5171 matches found
Nextcloud: HTML Injection on "polls" app - comments section (possibly XSS)
Hi everyone, On latest version of Polls app 1.7.5, I noticed a lack of user input filtering for the "Description" part of the survey. An HTML injection is therefore possible. I tried to inject JavaScript code to get an XSS but I didn't succeed. Certainly someone better than me will be able to do...
Nextcloud: bypassing dashboard without account + Information disclosure trough websockets
Sumarry : I found a information disclosure for bypassing parameter url attacker can redirect to dashboard without login user/pass page and websocket can be exposed in response/dashboard. URL Effected https://support.nextcloud.com/passwordreset Steps To Reproduce: Opened directory at...
OPENSUSE-SU-2021:0274-1 Security update for nextcloud
This update for nextcloud fixes the following issues: - nextcloud was upgraded to version 20.0.7 - CVE-2020-8294: Fixed a missing link validation boo1181803 - CVE-2020-8295: Fixed a denial of service attack boo1181804 - CVE-2020-8293: Fixed an input validation issue boo1181445 This update was...
Security update for nextcloud (moderate)
openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2021:0274-1 Rating: moderate References: 1181445 1181803 1181804 Cross-References: CVE-2020-8293 CVE-2020-8294 CVE-2020-8295 CVSS scores: CVE-2020-8293 NVD : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H...
openSUSE Security Update : nextcloud (openSUSE-2021-262)
This update for nextcloud fixes the following issues : - nextcloud was upgraded to version 20.0.7 - CVE-2020-8294: Fixed a missing link validation boo1181803 - CVE-2020-8295: Fixed a denial of service attack boo1181804 - CVE-2020-8293: Fixed an input validation issue boo1181445 C Tenable Network...
OPENSUSE-SU-2021:0262-1 Security update for nextcloud
This update for nextcloud fixes the following issues: - nextcloud was upgraded to version 20.0.7 - CVE-2020-8294: Fixed a missing link validation boo1181803 - CVE-2020-8295: Fixed a denial of service attack boo1181804 - CVE-2020-8293: Fixed an input validation issue boo1181445...
Security update for nextcloud (moderate)
openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2021:0262-1 Rating: moderate References: 1181445 1181803 1181804 Cross-References: CVE-2020-8293 CVE-2020-8294 CVE-2020-8295 Affected Products: openSUSE Leap 15.2 An update that fixes three vulnerabilities is now...
[ASA-202102-7] nextcloud: directory traversal
Arch Linux Security Advisory ASA-202102-7 ========================================= Severity: Medium Date : 2021-02-06 CVE-ID : CVE-2020-36193 Package : nextcloud Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1464 Summary ======= The package nextcloud before...
Nextcloud Server Cross-Site Scripting Vulnerability (CNVD-2021-09293)
Nextcloud is a set of client-server software for creating file hosting services and using them.Nextcloud Server is the server software. A cross-site scripting vulnerability exists in versions prior to Nextcloud Server 20.0.2, 19.0.5, and 18.0.11. The vulnerability stems from a lack of link...
Nextcloud: Take over a mail account due missing validation of account id
A validation is missing to make sure the account id belongs to the logged in user. To reproduce: 1. Login as user 2. Add a mail account to mail 3. Go to account settings 4. Update the account again See a request like below: curl 'http://localhost:50001/index.php/apps/mail/api/accounts/%7Bid%7D' ...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
Format string
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format...
CVE-2020-8294
CVE-2020-8294 in Nextcloud Server is a missing link validation vulnerability that allowed stored XSS via a javascript: URL in markdown. Affected versions are Nextcloud Server before 20.0.2, 19.0.5, and 18.0.11. The issue is fixed in OpenSUSE/OpenSUSE-SU updates (e.g., Nextcloud 20.0.7 and later)....
Nextcloud Server Resource Management Error Vulnerability
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server. The vulnerability stems from the program's lack of input validation, which prevents users from storing...
Nextcloud 跨站脚本漏洞
Nextcloud is a set of client-server software for creating file hosting services and using them.Nextcloud Server is the server software. A cross-site scripting vulnerability exists in versions prior to Nextcloud Server 20.0.2, 19.0.5, and 18.0.11. The vulnerability stems from a lack of link...
Nextcloud Server DoS Vulnerability (NC-SA-2021-003)
Nextcloud Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Nextcloud Server Multiple Vulnerabilities (NC-SA-2021-001, NC-SA-2021-002)
Nextcloud Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nextcloud:nextcloudserver"...