384 matches found
Passcode bypass on Talk Android app
None...
Access to internal files of the Nextcloud Android app from within the Nextcloud Android app
None...
Nextcloud Text app can disclose existence of folders in "File Drop" link share
None...
Nextcloud Talk not properly disassociating users from chats after account deletion
None...
Global site selector authentication bypass
None...
Can enable/disable birthday calendar for any user
None...
Text does not respect "Allow download" permissions
None...
Missing brute force protection on password confirmation modal
None...
SSRF via filter bypass due to lax checking on IPs
None...
Permission bypass in DiskLruImageCacheFileProvider (GHSL-2021-1008)
None...
Ability to control the filename when uploading a logo or favicon as admin in the theming settings
None...
Possibility to delete files attached to deck cards of other users
None...
Stored XSS via Authorization Endpoint - Safari-Only
None...
Geolocation preview links can be set to arbitrary links
None...
Last video frame is still sent after video is disabled in a call
None...
Possibility for anyone to add a stack with existing tasks on anyone's board in the Deck app
None...
Deck shared with a Circle can be accessed by non-Circle members
None...
Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
None...
Can bypass the lock protection in Android Files app
None...
Trusted servers exchange can be triggered by attacker
None...
Default settings leak federated cloud ID to lookup server of all users
None...
Guests can continue to receive video streams from call after being removed from a conversation
None...
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
None...
SMTP Command Injection in iCalendar Attachments to emails via newlines
None...
When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
None...
XSS in Nextcloud Circles
None...
Code injection possible with malformed Nextcloud Talk chat commands (NC-SA-2020-021)
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator...
OAuth2 client secrets were stored in a recoverable way
None...
Ability to by-pass second factor
None...
Generated passwords are not fully validated by HIBPValidator
None...
Ownership check missing when updating or deleting mail attachments
None...
File path disclosure of shared files in Richdocuments application
None...
Exceptions may have logged Encryption-at-Rest key content
None...
Audit log is not properly logging unsetting of share expiration date
None...
OAuth2 authorization codes are valid indefinetly
None...
Improper restriction of excessive authentication attempts on WebDAV endpoint
None...
Groupfolders advanced permissions is not obeyed for subfolders
None...
Filenames not escaped by default in controllers using DownloadResponse
None...
Existance of calendars and addressbooks can be checked by unauthenticated users
None...
Two-Factor Authentication not enforced for pages marked as public
None...
WOPI API not protected by credentials/IP check
None...
Lack of ratelimit on public DAV endpoint
None...
All users can reset the allowed apps list for Guest App users
None...
User without download rights can download older version of that file
None...
Missing brute force protection on password reset token
None...
Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link
None...
Bypass of Two Factor Authentication
None...
Denial of Service by requesting to reset a password (NC-SA-2021-003)
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...