CVE-2023-45150

CVE-2023-45150 concerns Nextcloud Calendar. The Red Hat/Reddit/GHSA and CVE records describe a flaw in the Nextcloud Calendar app where missing precondition checks allow handling of arbitrarily long strings (e.g., overly long email addresses), leading to a busy, unresponsive server and potential ...

CVE-2023-45150 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45150

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45150 Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

CVE-2023-45149 Password of talk conversations can be bruteforced in Nextcloud

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the...

CVE-2023-45149

CVE-2023-45149 affects Nextcloud Talk. Root cause: brute-force protection for public talk conversation passwords can be bypassed because the authentication endpoint validates the password without applying bruteforce protection. Affected: Nextcloud Talk versions prior to 15.0.8, 16.0.6, or 17.1.1....

CVE-2023-45149

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the...

CVE-2023-45149 Password of talk conversations can be bruteforced in Nextcloud

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the...

CVE-2023-45149 Password of talk conversations can be bruteforced in Nextcloud

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the...

CVE-2023-45148

Nextcloud is an open source home cloud server. When Memcached is used as "memcache.distributed" the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

CVE-2023-45148 Rate limiter not working reliable when Memcached is installed in Nextcloud

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

CVE-2023-45148

Technical details about CVE-2023-45148 are not publicly available in the provided connected documents. Monitor for updates from Nextcloud advisories to obtain concrete affected versions, impact, and remediation information.

CVE-2023-45151

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45151

CVE-2023-45151 affects Nextcloud Server where OAuth2 tokens were stored in plaintext on affected installations. The root cause is storage of OAuth2 tokens in plaintext on the server, enabling an attacker with server access to potentially elevate privileges. Affected versions were addressed by upg...

CVE-2023-45151 OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

CVE-2023-45660

CVE-2023-45660 affects Nextcloud Mail. The vulnerability arises from a missing check of origin, target and cookies in the image proxy/endpoint, enabling an attacker to abuse the proxy and cause a denial of service to a third server. Affected versions are Nextcloud Mail prior to 2.2.8 and prior to...