Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. A security vulnerability exists in Nextcloud Server that originates from allowing an attacker to inject HTML code in the search UI. Affected products and...

PT-2023-30769 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions 1.13.0 through 2.2.7 Nextcloud Mail versions 2.2.8 is not affected, but versions prior to 3.3.0 are affected, so the correct range is: Nextcloud Mail versions 1.13.0 through 3.2.x Description: Nextcloud Mail is the mai...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that originated from allowing an attacker to make external storage mount points inaccessible to other...

Nextcloud Security Breach

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server, Nextcloud Enterprise Server versions prior to 25.0.11, 26.0.6, and 27.1.0, which stems from a userldap...

Nextcloud: Notes app can be tricked into using a received share created before the user logged in

The Nextcloud Notes app was found to be vulnerable to a security issue that allowed it to be tricked into using a received share created before the user logged in...

Nextcloud: Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist

Improper handling of request URLs allowed guest users to bypass application allowlist in Nextcloud guests app...

Nextcloud: Non-admin users can reset app allowlist to the default

A vulnerability was disclosed where non-administrative users could reset the application allowlist to the default state. This could have allowed malicious apps to be installed...

Nextcloud: Authentication bypass in Global Site Selector allows an attacker to log in as any user

Authentication bypass vulnerability in software allowed attacker to bypass authentication and log in as any user...

Nextcloud: RCE on Wordpress website

A remote code execution vulnerability was exploited on a WordPress website due to unsafe deserialization of user input. This allowed arbitrary code execution as the web server user...

Nextcloud: Can download files by zipping the folder

A vulnerability was identified where files could be downloaded without proper permissions by zipping and downloading a folder, despite not having direct download access. This allowed circumvention of view-only restrictions...

Nextcloud: App PIN code can be bypassed in Files iOS

A vulnerability was discovered in the PIN code implementation of the Files iOS app version 4.9.1 that allowed an attacker to bypass the PIN code protection via brute force due to lack of rate limiting, enabling unauthorized access to the app...

Nextcloud: Bruteforce protection in password verification can be bypassed

A vulnerability was found where the IP address used for brute force protection in Nextcloud server could be bypassed by adding a valid X-Forwarded-For header. This allowed an attacker to bypass the brute force protection and brute force login credentials...

The vulnerability of the Memcached component of cloud software for creating and using Nextcloud data storage allows a attacker to cause a service failure.

The vulnerability of the Memcached component in cloud software for creating and using a data storage service for Nextcloud is related to the use of Memcached as memcache.distributed. Limiting the server’s performance may unexpectedly cause the performance counter to be reset earlier than expected...

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions lies in the storage of OAuth2 tokens in an exposed manner. This allows attackers to gain access to the server and enhance their privileges.

The vulnerability of cloud-based software for creating and using Nextcloud storage involves the storage of OAuth2 tokens in an exposed manner. Exploiting this vulnerability could allow a malicious actor to gain access to the server and enhance their privileges...

The vulnerability of the Nextcloud calendar application, a cloud-based software for creating and using Nextcloud data storage, allows a hacker to cause a service failure.

The vulnerability of the Nextcloud calendar application, a cloud-based software for creating and using Nextcloud data storage, stems from the lack of preliminary checks by the server to verify the validity of email addresses when sending emails. Exploiting this vulnerability could allow an attack...

ROS-20231024-03

The OAuth2 token vulnerability of the cloud-based software for creating and utilizing Nextcloud storage Nextcloud data storage software is related to the storage of OAuth2 tokens in plaintext. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to the server a...

ROS-20231020-02

A vulnerability in the Nextcloud calendar application for cloud-based software for creating and Nextcloud data storage software is related to the server's lack of pre-checks for strings of any length as an email address. of any length as an e-mail address. Exploitation of the vulnerability could...

The vulnerability of the application interface for WebDAV cloud software for creating and using Nextcloud data storage allows a perpetrator to gain access to confidential information.

The vulnerability of the WebDAV application programming interface of cloud-based software for creating and using Nextcloud data storage solutions is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to gain access to...

ROS-20231019-01

Vulnerability in Nextcloud cloud storage creation and utilization software is related to lack of protection and allows password mining in WebDAV API. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information...

SUSE CVE-2023-45660

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0...