CVE-2023-23944: Cleartext Storage of Sensitive Information

Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user...

Nextcloud 安全漏洞

An information disclosure vulnerability exists in Nextcloud, an open source, self-hosted file synchronization and sharing communications application platform from Nextcloud Germany. The vulnerability stems from the fact that user passwords are stored in plaintext in the database during the OAuth2...

Nextcloud 跨站脚本漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A cross-site scripting vulnerability exists in Nextcloud Desktop Client versions prior to 3.6.3, which stems from a lack of cleanup of qml tags, leading to...

PT-2023-19313 · Nextcloud +2 · Nextcloud Desktop Client +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.6.3 Description: The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. It is missing sanitisation on qml labels used for basic HTML elements such a...

PT-2023-19314

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 2.2.2 Description The issue concerns the storage of user passwords in cleartext in the database during the OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to...

CVE-2023-23943: Server-Side Request Forgery (SSRF)

Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is...

CVE-2023-23942: Improper Neutralization of Input During Web Page Generation

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation...

PT-2023-2378 · Nextcloud +2 · Nextcloud +2

Name of the Vulnerable Software and Affected Versions: Nextcloud versions 25.0.0 through 25.0.2 Description: The issue is related to Uncontrolled Resource Consumption in Nextcloud, an Open Source private cloud software. A user can configure a very long password, which consumes more resources on...

PT-2023-8425 · Nextcloud +1 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 24.0.x through 24.0.7 Nextcloud Server versions 25.0.x through 25.0.0 Nextcloud Enterprise Server versions 24.0.x through 24.0.7 Nextcloud Enterprise Server versions 25.0.x through 25.0.0 Nextcloud Office Richdocumen...

PT-2023-19947 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 25.0.1 Nextcloud Server versions prior to 24.0.8 Nextcloud Server versions prior to 23.0.12 Nextcloud Enterprise Server versions prior to 25.0.1 Nextcloud Enterprise Server versions prior to 24.0.8 Nextcloud...

PT-2023-2377 · Nextcloud +2 · Nextcloud +2

Name of the Vulnerable Software and Affected Versions: Nextcloud versions 24.0.4 through 24.0.6 Nextcloud versions 25.0.0 Description: The issue is related to improper access control in Nextcloud, a private cloud software. This can allow a remote attacker to gain unauthorized access to limited...

PT-2023-2471 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 24.0.9 Nextcloud Server versions prior to 25.0.3 Description: The issue is related to the handling of shared resources with the same name in Nextcloud Server, particularly when a memory cache is configured. ...

PT-2023-20176 · Nextcloud +1 · Nextcloud +1

Name of the Vulnerable Software and Affected Versions: Nextcloud server versions prior to 25.0.2 Nextcloud server versions prior to 24.0.8 Nextcloud server versions prior to 23.0.12 Description: The issue concerns the OCFilesNodeFolder::getFullPath function, which was validating and normalizing...

PT-2023-2470 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud server versions 25.0.0 through 25.0.2 Description: The issue is related to an inefficient fetch operation that may impact server performance and/or lead to a denial of service. This can be exploited by a remote attacker to initiate ...

Nextcloud: Chat room member disclosure via autocomplete API

It was possible to find out who is in a Spreed chat room using the autocomplete API, even if the person is not a member of the room. This vulnerability could have been exploited to gain information about the members of a chat room for malicious purposes...

Nextcloud: Full Passcode bypass on Nextcloud App iOS

Vulnerability description not provided...

Nextcloud: Missing brute force protection on password confirmation modal

A vulnerability was found in Nextcloud that allowed an attacker to bypass password protection and view a user's current password in cleartext. This was possible due to a lack of rate limit on the endpoints for generating backup codes, deleting accounts, and updating profiles. The vulnerability wa...

Nextcloud: Error in Booking an appointment reveals the full path of the website

A vulnerability in Nextcloud allowed users to reveal internal paths of the website when booking an appointment with SMTP configuration. An attacker could exploit this vulnerability to gain sensitive information about the website's internal structure...

Nextcloud Resource Management Error Vulnerability (CNVD-2023-04308)

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Deck is vulnerable to a resource management error, which stems from a database error that can be generated when executed multiple times, leading to a DoS...

PT-2023-19948 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 24.0.8 and prior to 23.0.12 Nextcloud Enterprise Server versions prior to 24.0.8 and prior to 23.0.12 Description: The issue concerns server-side request forgery SSRF, where attackers can leverage enclosed...