PT-2019-17683 · Nextcloud · Nextcloud Android App

Name of the Vulnerable Software and Affected Versions: Nextcloud Android app versions prior to 3.0.0 Description: The issue allows for the destruction of a local cache when a harmful query is executed, requiring the user to reset up the account. This occurs due to SQL Injection in the Nextcloud...

CVE-2019-5452: Improper Access Control

Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved...

CVE-2019-5454: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account...

CVE-2019-5455: Authentication Bypass Using an Alternate Path or Channel

Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process...

CVE-2019-5449: Improper Authentication

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5450: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML...

CVE-2019-5453: Authentication Bypass Using an Alternate Path or Channel

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider...

PT-2019-17684 · Nextcloud · Nextcloud Android App

Name of the Vulnerable Software and Affected Versions: Nextcloud Android app version 3.6.0 Description: The issue allows bypassing lock protection when creating a multi-account and aborting the process in the Nextcloud Android app. Recommendations: For Nextcloud Android app version 3.6.0, update ...

CVE-2019-5451: Authentication Bypass Using an Alternate Path or Channel

Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time...

PT-2019-17680

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.6.1 Description The issue allows bypassing lock protection by repeatedly opening and closing the app in a short time, enabling access to files. Recommendations For versions prior to 3.6.1, update to...

PT-2019-17682

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.3.0 Description The issue allows bypassing lock protection, enabling access to files when prompted for lock protection and switching to the Nextcloud file provider. Recommendations For versions prior t...

PT-2019-17679

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.7.0 Description The issue concerns improper sanitization of HTML in directory names. This allows styling of the directory name in the header bar when using basic HTML. Recommendations For versions prio...

Improper neutralization of item names in projects feature (NC-SA-2020-010)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Improper neutralization of item names in projects feature (NC-SA-2020-009)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Improper neutralization of item names in projects feature (NC-SA-2020-008)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Name of private conversations leaked when linked via projects to a shared item (NC-SA-2020-011)

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature...

Nextcloud: Talk - Leak of password-protected room name via already existent resource addition

CVSS ---- Medium 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Description ----------- Affected: Talk / Spreed 6.0.3 The name of shared but password-protected rooms leaks to low-privileged authenticated users. An attacker does not need to guess room IDs, but can simply iterate over IDs to gath...

Nextcloud: Persistent XSS via filename in projects

CVSS ---- Medium 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Description ----------- Affected: Talk / Spreed 6.0.3 The name of a file is echoed without encoding when moving the mouse onto it in the projects tab of a conversation, leading to persistent XSS. A successful attack requires an...

Nextcloud: Clickjacking on https://download.nextcloud.com/

the vulnerability is Clickjacking Steps for Reproduce: 1. Create a script like this Clickjacking! The Site is Vulnerability Clickjacking 2. Enter a file name after saving it in the .html format Then the web is Vuln Clickjacking Sorry bad english im indonesian Impact By using Clickjacking techniqu...

Nextcloud: Clickjacking on https://nextcloud.com/

the vulnerability is Clickjacking Steps for Reproduce: 1. Create a script like this Clickjacking! The Site is Vulnerability Clickjacking 2. Enter a file name after saving it in the .html format Then the web is Vuln Clickjacking Sorry bad english im indonesian Impact By using Clickjacking techniqu...