402 matches found
Users with read-only permissions for team folder can restore deleted files from trash bin
None...
Approval app allows users to request approval for other users file
None...
Calendar app allowed booking appointments without the generated token
None...
Users can modify tags on files that do not belong to them
None...
Deck app allows to spoof file extensions by using RTLO characters
None...
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory
None...
Calendar attachments of local files are offered to downloaded
None...
admin_audit does not log all actions on files in groupfolders
None...
Missing ownership check in Tables app allows moving columns into tables of other users
None...
Tables app allowed users to view columns metadata information of any table
None...
Stored XSS in contacts app via organisation and title field
None...
Participants were able to blindly delete poll drafts of other users by ID
None...
Deck app allowed user with "Can share" permission to modify permissions of other non-owners
None...
WebAuthn app was updated based on public key
None...
Development files shipped in files_pdfviewer app
None...
Tables app allowed to include local file via PhpSpreadsheet when importing a table
None...
Insecure temporary file creation, race with write access and permission
None...
Bypass group folder quota limit using attachment in text file
None...
3rdparty applications can create share links via socket API
None...
Test remote endpoint is not rate limited
None...
Second factor not requested after session timeout
None...
Global credentials of external storages are sent back to the frontend
None...
Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
None...
Desktop client created folders with world-readable and world-writable permissions on Linux
None...
Shares are not removed when user is limited to share with in their groups and being removed from one of them
None...
Incomplete sanitization of SVG files allows to embed other images into previews
None...
User can copy folder that contain files that are blocked by the files access control
None...
Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares
None...
Open redirection when logging in with User OIDC
None...
Authorization Bypass Through User-Controlled Key in Tables
None...
Share information of Tables app is not limited to affected users
None...
Mail app does not respect download permissions in shares
None...
Mail auto configurator sends account information to `autoconfig.tld` server when no auto-configuration is possible
None...
Missing password confirmation when changing external storage options
None...
OAuth2 client secrets were stored in a recoverable way
None...
Link reference provider can be tricked into downloading bigger files than intended
None...
Potential hash collision for background jobs could skip queuing them
None...
Custom defined credentials of external storages are sent back to the frontend
None...
User password is available in memory of the PHP process
None...
Can reshare read&share only folder with more permissions
None...
Events information leaked with shared calendars on recurrence exceptions
None...
ID4me does not validate signature or expiration
None...
Code injection in Nextcloud Desktop Client for macOS
None...
Users can delete old versions of read-only shared files
None...
Can access comments and attachments of deleted cards
None...
Notes app can be tricked into using a received share created before the user logged in
None...
Event create can create attachments that link to other websites
None...
Read-only users can restore old versions
None...