402 matches found
Improper sanitization of HTML in directory names (NC-SA-2019-009)
Some basic HTML tags were rendered as Markup in directory names...
Thumbnails of files leaked via Android content provider (NC-SA-2019-007)
If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, he can easily access the nextcloud-files even if the nextcloud app is locked with a fingerprint or pin...
Bypass lock protection in Android app (NC-SA-2019-004)
Creating a fake multi-account and aborting the process would redirect the user to the default account of the device without asking for the lock pattern if one was set up...
Query restriction bypass on exposed FileContentProvider in Android app (NC-SA-2019-011)
Not strictly enough sanitization allowed an attacker to get content information from protected tables when using custom queries...
SQL Injection in lookup-server (NC-SA-2019-010)
Improper sanitation of user input allowed any unauthenticated user to perform SQL injection attacks...
Renaming an item to a protected hidden folder deletes the target (NC-SA-2020-017)
Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name...
Server-Side request forgery in New-Subscription feature of the calendar app (NC-SA-2019-014)
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application...
Improper permission preservation on reshares (NC-SA-2020-012)
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...
User IDs and Nextcloud server leaked to Nextcloud Lookup server with disabled settings (NC-SA-2019-016)
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled...
Improper share updates could result in extended data access (NC-SA-2019-003)
A bug could expose more data in reshared link shares than intended by the sharer...
Improper access control checks for share expiration date (NC-SA-2019-002)
A missing check could give recipient the possibility to extend the expiration date of a share they received...
Classification of calendar events is ignored by the activity stream (NC-SA-2019-001)
A missing check revealed the name of confidential events and private events to all users of a shared calendar...
2FA sessions not properly expired on password change (NC-SA-2020-001)
A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...
Reflected XSS in redirect of the Updater (NC-SA-2020-007)
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location...
Event details leaked when sharing a non-public calendar event (NC-SA-2020-013)
Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event...
Second factor authentication bypassed if provider fails to load (NC-SA-2018-011)
Missing state would not enforce the use of a second factor at login if the the provider of the second factor failed to load...
Improper authentication on public shares (NC-SA-2018-012)
A missing access check could lead to continued access to password protected link shares when the owner had changed the password...
Improper access control checks for single share previews (NC-SA-2018-014)
A missing check could give unauthorized access to the previews of single file password protected shares...
Improper validation of permissions (NC-SA-2018-010)
Improper revalidation of permissions lead to not accepting access restrictions by acess tokens...
Session fixation on public share page (NC-SA-2018-013)
A bug causing session fixation could potentially allow an attacker to obtain access to password protected shares...
Stored XSS in autocomplete suggestions for file comments (NC-SA-2018-008)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...
Stored XSS in autocomplete suggestions for chat @-mentions (NC-SA-2018-009)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...
Improper validation of data passed to JSON encoder (NC-SA-2018-006)
Improper validation of input allowed an attacker to not have their actions logged to the audit log...
Bypass of 2 Factor Authentication (NC-SA-2018-007)
Improper authentication of the second factor challenge would allow an attacker that had access to user credentials to bypass the second factor validation completely...
Improper validation on OAuth2 token endpoint (NC-SA-2018-003)
Improper validation of input allowed an attacker with access to the OAuth2 refresh token to obtain new tokens...
File access control rules not applied to image previews (NC-SA-2018-002)
A missing check for read permissions allowed users that received an incomming share containing files tagged so they should be denied access to still request a preview for those files...
Stored XSS in calendar via group shares (NC-SA-2018-004)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...
Stored XSS in contacts via group shares (NC-SA-2018-005)
A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...
App password scope can be changed for other users (NC-SA-2018-001)
A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user...
Reflected XSS in error pages (NC-SA-2017-008)
Inadequate escaping of error messages leads to XSS vulnerabilities in multiple components.Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers...
Calendar and addressbook names disclosed (NC-SA-2017-012)
A logical error caused disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and adressbook has been disclosed...
Share tokens for public calendars disclosed (NC-SA-2017-011)
A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...
DOM XSS vulnerability in search dialogue (NC-SA-2017-007)
Inadequate escaping lead to XSS vulnerability in the search module. To be exploitable an user has to write or paste malicious content into the search dialogue...
Stored XSS in Gallery application (NC-SA-2017-010)
A JavaScript library used by Nextcloud for sanitizing untrusted user-input suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2.Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers...
Limitation of app specific password scope can be bypassed (NC-SA-2017-009)
Improper session handling allowed an application specific password without permission to the files access to the users file...
Permission increase on re-sharing via OCS API (NC-SA-2017-001)
A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set.Note that this only affects folders and files that th...
Content-Spoofing in "files" app (NC-SA-2017-006)
The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information...
Bypassing quota limitation (NC-SA-2017-005)
Due to not properly sanitzing values provided by the OC-Total-Length HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator...
Creation of folders in read-only folders despite lacking permissions (NC-SA-2017-002)
Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder.Note that this only affects folders and files that the adversary has at least read-only permissions for...
Error message discloses existence of file in write-only share (NC-SA-2017-003)
Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages...
Denial of Service attack (NC-SA-2017-004)
Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service...
Content-Spoofing in "dav" app (NC-SA-2016-011)
The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information...
SMB User Authentication Bypass (NC-SA-2016-006)
Nextcloud includes an optional and not by default enabled SMB authentication component that allows to authenticate users against an SMB server.This backend is implemented in a way that it tries to connect to a SMB server and if that succeeded consider the user logged-in.The backend did not proper...
Content-Spoofing in "files" app (NC-SA-2016-010)
The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...
Stored XSS in CardDAV image export (NC-SA-2016-008)
The CardDAV image export functionality as implemented in Nextcloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.Note: Nextcloud employs a very strict Content Security...
Improper authorization check on removing shares (NC-SA-2016-007)
The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation did simply unshare the file to all users in...
Reflected XSS in Gallery application (NC-SA-2016-009)
The gallery app was not properly sanitizing exception messages from the Nextcloud server. Due to an endpoint where an attacker could influence the error message this lead to a reflected Cross-Site-Scripting vulnerability...
Edit permission check not enforced on WebDAV COPY action (NC-SA-2016-004)
The WebDAV endpoint was not properly checking the permission on a WebDAV "COPY" action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files...
Read-only share recipient can restore old versions of file (NC-SA-2016-005)
The restore capability of Nextcloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions...
Content-Spoofing in "files" app (NC-SA-2016-003)
The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...