CVE-2024-22212

Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector i...

CVE-2024-22212 Nextcloud global site selector authentication bypass

Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector i...

Open redirect in user_saml via RelayState parameter

None...

Improper handling of request URLs in Guests app allows guest users to bypass app allowlist

None...

OAuth2 authorization codes are valid indefinetly

None...

Self XSS when sending HTML as a comment in the Deck app

None...

Global site selector authentication bypass

None...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud guests that stems from the ability for all users to reset the application list for guest users. Affected...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from improper handling of request URLs, which allows users to load unallowed application pages...

Nextcloud Security Breach

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from the presence of a cross-site scripting XSS vulnerability. Affected products and versions: Deck 1.9.0 a...

Nextcloud Input Validation Error Vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An input validation error vulnerability exists in Nextcloud User Saml that originates from allowing an attacker to turn on redirection in usersaml via the...

PT-2024-19391 · Nextcloud · Nextcloud User Saml

Name of the Vulnerable Software and Affected Versions: Nextcloud User Saml versions prior to 5.1.5 Nextcloud User Saml versions prior to 5.2.5 Nextcloud User Saml versions prior to 6.0.1 Description: Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions...

PT-2024-19392 · Nextcloud · Nextcloud Guests App

Name of the Vulnerable Software and Affected Versions: Nextcloud Guests app versions prior to 2.4.1 Nextcloud Guests app versions prior to 2.5.1 Nextcloud Guests app versions prior to 3.0.1 Description: The Nextcloud guests app is a utility to create guest users which can only see files shared wi...

PT-2024-19394 · Nextcloud · Nextcloud Files Zip App

Name of the Vulnerable Software and Affected Versions: Nextcloud files Zip app versions prior to 1.2.1 Nextcloud files Zip app versions prior to 1.4.1 Nextcloud files Zip app versions prior to 1.5.0 Description: The Nextcloud files Zip app is a tool to create zip archives from one or multiple fil...

PT-2024-1285 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.0 Description: The issue concerns the expiration of OAuth codes in Nextcloud Server, a self-hosted personal cloud system. In affected versions, OAuth codes did not expire, allowing an attacker who gains...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud files Zip 1.2.0 and later, which originates from an attacker being able to download view-only files by...

PT-2024-19280

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.9.5 Nextcloud Deck versions prior to 1.11.2 Description The issue allows users to be tricked into executing malicious code in their browser via HTML sent as a comment. This is a problem with the way the...

PT-2024-19393

Name of the Vulnerable Software and Affected Versions Nextcloud guests app versions prior to 2.4.1 Nextcloud guests app versions prior to 2.5.1 Nextcloud guests app versions prior to 3.0.1 Description The Nextcloud guests app is a utility to create guest users which can only see files shared with...

CVE-2024-22402: Improper Preservation of Permissions

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It i...

CVE-2024-22401: Improper Preservation of Permissions

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or...