384 matches found
Groupfolders advanced permissions is not obeyed for subfolders
None...
Code injection possible with malformed Nextcloud Talk chat commands (NC-SA-2020-021)
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...
System addressbooks can be modified by malicious trusted server
None...
Exceptions may have logged Encryption-at-Rest key content
None...
OAuth2 authorization codes are valid indefinetly
None...
Improper restriction of excessive authentication attempts on WebDAV endpoint
None...
Existance of calendars and addressbooks can be checked by unauthenticated users
None...
SQL Injection in lookup-server (NC-SA-2019-010)
Improper sanitation of user input allowed any unauthenticated user to perform SQL injection attacks...
Custom defined credentials of external storages are sent back to the frontend
None...
Missing brute force protection on password reset token
None...
No password length restriction in reset password endpoint
None...
Two-Factor Authentication not enforced for pages marked as public
None...
File path disclosure of shared files in Richdocuments application
None...
Self reflected HTML injection in Desktop client
None...
Deck card reference caching can leak data to unauthorized users
None...
Bypass of image blocking in Nextcloud Mail
None...
Stored XSS in markdown file with Nextcloud Talk using Internet Explorer (NC-SA-2021-002)
A missing link validation in Nextcloud Server 20.0.1 allowed to execute a stored XSS attack on Internet Explorer users by saving a javascript url in a Markdown...
Last video frame is still sent after video is disabled in a call
None...
File Drop can be bypassed using Richdocuments app
None...
Denial of Service by requesting to reset a password (NC-SA-2021-003)
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...
Mail app not verifying TLS host of mail servers (NC-SA-2020-020)
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
Insecure randomness for default password in file sharing when password policy app is disabled
None...
Secret Circle can be joined without approval
None...
Missing permission check on email metadata retrieval
None...
Ability to by-pass second factor
None...
Can enable/disable birthday calendar for any user
None...
Blind SSRF in the Mail app on avatar endpoint
None...
Authentication header is passed on by Nextcloud Server due to a vulnerable GuzzleHTTP version
None...
File path disclosure of shared files in OfficeOnline application
None...
XSS in Contacts
None...
End-to-end encryption device setup did not verify public key
None...
Nextcloud Talk not properly disassociating users from chats after account deletion
None...
Malicious Android app could access Shared Preferences of the Nextcloud Android client
None...
XSS in desktop client via invalid server address on login form (NC-SA-2020-027)
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...
Group admins can create users with IDs of system folders (NC-SA-2019-015)
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...
Missing brute force protection for passwords of password protected share links
None...
Desktop clients misbehaves with end-to-end encryption when the server returns an empty list of metadata keys
None...
SSRF via filter bypass due to lax checking on IPs
None...
XSS in Talk
None...
Ratelimiting can be bypassed using IPv6 subnets
None...
SSL certificate was not validated in Provider Registration Flow
None...
Alias creation did not validate account ID
None...
Missing rate limit on signup page (NC-SA-2020-033)
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...
Improper permission preservation on reshares (NC-SA-2020-012)
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...
Rate limiter not working reliable when Memcached is installed
None...
Open redirect on "Unsupported browser" warning
None...
Missing brute force protection on cloud federation sharing
None...
Talk app did allow access to sensitive chat messages on lockscreen
None...
Bypass of Two Factor Authentication
None...
Trusted servers exchange can be triggered by attacker
None...