6293 matches found
Malware in nextcloud-mail
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2022-4826 Malicious code in nextcloud-activity (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5be14942e4baffb9148a1ef55abac43b46bee3da640df6498632a2980795cf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4827 Malicious code in nextcloud-cookbook (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67a05fe7110f0b29da6c76fc1534cc2fcf9ff752fdc542306e5b83641defc79c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4830 Malicious code in nextcloud-news (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8505e1d287500e7ff318e12f512cecdc2558579d1ebfbca10e7ab5ce53d1cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in nextcloud-activity
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in nextcloud-news
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in nextcloud-cookbook
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in nextcloud-activity (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5be14942e4baffb9148a1ef55abac43b46bee3da640df6498632a2980795cf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nextcloud-cookbook (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67a05fe7110f0b29da6c76fc1534cc2fcf9ff752fdc542306e5b83641defc79c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nextcloud-news (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8505e1d287500e7ff318e12f512cecdc2558579d1ebfbca10e7ab5ce53d1cc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4828 Malicious code in nextcloud-js-tests (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b16d1ebcc082e0916e1ebfbf2a580ae6ef9e6167138c0df20449a63917dcd6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in nextcloud-js-tests
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in nextcloud-js-tests (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b16d1ebcc082e0916e1ebfbf2a580ae6ef9e6167138c0df20449a63917dcd6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Nextcloud: @nextcloud/logger NPM package brings vulnerable ansi-regex version
Summary: Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the sub-patterns \;? and ?:;-a-zA-Z\d\/&.:=?%@. Details: Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate...
Nextcloud: Generated passwords are not fully validated by HIBPValidator
Summary: If the Nextcloud server generates a secure random password e.g. for sharing files, the validation is checked before the shuffle function strshuffle is called. In very rare cases it could happen, that a password is validated by HIBPValidator before strshuffle, but would not validate after...
Nextcloud: Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle)
Summary: Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade, this depency is out of date and it can leat to still authorization header. Steps To Reproduce:...
Nextcloud: Brute force protections don't work
Summary: Most of the brute force protections don't actually throttle the response and so they are not logging negative attempts Search for functions with the @BruteForceProtection annotation and check that they call throttle on the response at least conditionally. Impact Brute force protection is...
Nextcloud: Lack of Brute force protection while joining video call in talk section which is password protected
Advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pf36-jvpv-4hwq...
Nextcloud: Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
Summary: Call to registerReceiver misses the broadcastPermission argument - no permissions will be checked for the broadcaster, which allows a malicious application to communicate with the broadcast receiver. Supporting Material/References: Screenshot Snyk report references to fixes in other repo...