CVE-2024-37313 Nextcloud server allows the by-pass the second factor

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Serv...

CVE-2024-37313 Nextcloud server allows the by-pass the second factor

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Serv...

CVE-2024-37313

CVE-2024-37313 corresponds to multiple Nextcloud vulnerabilities surfaced by PT Security and related alerts, detailing improper authentication and credential exposure scenarios. Technical details across connected sources include: 2FA bypass after valid credentials, read-access to external storage...

CVE-2024-37312 Nextcloud user_oidc app's ID4me feature is available even when disabled

useroidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to...

CVE-2024-37312

The CVE concerns Nextcloud’s user_oidc OpenID Connect backend, where the ID4me endpoint lacks access control, enabling account registration and potential access to data available to all registered users. Publicly documented details come from Nextcloud advisories and HackerOne report, which confir...

CVE-2024-37312 Nextcloud user_oidc app's ID4me feature is available even when disabled

useroidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to...

CVE-2024-37312 Nextcloud user_oidc app's ID4me feature is available even when disabled

useroidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to...

Can reshare read&share only folder with more permissions

None...

Events information leaked with shared calendars on recurrence exceptions

None...

ID4me does not validate signature or expiration

None...

Code injection in Nextcloud Desktop Client for macOS

None...

Users can delete old versions of read-only shared files

None...

Can access comments and attachments of deleted cards

None...

Notes app can be tricked into using a received share created before the user logged in

None...

Read-only users can restore old versions

None...

Missing permission check when removing a photo from an album

None...

Ability to by-pass second factor

None...

ID4me feature of OpenID connect app available even when disabled

None...

Nextcloud Security Breach

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany.Nextcloud Desktop Client is a desktop client application for Nextcloud. A security vulnerability exists in Nextcloud Desktop Client versions prior to 3.12.0, which...

PT-2024-27809 · Nextcloud · Nextcloud Deck

Name of the Vulnerable Software and Affected Versions: Nextcloud Deck versions prior to 1.6.6 Nextcloud Deck versions prior to 1.7.5 Nextcloud Deck versions prior to 1.8.7 Nextcloud Deck versions prior to 1.9.6 Nextcloud Deck versions prior to 1.11.3 Nextcloud Deck versions prior to 1.12.1...