PT-2020-9745

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1 Description The issue is related to improper permissions preservation, allowing sharees to reshare with write permissions when sharing the mount point of a share they received as a public link. Recommendations F...

PT-2020-9740

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 17.0.0 Description A missing check in the software allowed an attacker to set up a new second factor when trying to login. Recommendations For Nextcloud Server version 17.0.0, update to a version that includes the fix...

CVE-2020-8122: Improper Access Control

A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received...

PT-2020-19957 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 16.0.1 Description: A reflected Cross-Site Scripting issue was found in the svg generation of the affected software. Recommendations: For Nextcloud Server version 16.0.1, update to a version that includes a fix for th...

PT-2020-19955

Name of the Vulnerable Software and Affected Versions Nextcloud server version 16.0.1 Description The issue allows for an authenticated server-side request forgery when adding a new subscription in the calendar application, enabling the detection of local and remote services. Recommendations For...

PT-2020-19956

Name of the Vulnerable Software and Affected Versions Nextcloud server version 17.0.0 Description The issue is related to improper authorization in the Nextcloud server, which causes previews and files to be leaked when a file-drop share link is opened via the gallery app. Recommendations For...

CVE-2019-15621: Improper Preservation of Permissions

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

CVE-2019-15612: Session Fixation

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

PT-2020-9747

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1 Description The issue causes the server to send its domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. This results in the exposure of private...

CVE-2019-15623: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

CVE-2019-5449 affects Nextcloud Server prior to 15.0.1. A missing check allows leaking calendar event names when adding or modifying confidential or private events. Multiple connected sources confirm an information disclosure vulnerability in Nextcloud Server before 15.0.1. Impact is information ...

CVE-2019-5449: Improper Authentication

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

Improper neutralization of item names in projects feature (NC-SA-2020-009)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Improper neutralization of item names in projects feature (NC-SA-2020-008)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

PT-2020-9748

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 15.0.7 Description The issue is related to improper input validation, allowing group admins to create users with IDs of system folders. Recommendations For Nextcloud Server version 15.0.7, consider restricting the...

PT-2020-19958

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 14.0.4 Description A bug in the software could expose more data in reshared link shares than intended by the sharer. Recommendations For Nextcloud Server version 14.0.4, at the moment, there is no information about a...

PT-2019-17678

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 15.0.1 Description A missing check in the Nextcloud Server causes leaking of calendar event names when adding or modifying confidential or private events. Recommendations For versions prior to 15.0.1, update ...