386 matches found
Missing brute force protection on password confirmation modal
None...
Nextcloud Text app can disclose existence of folders in "File Drop" link share
None...
Nextcloud Talk not properly disassociating users from chats after account deletion
None...
All users can reset the allowed apps list for Guest App users
None...
SSRF via filter bypass due to lax checking on IPs
None...
XSS in Nextcloud Text application
None...
User scoped external storage can be used to gather credentials of other users
None...
Passcode bypass on Talk Android app
None...
Permission bypass in DiskLruImageCacheFileProvider (GHSL-2021-1008)
None...
Global site selector authentication bypass
None...
Can enable/disable birthday calendar for any user
None...
Text does not respect "Allow download" permissions
None...
Ability to control the filename when uploading a logo or favicon as admin in the theming settings
None...
Possibility to delete files attached to deck cards of other users
None...
Guests can continue to receive video streams from call after being removed from a conversation
None...
Last video frame is still sent after video is disabled in a call
None...
Access to internal files of the Nextcloud Android app from within the Nextcloud Android app
None...
Possibility for anyone to add a stack with existing tasks on anyone's board in the Deck app
None...
Stored XSS via Authorization Endpoint - Safari-Only
None...
SMTP Command Injection in iCalendar Attachments to emails via newlines
None...
Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
None...
Geolocation preview links can be set to arbitrary links
None...
Exceptions may have logged Encryption-at-Rest key content
None...
Trusted servers exchange can be triggered by attacker
None...
Deck shared with a Circle can be accessed by non-Circle members
None...
Default settings leak federated cloud ID to lookup server of all users
None...
Code injection possible with malformed Nextcloud Talk chat commands (NC-SA-2020-021)
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...
OAuth2 client secrets were stored in a recoverable way
None...
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
None...
When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
None...
Can bypass the lock protection in Android Files app
None...
XSS in Nextcloud Circles
None...
Filenames not escaped by default in controllers using DownloadResponse
None...
User without download rights can download older version of that file
None...
Generated passwords are not fully validated by HIBPValidator
None...
File path disclosure of shared files in Richdocuments application
None...
Audit log is not properly logging unsetting of share expiration date
None...
Ability to by-pass second factor
None...
OAuth2 authorization codes are valid indefinetly
None...
Groupfolders advanced permissions is not obeyed for subfolders
None...
Bypass of Two Factor Authentication
None...
Bypass of image blocking in Nextcloud Mail
None...
Lack of ratelimit on public DAV endpoint
None...
Denial of Service by requesting to reset a password (NC-SA-2021-003)
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...
Mail app not verifying TLS host of mail servers (NC-SA-2020-020)
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
Improper restriction of excessive authentication attempts on WebDAV endpoint
None...
Existance of calendars and addressbooks can be checked by unauthenticated users
None...
Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link
None...