Nextcloud 代码问题漏洞

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Contacts application prior to version 4.0.3 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side...

PT-2021-22475

Name of the Vulnerable Software and Affected Versions Nextcloud OfficeOnline versions prior to 1.1.1 Description The Nextcloud OfficeOnline application returned verbatim exception messages to the user, which could result in a full path disclosure on shared files. For example, an attacker could se...

Nextcloud 安全漏洞

Nextcloud is an open source set of self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. Nextcloud Deck is vulnerable to an access control error in versions prior to 1.2.9, 1.4.5 and 1.5.3. The vulnerability stems from a lack of permission...

Nextcloud 信息泄露漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Nextcloud Germany. nextcloud OfficeOnline applications prior to version 1.1.1 are vulnerable to an information disclosure vulnerability in which the vulnerable application returns...

PT-2021-22474

Name of the Vulnerable Software and Affected Versions Nextcloud Richdocuments versions prior to 3.8.6 and 4.2.3 Description The Nextcloud Richdocuments application returned verbatim exception messages to the user, which could result in a full path disclosure on shared files. For example, an...

Nextcloud 输入验证错误漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication applications platform from Germany-based Nextcloud. Nextcloud Mail applications prior to versions 1.10.4 and 1.11.0 are vulnerable to an information disclosure vulnerability that stems from a privacy filt...

CVE-2021-39223: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. e.g. an attacker could see that the file...

Nextcloud 安全漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Nextcloud, a German company. nextcloud has a security vulnerability that stems from an improper design or implementation during the development of code for a networked system or...

CVE-2021-41178: Relative Path Traversal

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishi...

PT-2021-22472

Name of the Vulnerable Software and Affected Versions Nextcloud Contacts versions prior to 4.0.3 Description The Nextcloud Contacts application is vulnerable to a stored Cross-Site Scripting XSS issue. To exploit this, a user must right-click on a malicious file and open it in a new tab. However,...

CVE-2021-39221: Unrestricted Upload of File with Dangerous Type

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due t...

CVE-2021-39224: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. e.g. an attacker could see that the file shared.txt is locat...

Nextcloud: When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL

Summary: This report is similar to 1337178 In Nextcloud Deck a user can post their decks in to a conversation via nextcloud talk. The link in metaData can be manipulated to point to a another URL. Steps To Reproduce: 0. Setup burpsuite to proxy 1. Go to Nextcloud Deck and pick a board 2. Pick any...

Nextcloud: Read-only users can restore old versions

Read-only users were able to restore old versions of files in Nextcloud...

Nextcloud: Error in Deleting Deck cards attachment reveals the full path of the website

Summary: An error in deck cards when deleting an attachment reveals the full path of the website. DELETE /apps/deck/cards/11/attachment/file:1 HTTP/2 Host: ctulhu.me/nc Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99" Accept: application/json, text/plain, / Sec-Ch-Ua-Mobile: ?0 User-Agent:...

MGASA-2021-0421 Updated nextcloud-client packages fix security vulnerability

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. CVE-2021-22895 In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to...

Updated nextcloud-client packages fix security vulnerability

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. CVE-2021-22895 In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to...

Debian: Security Advisory (DSA-4974-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nextcloud Desktop Authentication

The vulnerability of the Nextcloud desktop synchronization tool’s client lies in the lack of SSL certificate verification when using the “Register with a Provider” protocol. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

[SECURITY] [DSA 4974-1] nextcloud-desktop security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4974-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 19, 2021 https://www.debian.org/security/faq -...