PT-2017-10156

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.0.6 and 9.1.2 Description The issue concerns a Stored XSS in the CardDAV image export functionality. This functionality allows the download of images stored within a...

CVE-2016-9460: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an...

PT-2017-10151

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.52 ownCloud Server versions prior to 9.0.4 Description The issue allows for a content-spoofing attack in the files app. Specifically, the location bar in the files app does not verify the passed parameter...

PT-2017-10159

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 9.1.2 Description The issue concerns content spoofing in the dav app, where the...

PT-2017-10158

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 and 10.0.1 ownCloud Server versions prior to 9.0.6 and 9.1.2 Description The issue concerns content spoofing in the files app, where the location bar fails to verify passed parameters. An attacker can...

PT-2017-10154

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.1.2 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 8.2.9 Description The issue allows an...

CVE-2016-9461: Improper Access Control

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to...

CVE-2016-9468: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information...

CVE-2016-9467: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to displa...

CVE-2016-9464: Improper Authorization

Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselv...

CVE-2016-9465: Improper Neutralization of Input During Web Page Generation

Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification o...

PT-2017-10155

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server version 10.0.0 Description The issue arises from an improper authorization check on removing shares. Specifically, the Sharing Backend in Nextcloud differentiates between shares to use...

Nextcloud Server Cross-Site Scripting Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a cross-site scripting vulnerability in the CardDAV image output. An attacker can exploit this vulnerability to launch an XSS attack...

Nextcloud Server Authentication Bypass Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has an authentication bypass vulnerability in SMB. An unauthenticated attacker can exploit this vulnerability to bypass security mechanisms and access the SMB serv...

Nextcloud Server Cross-Site Scripting Vulnerability (CNVD-2016-10262)

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a cross-site scripting vulnerability in Gallery due to Gallery failing to adequately handle exception messages. An attacker can exploit this vulnerability to...

Nextcloud Server Content Spoofing Vulnerability (CNVD-2016-10259)

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a content spoofing vulnerability in the "files" app. The vulnerability is caused by displaying an abnormal message on the endpoint that puts inputs under the...

Nextcloud Server Content Spoofing Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a content spoofing vulnerability in the "dav" app. The vulnerability is caused by displaying an abnormal message on the endpoint that puts input under the...

OwnCloud Server and Nextcloud Server Cross-Site Scripting Vulnerabilities

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany.Nextcloud is an open source self-hosted file synchronization and sharing communication application platform.OwnCloud Server and Nextcloud Server are both a server version of one of them. A cross-site scriptin...

CVE-2016-7419

Cross-site scripting XSS vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name...

Cross site scripting

Cross-site scripting XSS vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name...