392 matches found
Nextcloud Text app can disclose existence of folders in "File Drop" link share
None...
XSS in Nextcloud Text application
None...
Nextcloud Talk not properly disassociating users from chats after account deletion
None...
User scoped external storage can be used to gather credentials of other users
None...
Scope of workflow operations is not validated
None...
SMTP Command Injection in iCalendar Attachments to emails via newlines
None...
Desktop client does not verify received singed certificate in end-to-end encryption
None...
Permission bypass in DiskLruImageCacheFileProvider (GHSL-2021-1008)
None...
Can bypass the lock protection in Android Files app
None...
XSS in Nextcloud Circles
None...
Access to internal files of the Nextcloud Android app from within the Nextcloud Android app
None...
Mail app not verifying TLS host of mail servers (NC-SA-2020-020)
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack...
OAuth2 client secrets were stored in a recoverable way
None...
Potential share collision for recipients when caching is enabled
None...
Stored XSS via Authorization Endpoint - Safari-Only
None...
Last video frame is still sent after video is disabled in a call
None...
Bypass of image blocking in Nextcloud Mail
None...
Trusted servers exchange can be triggered by attacker
None...
Code injection possible with malformed Nextcloud Talk chat commands (NC-SA-2020-021)
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...
SSRF via filter bypass due to lax checking on IPs
None...
When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
None...
Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
None...
Lack of ratelimit on public DAV endpoint
None...
Global site selector authentication bypass
None...
HTML injection in search UI when selecting a circle with HTML in the display name
None...
Can enable/disable birthday calendar for any user
None...
Text does not respect "Allow download" permissions
None...
Ability to control the filename when uploading a logo or favicon as admin in the theming settings
None...
Possibility to delete files attached to deck cards of other users
None...
File path disclosure of shared files in Richdocuments application
None...
Exceptions may have logged Encryption-at-Rest key content
None...
Audit log is not properly logging unsetting of share expiration date
None...
OAuth2 authorization codes are valid indefinetly
None...
Possibility for anyone to add a stack with existing tasks on anyone's board in the Deck app
None...
Geolocation preview links can be set to arbitrary links
None...
Bypass of Two Factor Authentication
None...
Default settings leak federated cloud ID to lookup server of all users
None...
Mail app does not respect download permissions in shares
None...
Guests can continue to receive video streams from call after being removed from a conversation
None...
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
None...
Groupfolders advanced permissions is not obeyed for subfolders
None...
WOPI API not protected by credentials/IP check
None...
File path disclosure of shared files in Nextcloud Text application
None...
User without download rights can download older version of that file
None...
Generated passwords are not fully validated by HIBPValidator
None...
Deck shared with a Circle can be accessed by non-Circle members
None...
Malicious Android app could access Shared Preferences of the Nextcloud Android client
None...
Denial of Service by requesting to reset a password (NC-SA-2021-003)
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...