387 matches found
Calendar app leaked user identifiers via attendee suggestion endpoint
None...
Hidden Public Link creation when sharing to a Team External Member
None...
Tables app share information not limited to relevant users
None...
Bypass group folder quota limit using attachment in text file
None...
Authorization Bypass Through User-Controlled Key in Tables
None...
Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
None...
XSS in SVG images when opened outside of Nextcloud
None...
User can copy folder that contain files that are blocked by the files access control
None...
Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
None...
View-only guests could see deleted Collectives pages in the trashbin
None...
Files Lock app allows users to lock and unlock files of other users
None...
Missing permission check for reading form submissions
None...
Unauthorized force-mute from missing permission check when using internal signaling
None...
ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
None...
Tables app allowed to include local file via PhpSpreadsheet when importing a table
None...
Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
None...
Limited path traversal via template API if using `{lang}` in config
None...
Users can modify tags on files that do not belong to them
None...
admin_audit does not log all actions on files in groupfolders
None...
Stored XSS in contacts app via organisation and title field
None...
3rdparty applications can create share links via socket API
None...
Calendar app used predictable proposal participant tokens
None...
Approval app allows users to request approval for other users file
None...
Deck app allowed user with "Can share" permission to modify permissions of other non-owners
None...
Development files shipped in files_pdfviewer app
None...
Bypass of 2 Factor Authentication (NC-SA-2018-007)
Improper authentication of the second factor challenge would allow an attacker that had access to user credentials to bypass the second factor validation completely...
Authorization bypass in approval feature allows unauthorized file sharing with approvers
None...
Mail stored HTML injection in subject text
None...
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory
None...
Missing ownership check in Tables app allows moving columns into tables of other users
None...
Contacts search allowed users to retrieve contact information of other users beyond their contact list
None...
WebAuthn app was updated based on public key
None...
View-Only shares on External Storage or Team Folders are always writeable
None...
Users with read-only permissions for team folder can restore deleted files from trash bin
None...
Participants were able to blindly delete poll drafts of other users by ID
None...