392 matches found
Classification of calendar events is ignored by the activity stream (NC-SA-2019-001)
A missing check revealed the name of confidential events and private events to all users of a shared calendar...
Improper access control checks for share expiration date (NC-SA-2019-002)
A missing check could give recipient the possibility to extend the expiration date of a share they received...
Bypassing quota limitation (NC-SA-2017-005)
Due to not properly sanitzing values provided by the OC-Total-Length HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator...
Error message discloses existence of file in write-only share (NC-SA-2017-003)
Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages...
Stored XSS in "gallery" application (NC-SA-2016-001)
Due to a recent migration of the Gallery app to the new sharing endpoint a parameter changed from an integer to a string value. This value wasn't sanitized before and was thus now vulnerable to a Cross-Site-Scripting attack.To exploit this vulnerability an authenticated attacker has to share a...
SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
None...
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
None...
Private circle can be added to another circle via API
None...
Logged-in user bypasses share password and download restrictions on Text attachments via documentId
None...
Test remote endpoint is not rate limited
None...
Admins can change authentication details of user configured external storage
None...
XSS in Desktop Client in call notification popup
None...
Re-Sharing allows increase of privileges (NC-SA-2020-029)
A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves...
Possible denial of service when entering a long password (NC-SA-2020-028)
Improper check of inputs in Preferred providers app 1.6.0 allowed to perform a denial of service attack when using a very long password...
SSRF protection bypass in calendar subscriptions (NC-SA-2020-014)
A missing check for IPv4 nested inside IPv6 in Nextcloud server 17.0.1 allowed a SSRF when subscribing to a malicious calendar URL...
Bypass lock protection in Android app (NC-SA-2019-008)
If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, they can circumvent the passcode protection by repeatedly opening and closing the app in a very short time...
Calendar and addressbook names disclosed (NC-SA-2017-012)
A logical error caused disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and adressbook has been disclosed...
Permission increase on re-sharing via OCS API (NC-SA-2017-001)
A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set.Note that this only affects folders and files that th...
PIN bypass in PassCodeActivity via back button
None...
Limit contacts photo uploading to images (NC-SA-2020-024)
A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars...
Bypass lock protection in Android app (NC-SA-2019-004)
Creating a fake multi-account and aborting the process would redirect the user to the default account of the device without asking for the lock pattern if one was set up...
Session fixation on public share page (NC-SA-2018-013)
A bug causing session fixation could potentially allow an attacker to obtain access to password protected shares...
Share tokens for public calendars disclosed (NC-SA-2017-011)
A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...
Stored XSS in CardDAV image export (NC-SA-2016-008)
The CardDAV image export functionality as implemented in Nextcloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.Note: Nextcloud employs a very strict Content Security...
Propfind requests for file comments allowed to load comments for other files
None...
Improper access control allows injecting tasks into other users decks (NC-SA-2020-022)
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks...
Reflected XSS in redirect of the Updater (NC-SA-2020-007)
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location...
Improper access control checks for single share previews (NC-SA-2018-014)
A missing check could give unauthorized access to the previews of single file password protected shares...
Content-Spoofing in "dav" app (NC-SA-2016-011)
The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information...
Edit permission check not enforced on WebDAV COPY action (NC-SA-2016-004)
The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files...
Improper check for access to application database (NC-SA-2018-015)
A too permissive check allowed an installed application that contained the Nextcloud client package name to obtain access to the database of the Nextcloud application. At time of disclosure there are no applications with in the Google Play Store that fullfill this requirement...
Improper authentication on public shares (NC-SA-2018-012)
A missing access check could lead to continued access to password protected link shares when the owner had changed the password...
Calendar app allowed booking appointments without the generated token
None...
Shares are not removed when user is limited to share with in their groups and being removed from one of them
None...
Open redirection when logging in with User OIDC
None...
Social App does not validate server certificates for outgoing connections (NC-SA-2020-043)
Missing validation of server certificates for out-going connections allowed a man-in-the-middle attack...
Improper neutralization of item names in projects feature (NC-SA-2020-009)
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...
Stored XSS in autocomplete suggestions for chat @-mentions (NC-SA-2018-009)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...
Improper authorization check on removing shares (NC-SA-2016-007)
The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation did simply unshare the file to all users in...
Hidden Public Link creation when sharing to a Team External Member
None...
Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
None...
Desktop client created folders with world-readable and world-writable permissions on Linux
None...
Link reference provider can be tricked into downloading bigger files than intended
None...
Improper access control to messages of Social app (NC-SA-2020-042)
Improper access control in Social app 0.3.1 allowed to read posts of any user...
Event details leaked when sharing a non-public calendar event (NC-SA-2020-013)
Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event...
Valid share tokens allow to access tempory upload files of share owner
None...
Tables app share information not limited to relevant users
None...
Open Redirect in user_oidc login flow via protocol-relative URL bypass
None...