6234 matches found
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
CVE-2020-8154
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint...
Design/Logic Flaw
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint...
CVE-2020-8155
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF...
Design/Logic Flaw
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
Cross site scripting
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF...
CVE-2020-8155
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF...
CVE-2020-8155
CVE-2020-8155 is addressed in Nextcloud security updates across multiple distributions. OpenSUSE and Fedora advisories show Nextcloud updates (e.g., openSUSE-2020-670, openSUSE-2020-0670-1, FEDORA_2020-C9863904DE/NASLs) that fix CVE-2020-8155. The openSUSE entries describe CVE-2020-8155 as a dire...
CVE-2020-8154
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint...
CVE-2020-8154
CVE-2020-8154 is an Insecure Direct Object Reference in Nextcloud Server (noted against 18.0.x) that allowed an attacker to remotely wipe other users’ devices via a crafted request to the affected endpoint. Publicly referenced advisories (openSUSE/OpenSUSE-SU-2020:0670-1 and openSUSE-670) associa...
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
CVE-2020-8156
CVE-2020-8156: Nextcloud Mail 1.1.3 has missing TLS host verification, enabling a man-in-the-middle attack. Affected component: Nextcloud Mail 1.1.3. Root cause: inadequate TLS host verification. Impact: potential eavesdropping/alteration of mail data (confidentiality/integrity) and partial avail...
CVE-2020-8156: Improper Certificate Validation
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
CVE-2020-8155: Improper Neutralization of Input During Web Page Generation
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF...
PT-2020-19989
Name of the Vulnerable Software and Affected Versions Nextcloud Server version 18.0.2 Description An issue in Nextcloud Server allowed an attacker to remotely wipe devices of other users by sending a malicious request directly to an endpoint. Recommendations For Nextcloud Server version 18.0.2,...
PT-2020-19990
Name of the Vulnerable Software and Affected Versions Nextcloud Server version 18.0.2 Description The issue is caused by an outdated 3rd party library in the Files PDF viewer, leading to a Cross-site scripting vulnerability when opening a malicious PDF. Recommendations For Nextcloud Server versio...
CVE-2020-8154: Authorization Bypass Through User-Controlled Key
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint...
PT-2020-19991 · Nextcloud · Nextcloud Mail
Name of the Vulnerable Software and Affected Versions: Nextcloud Mail version 1.1.3 Description: A missing verification of the TLS host allowed a man-in-the-middle attack. Recommendations: For Nextcloud Mail version 1.1.3, update to a version that includes the fix for the missing TLS host...