CVE-2021-37630

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is...

Cross site scripting

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

Design/Logic Flaw

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is...

Design/Logic Flaw

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access t...

CVE-2021-37631

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access t...

CVE-2021-32782 Cross-Site Scripting in Nextcloud Circles

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

CVE-2021-32782

CVE-2021-32782 pertains to Nextcloud Circles and is a stored Cross-Site Scripting (XSS) vulnerability. The issue affects Nextcloud Circles and is mitigated in modern browsers that enforce Content-Security-Policy (CSP); exploitation is noted as not feasible on CSP-compliant browsers, but it remain...

CVE-2021-32782

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...

CVE-2021-37630

CVE-2021-37630 affects Nextcloud Circles. The issue is an authorization flaw in affected versions prior to 0.19.15, 0.20.11, or 0.21.4 that allows any user to join a Secret Circle without the circle owner’s approval, leaking private information. The vulnerability is mitigated only by upgrading Ne...

CVE-2021-37630 Secret Circle can be joined without approval in Nextcloud Circles

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is...

CVE-2021-37630

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is...

CVE-2021-37631

CVE-2021-37631 affects Nextcloud Deck. The vulnerability arises from improper checking of Circle membership, allowing non-circle members to access boards shared with a Circle. Affected software is Deck (Nextcloud integration); multiple sources (Red Hat, CNVD, OSV, CVE list, GHSA advisory) consist...

CVE-2021-37631

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access t...

CVE-2021-37631 Circle can be accessed by non-Circle members in Nextcloud Deck

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access t...

Nextcloud: Cards in Deck are readable by any user

Sensitive deck card contents were readable by any user, allowing unauthorized access to the information...

PT-2021-21745

Name of the Vulnerable Software and Affected Versions Nextcloud Circles versions prior to 0.19.15 Nextcloud Circles versions prior to 0.20.11 Nextcloud Circles versions prior to 0.21.4 Description The Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by t...

CVE-2021-32800: Missing Authentication for Critical Function

Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended...

CVE-2021-37629: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is...

CVE-2021-32801: Insertion of Sensitive Information into Log File

Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4...

CVE-2021-32766: Generation of Error Message Containing Sensitive Information

Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link sha...