387 matches found
Rate-limits not working on instances without configured memory cache backend
None...
Nextcloud Text app can disclose existence of folders in "File Drop" link share
None...
Desktop client does not verify received singed certificate in end-to-end encryption
None...
Passcode bypass on Talk Android app
None...
Potential share collision for recipients when caching is enabled
None...
SSRF via filter bypass due to lax checking on IPs
None...
Permission bypass in DiskLruImageCacheFileProvider (GHSL-2021-1008)
None...
XSS in Nextcloud Text application
None...
Bypass of image blocking in Nextcloud Mail
None...
SMTP Command Injection in iCalendar Attachments to emails via newlines
None...
OAuth2 client secrets were stored in a recoverable way
None...
Global site selector authentication bypass
None...
Text does not respect "Allow download" permissions
None...
Ability to control the filename when uploading a logo or favicon as admin in the theming settings
None...
Last video frame is still sent after video is disabled in a call
None...
Code injection possible with malformed Nextcloud Talk chat commands (NC-SA-2020-021)
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...
User scoped external storage can be used to gather credentials of other users
None...
Possibility to delete files attached to deck cards of other users
None...
Access to internal files of the Nextcloud Android app from within the Nextcloud Android app
None...
Geolocation preview links can be set to arbitrary links
None...
Trusted servers exchange can be triggered by attacker
None...
Guests can continue to receive video streams from call after being removed from a conversation
None...
When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
None...
Can bypass the lock protection in Android Files app
None...
Lack of ratelimit on public DAV endpoint
None...
Audit log is not properly logging unsetting of share expiration date
None...
Can enable/disable birthday calendar for any user
None...
Stored XSS via Authorization Endpoint - Safari-Only
None...
Possibility for anyone to add a stack with existing tasks on anyone's board in the Deck app
None...
Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
None...
Exceptions may have logged Encryption-at-Rest key content
None...
Filenames not escaped by default in controllers using DownloadResponse
None...
Default settings leak federated cloud ID to lookup server of all users
None...
Ability to by-pass second factor
None...
OAuth2 authorization codes are valid indefinetly
None...
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
None...
Ownership check missing when updating or deleting mail attachments
None...
Deck shared with a Circle can be accessed by non-Circle members
None...
XSS in Nextcloud Circles
None...
HTML injection in search UI when selecting a circle with HTML in the display name
None...
Improper restriction of excessive authentication attempts on WebDAV endpoint
None...
User without download rights can download older version of that file
None...
Two-Factor Authentication not enforced for pages marked as public
None...
File path disclosure of shared files in Richdocuments application
None...
Bypass of Two Factor Authentication
None...
Mail app not verifying TLS host of mail servers (NC-SA-2020-020)
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
Mail app does not respect download permissions in shares
None...
Existance of calendars and addressbooks can be checked by unauthenticated users
None...