CVE-2022-36075 File list exposure in Nextcloud Files Access Control

Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgrade...

CVE-2022-36075 File list exposure in Nextcloud Files Access Control

Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgrade...

CVE-2022-36075

CVE-2022-36075 concerns exposure of file names to users with limited access in the Nextcloud Files Access Control app. Affected component: Nextcloud Files Access Control (Nextcloud) prior to versions 1.12.2, 1.13.1, and 1.14.1. Root cause details are not explicitly stated in the provided document...

Listing folder content blocked by files access control when received as share

None...

Authentication header is passed on by Nextcloud Server due to a vulnerable GuzzleHTTP version

None...

Nextcloud 信息泄露漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in Nextcloud files access control, which stems from a user being able to see the names of files with...

PT-2022-23163 · Nextcloud · Nextcloud Files Access Control App

Name of the Vulnerable Software and Affected Versions: Nextcloud Files Access Control app versions prior to 1.12.2 Nextcloud Files Access Control app versions prior to 1.13.1 Nextcloud Files Access Control app versions prior to 1.14.1 Description: The Nextcloud Files Access Control app has an iss...

Nextcloud 信息泄露漏洞

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in Nextcloud server versions prior to 23.0.7, 24.0.3 and prior to 24.0.3, which stems from the inability to...

Nextcloud: nextcloudcmd incorrectly trusts bad TLS certificates

Ref: https://github.com/nextcloud/desktop/issues/4927 Bug description I have a self hosted Nextcloud instance using my own private CA for TLS certs. When running nextcloudcmd without the --trust, it disregards the cert validation failure as "This is not an actual error" and proceeds with the sync...

Nextcloud: Name collision of shared folders

Vulnerability description not provided...

CVE-2022-35931

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud...

Default credentials

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud...

CVE-2022-35931 Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud...

CVE-2022-35931

CVE-2022-35931 affects the Nextcloud Password Policy app. Prior to versions 22.2.10, 23.0.7, and 24.0.3, the random password generator may, in very rare cases, produce common passwords that the validator would block. A patch is provided by upgrading the Nextcloud Server to 22.2.10, 23.0.7, or 24....

CVE-2022-35931 Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud...

CVE-2022-35931 Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator

Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3 the random password generator may, in very rare cases, generate common passwords that the validator itself would block. Upgrade Nextcloud...

PT-2022-23037 · Nextcloud · Nextcloud Password Policy

Name of the Vulnerable Software and Affected Versions: Nextcloud Password Policy versions prior to 22.2.10 Nextcloud Password Policy versions prior to 23.0.7 Nextcloud Password Policy versions prior to 24.0.3 Description: The random password generator in Nextcloud Password Policy may, in very rar...

Nextcloud 加密问题漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Password Policy, which stems from the fact that its random password generator may, in very rare cases, generat...

Nextcloud: Missing rate limiting on password reset functionality allows to send lot of emails

A missing rate limiting on password reset functionality in Nextcloud allowed an attacker to send a large number of emails, potentially resulting in financial loss and service disruption. The vulnerability was exploited using the IP rotate extension of Burp Suite. The issue was resolved by adding ...

Nextcloud: the complete server installation path is visible in cloud/user endpoint

Sensitive internal information, including the complete server installation path, was visible in the cloud/user endpoint of Nextcloud server versions prior to 20.0.8, 21.0.2, and 22.0.0RC2. An attacker could obtain this information by making a GET request on the endpoint while logged in. A securit...