CVE-2016-9465: Improper Neutralization of Input During Web Page Generation

Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification o...

PT-2017-10151

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.52 ownCloud Server versions prior to 9.0.4 Description The issue allows for a content-spoofing attack in the files app. Specifically, the location bar in the files app does not verify the passed parameter...

CVE-2016-9467: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to displa...

PT-2017-10155

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server version 10.0.0 Description The issue arises from an improper authorization check on removing shares. Specifically, the Sharing Backend in Nextcloud differentiates between shares to use...

CVE-2016-9464: Improper Authorization

Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselv...

PT-2017-10154

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.1.2 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 8.2.9 Description The issue allows an...

PT-2017-10159

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 9.1.2 Description The issue concerns content spoofing in the dav app, where the...

CVE-2016-9468: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information...

PT-2017-10158

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 and 10.0.1 ownCloud Server versions prior to 9.0.6 and 9.1.2 Description The issue concerns content spoofing in the files app, where the location bar fails to verify passed parameters. An attacker can...

PT-2017-10152

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.52 ownCloud Server versions prior to 9.0.4 Description The issue arises from improper verification of edit check permissions on WebDAV copy actions. Specifically, the WebDAV endpoint did not properly chec...

CVE-2016-9460: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an...

Nextcloud Server Cross-Site Scripting Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a cross-site scripting vulnerability in the CardDAV image output. An attacker can exploit this vulnerability to launch an XSS attack...

Nextcloud Server Authentication Bypass Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has an authentication bypass vulnerability in SMB. An unauthenticated attacker can exploit this vulnerability to bypass security mechanisms and access the SMB serv...

Nextcloud Server Cross-Site Scripting Vulnerability (CNVD-2016-10262)

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a cross-site scripting vulnerability in Gallery due to Gallery failing to adequately handle exception messages. An attacker can exploit this vulnerability to...

Nextcloud Server Content Spoofing Vulnerability (CNVD-2016-10259)

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a content spoofing vulnerability in the "files" app. The vulnerability is caused by displaying an abnormal message on the endpoint that puts inputs under the...

Nextcloud Server Content Spoofing Vulnerability

Nextcloud is a suite of open source self-hosted file synchronization and sharing communication application platform. Nextcloud Server has a content spoofing vulnerability in the "dav" app. The vulnerability is caused by displaying an abnormal message on the endpoint that puts input under the...

OwnCloud Server and Nextcloud Server Cross-Site Scripting Vulnerabilities

OwnCloud is a free and open source personal cloud storage solution from OwnCloud Germany.Nextcloud is an open source self-hosted file synchronization and sharing communication application platform.OwnCloud Server and Nextcloud Server are both a server version of one of them. A cross-site scriptin...

CVE-2016-7419

Cross-site scripting XSS vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name...

Cross site scripting

Cross-site scripting XSS vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name...

CVE-2016-7419

Cross-site scripting XSS vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name...