PT-2023-8885 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.12 Nextcloud Server versions 26.0.0 through 26.0.7 Nextcloud Server versions 27.0.0 through 27.1.2 Description: The issue is related to the rendering of HTML code without markup when a user...

PT-2023-8882 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.12 Nextcloud Server versions 26.0.0 through 26.0.7 Nextcloud Server versions prior to 27.1.3 Nextcloud Enterprise Server versions 20.0.0 through 20.0.14.15 Nextcloud Enterprise Server versions...

PT-2023-8886 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.12 Nextcloud Server versions 26.0.0 through 26.0.7 Nextcloud Server versions 27.0.0 through 27.1.2 Description: The issue is related to improper neutralization of input during web page generation,...

PT-2023-8432 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.10 Nextcloud Server versions 26.0.0 through 26.0.5 Nextcloud Server versions prior to 27.1.0 Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.15 Nextcloud Enterprise Server versions...

PT-2023-8883 · Nextcloud +2 · Nextcloud Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.10 Nextcloud Server versions 26.0.0 through 26.0.5 Nextcloud Server versions 27.0.0 through 27.0.0 Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.15 Nextcloud Enterprise Server versio...

Nextcloud: Notes app can be tricked into using a received share created before the user logged in

The Nextcloud Notes app was found to be vulnerable to a security issue that allowed it to be tricked into using a received share created before the user logged in...

Nextcloud: Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist

Improper handling of request URLs allowed guest users to bypass application allowlist in Nextcloud guests app...

Nextcloud: Non-admin users can reset app allowlist to the default

A vulnerability was disclosed where non-administrative users could reset the application allowlist to the default state. This could have allowed malicious apps to be installed...

Nextcloud: Authentication bypass in Global Site Selector allows an attacker to log in as any user

Authentication bypass vulnerability in software allowed attacker to bypass authentication and log in as any user...

Nextcloud: RCE on Wordpress website

A remote code execution vulnerability was exploited on a WordPress website due to unsafe deserialization of user input. This allowed arbitrary code execution as the web server user...

Nextcloud: Can download files by zipping the folder

A vulnerability was identified where files could be downloaded without proper permissions by zipping and downloading a folder, despite not having direct download access. This allowed circumvention of view-only restrictions...

Nextcloud: App PIN code can be bypassed in Files iOS

A vulnerability was discovered in the PIN code implementation of the Files iOS app version 4.9.1 that allowed an attacker to bypass the PIN code protection via brute force due to lack of rate limiting, enabling unauthorized access to the app...

Nextcloud: Bruteforce protection in password verification can be bypassed

A vulnerability was found where the IP address used for brute force protection in Nextcloud server could be bypassed by adding a valid X-Forwarded-For header. This allowed an attacker to bypass the brute force protection and brute force login credentials...

Memcached DoS

The vulnerability of the Memcached component in cloud software for creating and using a data storage service for Nextcloud is related to the use of Memcached as memcache.distributed. Limiting the server’s performance may unexpectedly cause the performance counter to be reset earlier than expected...

Nextcloud OAuth2 Token Exposure

The vulnerability of cloud-based software for creating and using Nextcloud storage involves the storage of OAuth2 tokens in an exposed manner. Exploiting this vulnerability could allow a malicious actor to gain access to the server and enhance their privileges...

Nextcloud Calendar DoS

The vulnerability of the Nextcloud calendar application, a cloud-based software for creating and using Nextcloud data storage, stems from the lack of preliminary checks by the server to verify the validity of email addresses when sending emails. Exploiting this vulnerability could allow an attack...

ROS-20231024-03

The OAuth2 token vulnerability of the cloud-based software for creating and utilizing Nextcloud storage Nextcloud data storage software is related to the storage of OAuth2 tokens in plaintext. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to the server a...

Nextcloud Information Disclosure

The vulnerability of the WebDAV application programming interface of cloud-based software for creating and using Nextcloud data storage solutions is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to gain access to...

ROS-20231020-02

A vulnerability in the Nextcloud calendar application for cloud-based software for creating and Nextcloud data storage software is related to the server's lack of pre-checks for strings of any length as an email address. of any length as an e-mail address. Exploitation of the vulnerability could...

ROS-20231019-01

Vulnerability in Nextcloud cloud storage creation and utilization software is related to lack of protection and allows password mining in WebDAV API. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to confidential information...