5157 matches found
Nextcloud Server 25.0.2 < 25.0.6, 26.0.x < 26.0.1 Insufficient Session Expiration Vulnerability (GHSA-q8c4-chpj-6v38)
Nextcloud Server is prone to an insufficient session expiration vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
PT-2023-23585 · Nextcloud · User Oidc
Name of the Vulnerable Software and Affected Versions: user oidc app versions prior to 1.3.2 Description: The user oidc app, an OpenID Connect user backend for Nextcloud, has an issue where authentication can be broken or bypassed. Recommendations: For versions prior to 1.3.2, upgrade the Nextclo...
Nextcloud 安全漏洞
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in versions prior to Nextcloud 1.3.2, which stems from the ability to break/bypass authentication in the application...
Nextcloud Server 24.0.x < 24.0.11, 25.0.x < 25.0.5 Missing Brute-Force Protection Vulnerability (GHSA-mr7q-xf62-fw54)
Nextcloud Server is prone to a missing brute-force protection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Basic auth header on WebDAV requests is not brute-force protected
None...
User session not correctly destroyed on logout
None...
user_oidc app is missing bruteforce protection
None...
Nextcloud: Path traversal allows tricking the Talk Android app into writing files into it's root directory
Vulnerability description not provided...
Nextcloud: App stores client secret unencrypted in database
The client secret used to identify the Nextcloud server was stored in plain text in the database, making it vulnerable to unauthorized access...
Nextcloud: OAuth2 client_secret stored in plain text in the database
An OAuth2 client secret was stored in plain text in a database. If accessed without authorization, this would have allowed the client secret to be easily read, enabling impersonation of any OAuth2 client...
CVE-2023-31145
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...
Cross site scripting
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...
CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...
CVE-2023-31145
CVE-2023-31145 describes a reflected XSS with full CSP bypass in Collabora Online when installed with the Nextcloud bundle. The vulnerability allows an attacker to inject malicious code into pages and run in the victim’s browser session, enabling a trivial account takeover attack. Exploitation re...
CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...
Cross-Site Request Forgery (CSRF)
nextcloud-client is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker could make a user send a POST request with an arbitrary body if they click a malicious deep link on a windows based machine exploiting it to the vulnerability...
PT-2023-23178 · Collabora · Collabora Online
Name of the Vulnerable Software and Affected Versions: Collabora Online versions prior to 22.05.13 Collabora Online versions prior to 21.11.9 Collabora Online versions prior to 6.4.27 Description: This issue describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations...
Collabora Online 跨站脚本漏洞
Collabora Online is an application from Collabora UK. A powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats. A cross-site scripting vulnerability exists in Collabora Online versions 22.05.13, 21.11.9, and 6.4.27, which stems from th...
Nextcloud: Password reset endpoint is not brute force protected
The lostpassword flow in Nextcloud was missing brute force protection for the password reset endpoint, allowing attackers to potentially brute force the token without being throttled...