PT-2022-23162 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 23.0.7 Nextcloud Server versions prior to 24.0.3 Nextcloud Enterprise Server versions prior to 22.2.11 Nextcloud Enterprise Server versions prior to 23.0.7 Nextcloud Enterprise Server versions prior to 24.0....

PT-2022-24916 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.10 Nextcloud Server versions prior to 23.0.7 Nextcloud Server versions prior to 24.0.3 Description: The Nextcloud server is an open source personal cloud server. Affected versions of the Nextcloud serve...

PT-2022-24812 · Nextcloud +1 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 23.0.8 Nextcloud Server versions prior to 24.0.4 Nextcloud Enterprise Server versions prior to 22.2.10.4 Nextcloud Enterprise Server versions prior to 23.0.8 Nextcloud Enterprise Server versions prior to...

Generated passwords are not fully validated by HIBPValidator

None...

Nextcloud: Database resource exhaustion for logged-in users via sharee recommendations with circles

Summary: Registered users can generate massive database load Steps To Reproduce: 1. create 9 circles and 6 folders circles folder 50 2. share all created folders with all created circles 3. open an other folder and open the share tab, so the URI...

Nextcloud: [user_oidc] Unencrypted Communications

The OpenID Connect User Backend allows users to login to Nextcloud using SSO and is - according to the policy - part of the main scope of this program. The implementation supports plain HTTP without TLS and transfers sensitive information such as OIDC clientsecrets in an unencrypted manner...

Nextcloud: Desktop client does not verify received singed certificate in end to end encryption

Vulnerability description not provided...

Nextcloud: Profile of disabled user stays accessible

Userprofiles of disabled users keep staying accessible. on DOMAIN/u/USERID This is quite undesirable as this user has no way to clear or modify this data in case they do not want it exposed anymore. I'd assume profiles of disabled users would not be visible to ensure they can always be in control...

Nextcloud: XSS in Desktop Client in the notifications

Summary: The Nextcloud Desktop Client application does not properly neutralize the names of files before using them. Steps To Reproduce: Server Machine 1. Install the Nextcloud Server application 2. Log into your account Client Machine 3. Install the Nextcloud Desktop Client application onto a...

CVE-2022-35932

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

Design/Logic Flaw

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

CVE-2022-35932

CVE-2022-35932 describes a missing rate limit in Nextcloud Talk for password-protected conversations. Before versions 12.2.7, 13.0.7, and 14.0.3, an attacker with the conversation link/token can brute-force the password due to lack of rate limiting. Public sources (NVD/Red Hat/GSAs) confirm the i...

CVE-2022-35932 Missing rate limit when trying to join a password protected Nextcloud Talk conversation

Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are susceptible to brute force attacks if the attacker has the link/conversation token. It is recommended that the Nextcloud Talk application is...

Nextcloud Talk 安全漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. A security vulnerability exists in Nextcloud Talk versions prior to 12.2.7, 13.0.7, and 14.0.3. An attacker exploited the vulnerability to disclose sensitive information...

Nextcloud: Multiple Vulnerabilities

Background Nextcloud is a personal cloud that runs on your own server. Description Multiple vulnerabilities have been discovered in Nextcloud. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

Missing rate limit when trying to join a password protected Nextcloud Talk conversation

None...

Nextcloud Server < 22.2.9, 23.x < 23.0.6, 24.x < 24.0.2 Improper Initialization (GHSA-2vwh-5v93-3vcq)

Nextcloud Server is prone to an insufficient logging vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Nextcloud Server < 22.2.7, 23.x < 23.0.4 Insufficient Logging Vulnerability (GHSA-9qvg-7fwg-722x)

Nextcloud Server is prone to an insufficient logging vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...