Nextcloud 信息泄露漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in Nextcloud Richdocuments, which stems from the fact that there is no rate limitation on Richdocuments OCS...

Nextcloud 信息泄露漏洞

An information disclosure vulnerability exists in Nextcloud Richdocuments, an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the fact that in the affected version, the Richdocuments OCS endpoint is not...

Nextcloud安全漏洞

Deck is a Kanban-style organization tool. Designed for individual planning and project organization for teams integrated with Nextcloud, a security vulnerability exists in Deck that stems from the Deck application not properly checking for user membership in a Circle. An attacker could exploit th...

Nextcloud 日志信息泄露漏洞

An information disclosure vulnerability exists in Nextcloud Server, an open source, powerful cloud storage network drive project. An attacker could use this vulnerability to bypass the dual authentication in Nextcloud, and an attacker who knows the password or has access to the WebAuthN trusted...

Nextcloud 安全漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Germany's Nextcloud. Nextcloud is vulnerable to a code execution vulnerability that stems from Nextcloud's support for rendering image previews of file content provided to users, whic...

Nextcloud 安全漏洞

Nextcloud Circles, an open source social network built by Nextcloud Germany for the Nextcloud ecosystem, is vulnerable to an authorization issue in versions prior to 0.19.15, 0.20.11, and 0.21.4, which stems from a vulnerability in the Nextcloud Circles The application allows any user to join any...

PT-2021-19940 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.12 Nextcloud Server versions prior to 21.0.4 Nextcloud Server versions prior to 22.1.0 Description: The Nextcloud server, an open-source, self-hosted personal cloud, has a issue where logging of...

Nextcloud 安全漏洞

Nextcloud Text is an open source self-hosted file synchronization and sharing communication application platform from the German company Nextcloud. Nextcloud Text has a security vulnerability that could be exploited by attackers to enumerate folders in such shares...

PT-2021-19941 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.12 Nextcloud Server versions prior to 21.0.4 Nextcloud Server versions prior to 22.1.0 Description: Nextcloud server is an open source, self-hosted personal cloud that supports rendering image previews...

PT-2021-19939 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.12 Nextcloud Server versions prior to 21.0.4 Nextcloud Server versions prior to 22.1.0 Description: The issue affects Nextcloud server, an open-source, self-hosted personal cloud. An attacker can bypass...

Preview generation used third-party library not suited for user-generated content

None...

Secret Circle can be joined without approval

None...

Deck shared with a Circle can be accessed by non-Circle members

None...

File Drop can be bypassed using Richdocuments app

None...

Bypass of Two Factor Authentication

None...

Exceptions may have logged Encryption-at-Rest key content

None...

Lack of ratelimit on Richdocuments OCS endpoint

None...

XSS in Nextcloud Circles

None...

Nextcloud Text app can disclose existence of folders in "File Drop" link share

None...

Information Disclosure

nextcloud-desktop is vulnerable to informatino disclosure. The client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious...