386 matches found
Linux client is vulnerable to directory traversal when downloading files (NC-SA-2020-032)
Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory...
Improper share updates could result in extended data access (NC-SA-2019-003)
A bug could expose more data in reshared link shares than intended by the sharer...
Stored XSS in contacts via group shares (NC-SA-2018-005)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...
Stored XSS in Gallery application (NC-SA-2017-010)
A JavaScript library used by Nextcloud for sanitizing untrusted user-input suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2.Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers...
Users can set up workflows using restricted and invisible system tags
None...
Full path of data directory exposed to users
None...
Reflected XSS in svg logo generation (NC-SA-2019-018)
A reflected Cross-Site Scripting vunerability was discovered in the svg generation...
Query restriction bypass on exposed FileContentProvider in Android app (NC-SA-2019-011)
Not strictly enough sanitization allowed an attacker to get content information from protected tables when using custom queries...
Stored XSS in autocomplete suggestions for file comments (NC-SA-2018-008)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...
Stored XSS in calendar via group shares (NC-SA-2018-004)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...
File access control rules not applied to image previews (NC-SA-2018-002)
A missing check for read permissions allowed users that received an incomming share containing files tagged so they should be denied access to still request a preview for those files...
Limitation of app specific password scope can be bypassed (NC-SA-2017-009)
Improper session handling allowed an application specific password without permission to the files access to the users file...
Reflected XSS in Gallery application (NC-SA-2016-009)
The gallery app was not properly sanitizing exception messages from the Nextcloud server. Due to an endpoint where an attacker could influence the error message this lead to a reflected Cross-Site-Scripting vulnerability...
Content-Spoofing in "files" app (NC-SA-2016-003)
The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...
End-to-end encryption device setup did not verify public key
None...
Lack of ratelimit on public share link mount endpoint
None...
Default Nextcloud Server and Android Client leak sharee searches to Nextcloud
None...
Possible denial of service when entering a long password (NC-SA-2020-028)
Improper check of inputs in Preferred providers app 1.6.0 allowed to perform a denial of service attack when using a very long password...
Missing permission check on resharing a board (NC-SA-2020-025)
Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves...
Name of private conversations leaked when linked via projects to a shared item (NC-SA-2020-011)
Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature...
Bypass lock protection in Android app (NC-SA-2019-006)
If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, they can easily access the nextcloud-files even if the nextcloud app is locked with a fingerprint or pin...
Server-Side request forgery in New-Subscription feature of the calendar app (NC-SA-2019-014)
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application...
Denial of Service attack (NC-SA-2017-004)
Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service...
Stored XSS in "gallery" application (NC-SA-2016-001)
Due to a recent migration of the Gallery app to the new sharing endpoint a parameter changed from an integer to a string value. This value wasn't sanitized before and was thus now vulnerable to a Cross-Site-Scripting attack.To exploit this vulnerability an authenticated attacker has to share a...
Calendar attachments of local files are offered to downloaded
None...
Improper handling of request URLs in Guests app allows guest users to bypass app allowlist
None...
user_oidc app stores client secret unencrypted in database
None...
Lack of ratelimit on shareinfo endpoint
None...
Improper integrity protection of server-side encryption keys (NC-SA-2020-041)
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys...
Re-Sharing allows increase of privileges (NC-SA-2020-029)
A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves...
Arbitrary code execution in desktop client via OpenSSL config (NC-SA-2020-030)
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory...
Workflow rules only check the file extension for the mimetype instead of the content (NC-SA-2020-002)
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes...
Improper neutralization of item names in projects feature (NC-SA-2020-008)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...
Improper sanitization of HTML in directory names (NC-SA-2019-009)
Some basic HTML tags were rendered as Markup in directory names...
Classification of calendar events is ignored by the activity stream (NC-SA-2019-001)
A missing check revealed the name of confidential events and private events to all users of a shared calendar...
Calendar and addressbook names disclosed (NC-SA-2017-012)
A logical error caused disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and adressbook has been disclosed...
Bypassing quota limitation (NC-SA-2017-005)
Due to not properly sanitzing values provided by the OC-Total-Length HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator...
Missing memory corruption protection on Windows release built (NC-SA-2020-035)
Missing ASLR and DEP protections in Nextcloud Desktop Client 2.6.4 for windows allowed to corrupt memory...
File-drop content is visible through the gallery app (NC-SA-2019-012)
Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app...
Improper access control checks for share expiration date (NC-SA-2019-002)
A missing check could give recipient the possibility to extend the expiration date of a share they received...
Share tokens for public calendars disclosed (NC-SA-2017-011)
A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...
Permission increase on re-sharing via OCS API (NC-SA-2017-001)
A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set.Note that this only affects folders and files that th...
Error message discloses existence of file in write-only share (NC-SA-2017-003)
Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages...
Content-Spoofing in "files" app (NC-SA-2016-010)
The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...
Edit permission check not enforced on WebDAV COPY action (NC-SA-2016-004)
The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files...
Admins can change authentication details of user configured external storage
None...
Memory Leak in OCUtil.dll library in Desktop client can lead to DoS (NC-SA-2020-034)
A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system...
Improper neutralization of item names in projects feature (NC-SA-2020-010)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...
Session fixation on public share page (NC-SA-2018-013)
A bug causing session fixation could potentially allow an attacker to obtain access to password protected shares...
Stored XSS in CardDAV image export (NC-SA-2016-008)
The CardDAV image export functionality as implemented in Nextcloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.Note: Nextcloud employs a very strict Content Security...