CVE-2021-41181 Nextcloud Talk app exposes chat messages on lockscreen

Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker...

CVE-2021-41181

The CVE affects the Nextcloud Talk Android app prior to version 12.3.0. A flaw causes the app to fail to detect the device lockscreen state when an incoming call occurs, enabling an attacker with physical access to a locked phone to access chat messages and files. Affected component: Nextcloud An...

CVE-2021-41180 Geolocation preview links can be set to arbitrary links in nextcloud talk

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only...

CVE-2021-41180 Geolocation preview links can be set to arbitrary links in nextcloud talk

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only...

CVE-2021-41180

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only...

Geolocation preview links can be set to arbitrary links

None...

Talk app did allow access to sensitive chat messages on lockscreen

None...

PT-2022-11371

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 12.1.2 Description Nextcloud talk is a self-hosting messaging service. In affected versions, an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of...

Nextcloud Talk 输入验证错误漏洞

Nextcloud Talk, a self-hosted local audio/video and chat communication service from Nextcloud Germany, is vulnerable to a user redirection vulnerability in versions prior to 12.1.2. The vulnerability stems from the system's failure to reasonably handle target jumps, which could be exploited to...

Nextcloud Talk 授权问题漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. Nextcloud Talk suffers from an authorization issue vulnerability that stems from the fact that in versions prior to 12.3.0, the Nextcloud Android Talk app fails to properly detect a locked...

PT-2022-11372 · Nextcloud · Nextcloud Talk Android

Name of the Vulnerable Software and Affected Versions: Nextcloud Android Talk App versions prior to 12.3.0 Description: Nextcloud talk is a self-hosting messaging service. The Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker...

CVE-2021-41180: URL Redirection to Untrusted Site

Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only...

CVE-2021-41181: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker...

perthturftalk.com.au Cross Site Scripting vulnerability OBB-2375959

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Solari Di Udine TermTalk Server 路径遍历漏洞

Solari Di Udine Spa Solari Di Udine TermTalk Server Solari Di Udine TtServer is an attendance management service from Solari Di Udine Spa, Italy. A security vulnerability exists in TermTalk Server TTServer version 3.24.0.2 due to a lack of effective filtering and escaping of user-submitted...

Nextcloud Talk Cross-Site Scripting Vulnerability (CNVD-2022-18416)

Nextcloud Talk, a self-hosted local audio/video and chat communication service from Germany-based Nextcloud, is vulnerable to a cross-site scripting vulnerability that could be exploited by remote attackers to inject and execute arbitrary HTML and script code in the user's browser within the...

CVE-2021-39222

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict...

CVE-2021-39222

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict...

CVE-2021-39222

Nextcloud Talk is affected by a stored XSS vulnerability in the Talk component of Nextcloud. The issue can be triggered by right-clicking a malicious file and opening it in a new tab, but exploitation is mitigated on modern browsers due to Content-Security-Policy (CSP). Remediation is to upgrade ...

CVE-2021-39222 XSS in Talk

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict...