CVE-2021-39222

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict...

PT-2021-22473

Name of the Vulnerable Software and Affected Versions Nextcloud Talk versions prior to 10.0.7 Nextcloud Talk versions prior to 10.1.4 Nextcloud Talk versions prior to 11.1.2 Nextcloud Talk versions prior to 11.2.0 Nextcloud Talk versions prior to 12.0.0 Description The Nextcloud Talk application...

CVE-2021-39222: Unrestricted Upload of File with Dangerous Type

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting XSS vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict...

Nextcloud Talk 跨站脚本漏洞

Nextcloud Talk, a self-hosted local audio/video and chat communication service from Germany-based Nextcloud, is vulnerable to a cross-site scripting vulnerability that could be exploited by remote attackers to inject and execute arbitrary HTML and script code in the user's browser within the...

CVE-2021-41179

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't...

Authentication flaw

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't...

CVE-2021-41179 Two-Factor Authentication not enforced for pages marked as public

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't...

CVE-2021-41179

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as "@PublicPage" could thus be accessed with a valid user session that isn't...

XSS in Talk

None...

CVE-2021-41179: Missing Critical Step in Authentication

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as @PublicPage could thus be accessed with a valid user session that isn't...

PT-2021-23154

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.13 Nextcloud Server versions prior to 21.0.5 Nextcloud Server versions prior to 22.2.0 Description Nextcloud is an open-source, self-hosted productivity platform. The Two-Factor Authentication wasn't...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

Design/Logic Flaw

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...

CVE-2021-22952

The CVE-2021-22952 issue affects UniFi Talk applications prior to 1.12.5. Affected: UniFi Talk app versions 1.12.3 and earlier. Description: if an attacker already has network access, they can subsequently control Talk devices assigned to that network that are not yet adopted. Impact: device cont...

PT-2021-15295 · Ubiquiti · Unifi Talk

Name of the Vulnerable Software and Affected Versions: UniFi Talk application versions 1.12.3 and earlier Description: A vulnerability in the UniFi Talk application permits a malicious actor who has already gained access to a network to control Talk devices assigned to said network if they are no...

UniFi Talk 代码注入漏洞

The Ubiquiti UniFi Talk Application is a plug-and-play VoIp telephony system from Ubiquiti USA. A security vulnerability exists in UniFi Talk that allows a malicious participant who has gained access to the network to subsequently take control of Talk devices assigned to the network if they have...

CVE-2021-22952: Improper Control of Generation of Code

A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk devices assigned to said network if they are not yet adopted. This vulnerability is fixed in UniFi Talk application V1.12.5 and lat...