CVE-2016-9459: Generation of Error Message Containing Sensitive Information

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment...

PT-2017-10159

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 9.1.2 Description The issue concerns content spoofing in the dav app, where the...

CVE-2016-9468: User Interface (UI) Misrepresentation of Critical Information

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information...

PT-2017-10158

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 and 10.0.1 ownCloud Server versions prior to 9.0.6 and 9.1.2 Description The issue concerns content spoofing in the files app, where the location bar fails to verify passed parameters. An attacker can...

PT-2017-10152

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.52 ownCloud Server versions prior to 9.0.4 Description The issue arises from improper verification of edit check permissions on WebDAV copy actions. Specifically, the WebDAV endpoint did not properly chec...

Nextcloud: Server version/OS type disclosure via HTTP Response Header

1 Issued request below: GET / HTTP/1.1 Host: demo.nextcloud.com User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:43.0 Gecko/20100101 Firefox/43.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://demo.nextcloud.com/hohoho/ Cookie:...

Nextcloud: Content spoofing due to the improper behavior of the 403 page

Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. PoC: https://usercontent.apps.nextcloud.com/.htaccessthis%20page%20has%20moved%20to%20http://evil.com%20 thanks...

Nextcloud: Update php-saml library to 2.10.5

The php-saml library as used by our SSO implementation had a minor security patch in 2.10.4 as per https://github.com/onelogin/php-saml/commit/949359f5cad5e1d085c4e5447d9aa8f49a6e82a1. So we should update this in our next minor releases. Security update for signature validation on...

Nextcloud: Content Spoofing/Text Injection in nextcloud.com

Greetings, Hello Team, I have found a Content Spoofing/Text Injection on this domain https://nextcloud.com PoC URL: https://nextcloud.com/wp-content/cache/minify/%0d%0ahas%20moved%20to%20www.attacker.com.Please%20visit%20attacker.com%20present%20resource PoC Screen Shot: F168750 Let me know if yo...

Nextcloud: SSRF at apps.nextcloud.com/developer/apps/releases/new

Hi, I've found SSRF vulnerability at https://apps.nextcloud.com/developer/apps/releases/new Description Server Side Request Forgery SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attack...

Nextcloud: DOM XSS vulnerability in search dialogue (NC-SA-2017-007)

DOM XSS vulnerability in search dialogue NC-SA-2017-007 Risk level: Low CVSS v3 Base Score: 2.6 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CWE-79 Description Inadequate escaping lead to XSS vulnerability in the searc...

Nextcloud: Invalid request may lead content spoofing for phishing

HI, I found that site have invalid request may lead to content spoof. Proof Of Concept: https://logs.nextcloud.com/redirecturi?Andmovet0malicioussite.com Thanks,...

Nextcloud: Content spoofing due to the improper behavior of the 403 page

Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. PoC:...

Nextcloud: https://xmpp.nextcloud.com///;@www.google.com allows open redirect

Good day : Hope it goes well, an open redirect exists on the main xmpp.nextcloud.com domain allowing "bad hackers" to do bad things : Poc https://xmpp.nextcloud.com///;@www.google.com May you be well on your side of the screen : -Eric...

Nextcloud: Version 4.7.2 of wordpress is vulnerable

Hello team, I observed that your website https://nextcloud.com still use wordpress 4.7.2 Version 4.7.2 of wordpress is vulnerable to : Cross-site scripting XSS Control characters can trick redirect URL validation Cross-site scripting XSS via video URL in YouTube embeds Cross-site scripting XSS vi...

Nextcloud: http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement

Good day, I truly hope it treats you well on your side of the screen : I have found that your website uses the flash file: swfupload.swf to allow your users to upload files. The tl;dr version of this bug report is it allows an open redirect to any site a non kind person may want to exploit or...

Nextcloud: LDAP login possible even though account doesn't match user filter

We have set up a ldap user filter to match only those users in our ldap directory which should get access to nextcloud. User count shows correct number of users as expected and the filter correctly shows only the users we want in an ldapsearch. The ldap directory contains a lot of other accounts...

Nextcloud: Missing SPF Flags on nextcloud.com

Hello NextCloud Details i just test your domain which is nextcloud.com and i surprised that i can send a legit email to a user. Impact Attacker can use this to send a Legit Email to the Victim and attacker can send a Malicious Web Links and Phishing Sites. Video Proof of Concept...

Nextcloud: Calendar and addressbook names disclosed (NC-SA-2017-012)

Calendar and addressbook names disclosed NC-SA-2017-012 Risk level: Low CVSS v3 Base Score: 3.5 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CWE: Information Exposure Through Directory Listing CWE-548 Description A logical error caused disclosure of calendar and addressbook names to other logged-in users...

Nextcloud: Wordpress 4.7.1

Greetings, I observed that your website https://nextcloud.com still use wordpress 4.7.1 + WordPress version 4.7.1 Released on 2017-01-11 identified from advanced fingerprinting This version of wordpress is vulnerable to : ---- - WPQuery SQLi injection - XSS vulnerability was in the posts list tab...