CVE-2024-57960

Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from the Chinese company Huawei Huawei. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS that stems from an input validation class vulnerability in the ExternalStorageProvid...

CVE-2025-23212

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28...

CVE-2025-23212

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28...

CVE-2025-23212

CVE-2025-23212 affects Tandoor Recipes. The vulnerability stems from the external storage feature, which allows any user to enumerate the names and contents of files on the server, yielding a local file disclosure. The issue is fixed in version 1.5.28 . Multiple connected sources corroborate this...

CVE-2025-23212 Tandoor Recipes - Local file disclosure - Users can read the content of any file on the server

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28...

PT-2025-4851 · Unknown · Tandoor Recipes

Name of the Vulnerable Software and Affected Versions: Tandoor Recipes versions prior to 1.5.28 Description: Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files...

CVE-2025-23212: Exposure of Sensitive Information to an Unauthorized Actor

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28...

Tandoor Recipes 安全漏洞

Tandoor Recipes is a Tandoor Recipes open source application for managing recipes, planning meals, creating shopping lists, and more. A security vulnerability exists in Tandoor Recipes versions prior to 1.5.28, which stems from an external storage feature that allows any user to enumerate the nam...

CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options

Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...

CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options

Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...

CVE-2024-52518

CVE-2024-52518 (Nextcloud Server) : A session takeover allows an attacker who gains access to a user or admin session to create, modify, or delete external storages without re-entering a password. Descriptions across multiple sources (NVD, Red Hat, GitHub advisories) confirm the issue affects Nex...

CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options

Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...

CVE-2024-52523 Nextcloud Server Custom defined credentials of external storages are sent back to the frontend

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...

CVE-2024-52523

CVE-2024-52523 affects Nextcloud Server. When a user or administrator defines external storage with fixed credentials, the API returns those credentials and re-inserts them into the frontend, allowing an attacker with an active user session to read them in plain text. The vulnerability enables in...

CVE-2024-52523

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...

Custom defined credentials of external storages are sent back to the frontend

None...

Nextcloud 信息泄露漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an information disclosure vulnerability that stems from the fact that after setting up user- or administrator-defined external storage...

Nextcloud 授权问题漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an authorization issue vulnerability that originates when an attacker gains access to a user or administrator session to create, change...

CVE-2024-52523: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active sessi...