402 matches found
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
None...
Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link
None...
Exception logging in Sharepoint app reveals clear-text connection details
None...
Profile of disabled user stays accessible
None...
Database resource exhaustion for logged-in users via sharee recommendations with circles
None...
Last video frame is still sent after video is disabled in a call
None...
Server-Side Request Forgery (SSRF) via potential filter bypass with too lax local domain checking
None...
Access to internal files of the Nextcloud Android app from within the Nextcloud Android app
None...
Listing folder content blocked by files access control when received as share
None...
Authentication header is passed on by Nextcloud Server due to a vulnerable GuzzleHTTP version
None...
Generated passwords are not fully validated by HIBPValidator
None...
Missing rate limit when trying to join a password protected Nextcloud Talk conversation
None...
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
None...
Missing brute force protection on cloud federation sharing
None...
Password disclosure in log file when providing incorrect additional data on initial setup of Mail App
None...
Federated share accepting/declining is not logged in audit log
None...
Ownership check missing when updating or deleting mail attachments
None...
SMTP Command Injection in iCalendar Attachments to emails via newlines
None...
Federated editing allows iframing remote servers by default
None...
Improper input-size validation on the user new session name
None...
Bypass of password requirements when sharing a folder via the Circles app
None...
Sensitive files/ data exists post deletion of user account
None...
Possibility for anyone to add a stack with existing tasks on anyone's board in the Deck app
None...
Error in deleting deck cards attachment reveals the full application path
None...
Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic
None...
When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL
None...
Force an admin to install recommended applications
None...
Control character filtering misses leading and trailing whitespace in file and folder names
None...
Notification implicit PendingIntent in com.nextcloud.client allows to access contacts
None...
Can bypass the lock protection in Android Files app
None...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Server
None...
Command Injection in Appointment Emails for Calendar
None...
Folder names of "File Drop" share accessible
None...
High memory usage for generating preview of broken image
None...
Groupfolders advanced permissions is not obeyed for subfolders
None...
User enumeration setting not obeyed in User Status API
None...
Geolocation preview links can be set to arbitrary links
None...
Talk app did allow access to sensitive chat messages on lockscreen
None...
Permission bypass in DiskLruImageCacheFileProvider (GHSL-2021-1008)
None...
Two-Factor Authentication not enforced for pages marked as public
None...
File Traversal affecting SVG files on Nextcloud Server
None...
Rate-limits not working on instances without configured memory cache backend
None...
Missing permission check on Deck API
None...
Nextcloud Server shipped insecure Archive_Tar version
None...
Missing User Presence Check in Nextcloud WebAuthn login
None...
File path disclosure of shared files in OfficeOnline application
None...
File path disclosure of shared files in Richdocuments application
None...
XSS in Contacts
None...