnerability in versions prior to 11.2.2 where a user could reuse an earlier username and gain access to chat messages sent to that previous user. The issue is described as allowing access to messages associated with the reused username, with patches released in Nextclo...

Nextcloud Talk not properly disassociating users from chats after account deletion

None...

CVE-2021-32689: Incorrect Ownership Assignment

Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and...

Nextcloud Talk 安全漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. A security vulnerability exists in versions prior to Nextcloud Talk 11.2.2, which stems from the fact that if a user is able to reuse a previously used username, they can access any chat...