402 matches found
Users can set up workflows using restricted and invisible system tags
None...
CSRF protection on user_oidc login returned the expected token in case of an error
None...
Desktop clients misbehaves with end-to-end encryption when the server returns an empty list of metadata keys
None...
Initialization vector reuse in end-to-end encryption allows a malicious server admin to break manipulate and access files
None...
Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
None...
Desktop client does not verify received singed certificate in end-to-end encryption
None...
Full path of data directory exposed to users
None...
Secure view can be bypassed by using internal API endpoint
None...
User without download rights can download older version of that file
None...
Chat room membership disclosed via autocompletion when not a member yourself
None...
Ability to control the filename when uploading a logo or favicon as admin in the theming settings
None...
Insecure randomness for default password in file sharing when password policy app is disabled
None...
Scope of workflow operations is not validated
None...
App pin of the iOS app can be bypassed
None...
App pin of the Android app can be bypassed via thirdparty apps generating deep links
None...
Reference fetch can saturate the server bandwidth for 10 seconds
None...
Potential share collision for recipients when caching is enabled
None...
Missing brute force protection on password reset token
None...
Delete permissions are not saved when creating public share
None...
Missing brute force protection on password confirmation modal
None...
Messages can still be seen on conversation after expiring when cron is misconfigured
None...
No password length restriction in reset password endpoint
None...
Download permissions can be changed by resharer
None...
Potential directory traversal in OC\Files\Node\Folder::getFullPath
None...
SSRF via filter bypass due to lax checking on IPs
None...
Missing rate limiting on password reset functionality allows sending lots of emails
None...
IDOR Vulnerability in Nextcloud Mail
None...
Previews are accessible without a watermark
None...
Document content of files can be obtained through Collabora for files of other users
None...
Mail app temporarily stores cleartext password in database until OAuth2 setup is done
None...
Blind SSRF via server URL input in the Nextcloud Mail app
None...
Self reflected HTML injection in Desktop client
None...
Passcode bypass on Talk Android app
None...
CSRF vulnerability in Nextcloud Desktop Client on Windows when clicking malicious link
None...
Possibility to delete files attached to deck cards of other users
None...
Missing character limitation allows to put generate a database error
None...
Deck card reference caching can leak data to unauthorized users
None...
Vulnerable moment-timezone version shipped
None...
Suspicious login app ships old league/flysystem version
None...
Guests can continue to receive video streams from call after being removed from a conversation
None...
Disabled download shares still allow download through preview images
None...
No password length limit when creating a user as an administrator
None...
Calendar name length not validated before writing to database
None...
nextcloudcmd incorrectly trusts bad TLS certificates
None...
XSS in Desktop Client in call notification popup
None...
XSS in Desktop Client via user status and information
None...
XSS in Desktop Client in the notifications
None...
Stored XSS via Authorization Endpoint - Safari-Only
None...