CVE-2023-45148

Technical details about CVE-2023-45148 are not publicly available in the provided connected documents. Monitor for updates from Nextcloud advisories to obtain concrete affected versions, impact, and remediation information.

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45151

CVE-2023-45151 affects Nextcloud Server where OAuth2 tokens were stored in plaintext on affected installations. The root cause is storage of OAuth2 tokens in plaintext on the server, enabling an attacker with server access to potentially elevate privileges. Affected versions were addressed by upg...

CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45660 Require strict cookies for image proxy requests in Nextcloud Mail

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0...

CVE-2023-45660 Require strict cookies for image proxy requests in Nextcloud Mail

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0...

CVE-2023-45660

CVE-2023-45660 affects Nextcloud Mail. The vulnerability arises from a missing check of origin, target and cookies in the image proxy/endpoint, enabling an attacker to abuse the proxy and cause a denial of service to a third server. Affected versions are Nextcloud Mail prior to 2.2.8 and prior to...

CVE-2023-45660 Require strict cookies for image proxy requests in Nextcloud Mail

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0...

Nextcloud: Self XSS when pasting HTML into Text app with Ctrl+Shift+V

A vulnerability was found where pasting HTML into the Text app using Ctrl+Shift+V would insert the HTML into the page, allowing for a potential XSS attack...

Require strict cookies for image proxy requests

None...

Inviting excessive long email addresses to a calendar event makes the server unresponsive

None...

OAuth2 client_secret stored in plain text in the database

None...

Password of talk conversations can be bruteforced

None...

Rate limiter not working reliable when Memcached is installed

None...

PT-2023-29634 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 2.2.8 Nextcloud Mail versions prior to 3.3.0 Description: The issue is related to a missing check of origin, target, and cookies in Nextcloud Mail, allowing an attacker to abuse the proxy endpoint and cause a...

PT-2023-6441 · Nextcloud +2 · Nextcloud +2

Name of the Vulnerable Software and Affected Versions: Nextcloud versions prior to 25.0.8 Nextcloud versions prior to 26.0.3 Nextcloud versions prior to 27.0.1 Description: The issue is related to the storage of OAuth2 tokens in plaintext in Nextcloud, allowing an attacker who has gained access t...

PT-2023-6442 · Nextcloud +2 · Nextcloud +2

Name of the Vulnerable Software and Affected Versions: Nextcloud versions prior to 25.0.11 Nextcloud versions prior to 26.0.6 Nextcloud versions prior to 27.1.0 Description: The issue is related to the use of Memcached as memcache.distributed in Nextcloud, which can cause the rate limiting on the...

Nextcloud Server < 22.2.10.14, 23.x < 23.0.12.9, 24.x < 24.0.12.5, 25.x < 25.0.9, 26.x < 26.0.4 Improper Access Control Vulnerability (GHSA-2hrc-5fgp-c9c9)

Nextcloud Server is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...