PT-2023-27173 · Nextcloud · Nextcloud Talk Android

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk Android versions prior to 17.0.0 Description: Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. An unprotected intent in versions prior to 17.0.0 allowed malicious third-party apps...

Nextcloud user_oidc security vulnerability

Nextcloud useroidc is an application from Nextcloud, Germany. A security vulnerability exists in Nextcloud useroidc version 1.0.0 through versions prior to 1.3.3. An attacker can exploit this vulnerability to impersonate the Nextcloud server against a linked server...

PT-2023-27170 · Nextcloud · Nextcloud +1

Name of the Vulnerable Software and Affected Versions: user oidc versions 1.0.0 through 1.3.2 Description: The issue is related to the missing verification of the issuer in the user oidc module for Nextcloud, allowing an attacker to perform a man-in-the-middle attack by returning corrupted or kno...

Nextcloud Access Control Error Vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Server. An attacker could exploit the vulnerability to access files within subfolders of a group...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server. An attacker could use this vulnerability to brute-force break the client secrets of a configured OAuth...

PT-2023-27171 · User Oidc +1 · User Oidc +1

Name of the Vulnerable Software and Affected Versions: user oidc versions 1.0.0 through 1.3.2 Description: The issue affects the user oidc module, which provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. An attacker with at least read access to a snapshot of the...

Nextcloud Access Control Error Vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Server. An attacker could exploit the vulnerability to inline add an image to a text file and...

Nextcloud Access Control Error Vulnerability

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. An access control error vulnerability exists in Nextcloud Server that stems from a lack of password validation...

PT-2023-27175 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 24.0.4 through 25.0.8 Nextcloud Server versions 26.0.0 through 26.0.3 Nextcloud Server versions 27.0.0 through 27.0.0 Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform...

Nextcloud Server Improper Access Control Vulnerability (GHSA-cq8w-v4fh-4rjq)

Nextcloud Server is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Nextcloud: user_ldap app logs user passwords in the log file on level debug

User passwords were logged in Nextcloud application logs when using LDAP authentication and debug log level settings...

Nextcloud: Password of talk conversations can be bruteforced

The password of talk conversations could be bruteforced by adding the password as a parameter on the GET request of the frontpage instead of sending a POST to the authentication endpoint. This allowed bypassing brute force protection of public talk conversation passwords...

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions stems from improper handling of insufficient privileges. This allows attackers to gain access to the credentials of other users.

The vulnerability of cloud-based software for creating and using Nextcloud storage involves the use of an external storage at the user level, which can be utilized to collect user credentials of other users. Exploiting this vulnerability allows a malicious actor to gain access to another user’s...

Malicious code in nextcloud-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis be6d2af367680b5d332b3472317eeab4a364c78e1617e1d7f3a32f1d797fcdc8 The OpenSSF Package Analysis project identified 'nextcloud-api-sdk' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1247 Malicious code in nextcloud-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis be6d2af367680b5d332b3472317eeab4a364c78e1617e1d7f3a32f1d797fcdc8 The OpenSSF Package Analysis project identified 'nextcloud-api-sdk' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

Nextcloud: New AppPassword can be generated without password confirmation

A security vulnerability allowed an attacker to generate a new AppPassword without requiring password confirmation, potentially granting unauthorized access to Nextcloud accounts...

openSUSE 15 Security Update : nextcloud-desktop (openSUSE-SU-2023:0171-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0171-1 advisory. - Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client...

OPENSUSE-SU-2023:0171-1 Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues: Update ot 3.8.0 - Resize WebView widget once the loginpage rendered - Feature/secure file drop - Check German translation for wrong wording - L10n: Correct word - Fix displaying of file details button for local syncfileitem activities ...

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions lies in the improper limitation on excessive authentication attempts, which allows a hacker to compromise the target system.

The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to the lack of protection against brute-force attacks during password reset procedures. Exploiting this vulnerability could allow a malicious actor to crack the password reset links remotely...

Security update for nextcloud-desktop (important)

openSUSE Security Update: Security update for nextcloud-desktop Announcement ID: openSUSE-SU-2023:0171-1 Rating: important References: 1205798 1205799 1205800 1205801 1207976 Cross-References: CVE-2022-39331 CVE-2022-39332 CVE-2022-39333 CVE-2022-39334 CVE-2023-23942 CVSS scores: CVE-2022-39331 N...