Nextcloud 访问控制错误漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An access control error vulnerability exists in Nextcloud Android prior to version 3.19.0, which stems from the misuse of the former account holder's...

PT-2022-19420

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.4.8 Nextcloud Deck versions prior to 1.5.6 Nextcloud Deck versions prior to 1.6.1 Description Nextcloud Deck is a Kanban-style project and personal management tool for Nextcloud. In affected versions, an...

CVE-2022-29163: Lack of Administrator Control over Security

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a pat...

CVE-2022-29159: Authorization Bypass Through User-Controlled Key

Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to a board of another user. The Nextcloud Deck app contains a patch for this issue in versions...

CVE-2022-29160: Improper Access Control

Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related details exist after deletion of a user account. This could result in misuse of the former account holder's information. Nextcloud Android...

PT-2022-19421

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions prior to 3.19.0 Description The issue concerns the existence of sensitive tokens, images, and user-related details after the deletion of a user account in Nextcloud Android. This could lead to the misuse of the forme...

CVE-2022-24906: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available...

Nextcloud信息泄露漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an information disclosure vulnerability that originates when the full path of an application is exposed to an unauthorized user...

CVE-2022-24890

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

Code injection

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

CVE-2022-24890

CVE-2022-24890 (Nextcloud Talk) affects Nextcloud Talk prior to versions 13.0.5 and 14.0.0, where a call moderator could indirectly enable a user's webcam by granting permissions that were removed. The underlying issue is exposure of webcam permissions that could be re-enabled without user consen...

CVE-2022-24890

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

PT-2022-16961

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 13.0.5 Nextcloud Talk versions prior to 14.0.0 Description The issue affects Nextcloud Talk, a video and audio conferencing app for Nextcloud. A call moderator can indirectly enable user webcams by granting...

CVE-2022-24890: Exposure of Private Personal Information to an Unauthorized Actor

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...

Nextcloud Talk 信息泄露漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. An information disclosure vulnerability exists in Nextcloud Talk versions 13.0.0 through 13.0.4, which allows remote attackers to access potentially sensitive information...

Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic

None...

Nextcloud: Password disclosure in initial setup of Mail App

Summary: https://github.com/nextcloud/mail/issues/823 Steps To Reproduce: https://github.com/nextcloud/mail/issues/823 Impact Complete access to a IMAP account and possibly if the password is the same for the NC account, complete account control...