386 matches found
Remote code execution in Nextcloud Flow via vulnerable Windmill version
None...
Deck app allows to spoof file extensions by using RTLO characters
None...
Tables app allowed users to view columns metadata information of any table
None...
Can access comments and attachments of deleted cards
None...
Duplicate setup of second factor allowed (NC-SA-2020-006)
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...
Removing emails from circles does not revoke access to shared items (NC-SA-2019-013)
Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle...
Missing default timeout on HTTP requests (NC-SA-2020-005)
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long...
Thumbnails of files leaked via Android content provider (NC-SA-2019-007)
If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, he can easily access the nextcloud-files even if the nextcloud app is locked with a fingerprint or pin...
Bypass lock protection in Android app (NC-SA-2019-008)
If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, they can circumvent the passcode protection by repeatedly opening and closing the app in a very short time...
Improper access control checks for single share previews (NC-SA-2018-014)
A missing check could give unauthorized access to the previews of single file password protected shares...
Bypass of second factor authentication on DAV endpoints by reusing a pre-2FA session ID
None...
fileId parameter reveals workflow associations in Nextcloud Approval app
None...
Share information of Tables app is not limited to affected users
None...
Social App does not validate server certificates for outgoing connections (NC-SA-2020-043)
Missing validation of server certificates for out-going connections allowed a man-in-the-middle attack...
Limit contacts photo uploading to images (NC-SA-2020-024)
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...
SSRF protection bypass in calendar subscriptions (NC-SA-2020-014)
A missing check for IPv4 nested inside IPv6 in Nextcloud server 17.0.1 allowed a SSRF when subscribing to a malicious calendar URL...
Renaming an item to a protected hidden folder deletes the target (NC-SA-2020-017)
Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name...
Reflected XSS in redirect of the Updater (NC-SA-2020-007)
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location...
App password scope can be changed for other users (NC-SA-2018-001)
A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user...
Content-Spoofing in "dav" app (NC-SA-2016-011)
The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information...
Improper authorization check on removing shares (NC-SA-2016-007)
The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation did simply unshare the file to all users in...
SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
None...
Improper access control to messages of Social app (NC-SA-2020-042)
Improper access control in Social app 0.3.1 allowed to read posts of any user...
Improper access control allows injecting tasks into other users decks (NC-SA-2020-022)
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
Improper neutralization of item names in projects feature (NC-SA-2020-009)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...
Improper authentication on public shares (NC-SA-2018-012)
A missing access check could lead to continued access to password protected link shares when the owner had changed the password...
DOM XSS vulnerability in search dialogue (NC-SA-2017-007)
Inadequate escaping lead to XSS vulnerability in the search module. To be exploitable an user has to write or paste malicious content into the search dialogue...
Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
None...
PIN bypass in PassCodeActivity via back button
None...
Desktop client created folders with world-readable and world-writable permissions on Linux
None...
Shares are not removed when user is limited to share with in their groups and being removed from one of them
None...
Improper check for access to application database (NC-SA-2018-015)
A too permissive check allowed an installed application that contained the Nextcloud client package name to obtain access to the database of the Nextcloud application. At time of disclosure there are no applications with in the Google Play Store that fullfill this requirement...
Bypass lock protection in Android app (NC-SA-2019-004)
Creating a fake multi-account and aborting the process would redirect the user to the default account of the device without asking for the lock pattern if one was set up...
Event details leaked when sharing a non-public calendar event (NC-SA-2020-013)
Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event...
Stored XSS in autocomplete suggestions for chat @-mentions (NC-SA-2018-009)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...
Link reference provider can be tricked into downloading bigger files than intended
None...
Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
None...
User can copy folder that contain files that are blocked by the files access control
None...
Open redirection when logging in with User OIDC
None...
Propfind requests for file comments allowed to load comments for other files
None...
Valid share tokens allow to access tempory upload files of share owner
None...
Logged-in user bypasses share password and download restrictions on Text attachments via documentId
None...
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
None...
Private circle can be added to another circle via API
None...
Calendar app allowed booking appointments without the generated token
None...
Tables app allowed to include local file via PhpSpreadsheet when importing a table
None...
Information Disclosure of view filter metadata via Broken Sensitive Data Masking in ViewService
None...
Test remote endpoint is not rate limited
None...