557 matches found
CVE-2021-32676
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded t...
Code injection
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded t...
CVE-2021-32676
Nextcloud Talk suffers a session fixation vulnerability: password-protected shared talks did not rotate the session cookie after authentication in versions prior to 9.0.10, 10.0.8 and 11.2.2. Exploitation could allow an attacker to hijack a guest session. Remediation is to upgrade the Nextcloud T...
Nextcloud Talk Authorization Issues Vulnerability (CNVD-2021-44989)
Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. An authorization issue vulnerability exists in Nextcloud Talk that stems from unchanged cookie session data after changing authentication information in Talk. No details of the vulnerability a...
Session Fixation in Nextcloud Talk
None...
Nextcloud Talk 授权问题漏洞
Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. An authorization issue vulnerability exists in Nextcloud Talk that stems from unchanged cookie session data after changing authentication information in Talk. No details of the vulnerability a...
#LetsTalkSecurity: Transformational Security
Let's Talk Security: Season 02 // Episode 01: Host, Rik Ferguson, interviews Business Information Security Officer from S Global Ratings, Alyssa Miller. Together they discuss transformational security...
Nextcloud: Talk discloses turn server to anybody
The attack is straight forward. 1. send a request to bash curl -H 'OCS-APIREQUEST: true' https://server/ocs/v2.php/apps/spreed/api/v2/signaling/settings And you get back a lot of information. signaling server stun server turn server inc credentials The stun server is harmless enough. I did not lo...
The Story of Colossus
Nice video of a talk by Chris Shore on the history of Colossus...
Nextcloud: Session fixation on public talk links
userA shares a talk room and protects it with a password 2. userB opens links but doesn't enter the password yet 3. Attacker steals the cookies from userB 4. userB logs in 5. attacker is now also able to read the conversation etc Impact In short the attacker is able to take over the session of...
Rockwell Automation FactoryTalk Services Platform Security Vulnerability
The Rockwell Automation FactoryTalk Services Platform is a suite of services platforms from Rockwell Automation, USA, consisting of multiple products that provide applications with routine services such as diagnostic information, health monitoring, and real-time data access. FactoryTalk Services...
Linux: Disabled talk server
The talk software makes it possible for users to send and receive messages across systems through a terminal session. The talk client allows initiate of talk sessions is installed by default. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...
Stored XSS in markdown file with Nextcloud Talk using Internet Explorer (NC-SA-2021-002)
A missing link validation in Nextcloud Server 20.0.1 allowed to execute a stored XSS attack on Internet Explorer users by saving a javascript url in a Markdown...
Nextcloud: Stored XSS in markdown file with Nextcloud Talk using Internet Explorer
While editing a markdown file through the text app, users can create link elements that have a javascript URL such as javascript:alert1. Steps to reproduce: While editing a markdown file, select some text and click the "Add Link" button. Using a web proxy, intercept the request and change the hre...
More on NIST's Post-Quantum Cryptography
Back in July, NIST selected third-round algorithms for its post-quantum cryptography standard. Recently, Daniel Apon of NIST gave a talk detailing the selection criteria. Interesting stuff. NOTE: We're in the process of moving this blog to Wordpress. Comments will be disabled until the move it...
CVE-2020-1894
A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk...
talkvideofree.info Cross Site Scripting vulnerability OBB-1257063
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Nextcloud Talk Code Injection Vulnerability
Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. A code injection vulnerability exists in Nextcloud Talk versions 6.0.4, 7.0.2, and 8.0.7, which stems from the program failing to properly clean up Talk commands. An attacker could exploit the...
