386 matches found
Hidden Public Link creation when sharing to a Team External Member
None...
Open Redirect in user_oidc login flow via protocol-relative URL bypass
None...
Tables app share information not limited to relevant users
None...
Bypass group folder quota limit using attachment in text file
None...
3rdparty applications can create share links via socket API
None...
Bypass lock protection in Android app (NC-SA-2020-004)
A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past...
Two-Factor Authentication Bypass via Pending Session Token Replay
None...
Calendar app leaked user identifiers via attendee suggestion endpoint
None...
Missing permission check for reading form submissions
None...
XSS in SVG images when opened outside of Nextcloud
None...
Bypass of 2 Factor Authentication (NC-SA-2018-007)
Improper authentication of the second factor challenge would allow an attacker that had access to user credentials to bypass the second factor validation completely...
View-only guests could see deleted Collectives pages in the trashbin
None...
Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
None...
Stored XSS in contacts app via organisation and title field
None...
Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
None...
Limited path traversal via template API if using `{lang}` in config
None...
Authorization bypass in approval feature allows unauthorized file sharing with approvers
None...
Unauthorized force-mute from missing permission check when using internal signaling
None...
ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
None...
Deck app allowed user with "Can share" permission to modify permissions of other non-owners
None...
Mail stored HTML injection in subject text
None...
Users can modify tags on files that do not belong to them
None...
admin_audit does not log all actions on files in groupfolders
None...
Missing ownership check in Tables app allows moving columns into tables of other users
None...
WebAuthn app was updated based on public key
None...
Files Lock app allows users to lock and unlock files of other users
None...
Calendar app used predictable proposal participant tokens
None...
Contacts search allowed users to retrieve contact information of other users beyond their contact list
None...
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory
None...
Improper validation of data passed to JSON encoder (NC-SA-2018-006)
Improper validation of input allowed an attacker to not have their actions logged to the audit log...
View-Only shares on External Storage or Team Folders are always writeable
None...
Approval app allows users to request approval for other users file
None...
Participants were able to blindly delete poll drafts of other users by ID
None...
Development files shipped in files_pdfviewer app
None...