CVE-2023-30540 Chat poll data can still be queried from API after purging history in Nextcloud talk

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it...

CVE-2023-30540 Chat poll data can still be queried from API after purging history in Nextcloud talk

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it...

CVE-2023-30540

CVE-2023-30540 affects Nextcloud Talk (Nextcloud extension). A user added later to a conversation could access data that had already been deleted before their addition, representing an information disclosure. The issue has been patched in Nextcloud Talk 15.0.5; upgrading to 15.0.5 is recommended....

CVE-2023-30540 Chat poll data can still be queried from API after purging history in Nextcloud talk

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it...

Chat poll data can still be queried from API after purging history of a chat converstion

None...

PT-2023-22767 · Nextcloud · Nextcloud Talk

Name of the Vulnerable Software and Affected Versions: Nextcloud Talk versions prior to 15.0.5 Description: The issue allows a user added later to a conversation to access data that was deleted before they were added. This is a problem in Nextcloud Talk, a chat, video, and audio call extension fo...

SUSE CVE-2023-28845

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they...

SUSE CVE-2023-26041

Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to...

CVE-2023-28845

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they...

Design/Logic Flaw

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they...

CVE-2023-28845

CVE-2023-28845 affects Nextcloud Talk (the video/audio conferencing app) and stems from improper filtering of access to a conversation’s member list. This could allow an attacker to retrieve information about members of a Talk conversation even if they are not a member themselves. Public disclosu...

CVE-2023-28845 Chat room membership disclosed via autocompletion in Nextcloud talk

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they...

CVE-2023-28845 Chat room membership disclosed via autocompletion in Nextcloud talk

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they...

CVE-2023-28845 Chat room membership disclosed via autocompletion in Nextcloud talk

Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they...

Chat room membership disclosed via autocompletion when not a member yourself

None...

Nextcloud 访问控制错误漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud talk suffers from an access control error vulnerability that stems from an inability to properly filter access to a list of users. An attacker...

A Hacker’s Mind News

My latest book continues to sell well. Its ranking hovers between 1,500 and 2,000 on Amazon. Its been spied in airports. Reviews are consistently good. I have been enjoying giving podcast interviews. It all feels pretty good right now. You can order a signed book from me here. For those of you in...

CVE-2023-26041

Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to...

Code injection

Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to...

CVE-2023-26041

The CVE-2023-26041 issue affects Nextcloud Talk: when cron jobs are misconfigured, expired messages are not actually expired and the API still returns them, with frontend hiding not applied. This results in conversations showing messages that should have expired. Affected product: Nextcloud Talk ...