Desktop Security Vulnerabilities - 2020
A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment.
6.7CVSS
6.6AI Score
0.001EPSS
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
5.4CVSS
5.2AI Score
0.001EPSS
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
7.8CVSS
7.6AI Score
0.001EPSS
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
7.5CVSS
7.4AI Score
0.002EPSS
Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.
6.8CVSS
6.4AI Score
0.013EPSS
A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.
5.5CVSS
5.2AI Score
0.0004EPSS
A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory.
5.5CVSS
5.5AI Score
0.0004EPSS