Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
408 results · page 6 of 9
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform.CVE-2021-39225 · Other software · nextcloud · reported by GitHubHigh 8.1
Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. There are no known workarounds aside from upgrading.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform.CVE-2021-39224 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the OfficeOnline application is upgraded to 1.1.1. As a workaround, one may disable the OfficeOnline application in the app settings.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform.CVE-2021-39223 · Other software · nextcloud · reported by GitHubMedium 4.8
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`). It is recommended that the Richdocuments application is upgraded to 3.8.6 or 4.2.3. As a workaround, disable the Richdocuments application in the app settings.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform.CVE-2021-39221 · Other software · nextcloud · reported by GitHubMedium 6.4
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Contacts application is upgraded to 4.0.3. As a workaround, one may use a browser that has support for Content-Security-Policy.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render imaCVE-2021-39220 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommended that the Nextcloud Mail application is upgraded to 1.10.4 or 1.11.0. There are no known workarounds aside from upgrading.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud server is an open source, self hosted personal cloud.CVE-2021-32802 · Other software · nextcloud · reported by GitHubCritical 9.3
Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image types, the Nextcloud server was invoking a third-party library that wasn't suited for untrusted user-supplied content. There are several security concerns with passing user-generated content to this library, such as Server-Side-Request-Forgery, file disclosure or potentially executing code on the system. The risk depends on your system configuration and the installed library version. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. These versions do not use this library anymore. As a workaround users may disable previews by setting `enable_previews` to `false` in `config.php`.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.nextcloud.comgithub.com
Sep 7, 2021Nextcloud server is an open source, self hosted personal cloud.CVE-2021-32801 · Other software · nextcloud · reported by GitHubMedium 5.5
Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. If upgrading is not an option users are advised to disable system logging to resolve this issue until such time that an upgrade can be performed Note that ff you do not use the Encryption-at-Rest functionality of Nextcloud you are not affected by this bug.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud server is an open source, self hosted personal cloud.CVE-2021-32800 · Other software · nextcloud · reported by GitHubHigh 8.1
Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus knowledge of a password, or access to a WebAuthN trusted device of a user was sufficient to gain access to an account. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.1.0. There are no workaround for this vulnerability.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Richdocuments is an open source collaborative office suite.CVE-2021-37629 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. It is recommended that the Nextcloud Richdocuments app is upgraded to either 3.8.4 or 4.2.1 to resolve. For users unable to upgrade it is recommended that the Richdocuments application be disabled.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Richdocuments is an open source collaborative office suite.CVE-2021-37628 · Other software · nextcloud · reported by GitHubHigh 7.5
Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextcloud) can be bypassed using the Nextcloud Richdocuments app. An attacker was able to read arbitrary files in such a share. It is recommended that the Nextcloud Richdocuments is upgraded to 3.8.4 or 4.2.1. If upgrading is not possible then it is recommended to disable the Richdocuments application.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server.CVE-2021-32766 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or files exist in a "File Drop" share. Using this vulnerability an attacker is able to enumerate folders in such a share. Exploitation requires that the attacker has access to a valid affected "File Drop" link share. It is recommended that the Nextcloud Server is upgraded to 20.0.12, 21.0.4 or 22.0.1. Users who are unable to upgrade are advised to disable the Nextcloud Text application in the app settings.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.CVE-2021-37631 · Other software · nextcloud · reported by GitHubMedium 6.5
Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions the Deck application didn't properly check membership of users in a Circle. This allowed other users in the instance to gain access to boards that have been shared with a Circle, even if the user was not a member of the circle. It is recommended that Nextcloud Deck is upgraded to 1.5.1, 1.4.4 or 1.2.9. If you are unable to update it is advised to disable the Deck plugin.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Circles is an open source social network built for the nextcloud ecosystem.CVE-2021-37630 · Other software · nextcloud · reported by GitHubMedium 6.5
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user to join any "Secret Circle" without approval by the Circle owner leaking private information. It is recommended that Nextcloud Circles is upgraded to 0.19.15, 0.20.11 or 0.21.4. There are no workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021Nextcloud Circles is an open source social network built for the nextcloud ecosystem.CVE-2021-32782 · Other software · nextcloud · reported by GitHubMedium 5.8
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer.CVE-2021-37617 · Other software · nextcloud · reported by GitHubHigh 7.3
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the `Uninstall.exe` file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious `Uninstall.exe`, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the `C:\` system folder and verify that there is no malicious `C:\Uninstall.exe` file on the system.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2021The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer.CVE-2021-32728 · Other software · nextcloud · reported by GitHubMedium 6.5
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to previously downloaded public certificate. If the Nextcloud instance serves a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. This issue is fixed in Nextcloud Desktop Client version 3.3.0. There are no known workarounds aside from upgrading.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2021Nextcloud Richdocuments in an open source self hosted online office.CVE-2021-32748 · Other software · nextcloud · reported by GitHubMedium 4.3
Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicate with the Collabora Editor, the communication between these two services was not protected by a credentials or IP check. Whilst this does not result in gaining access to data that the user has not yet access to, it can result in a bypass of any enforced watermark on documents as described on the [Nextcloud Virtual Data Room](https://nextcloud.com/virtual-data-room/) website and [our documentation](https://portal.nextcloud.com/article/nextcloud-and-virtual-data-room-configuration-59.html). The Nextcloud Richdocuments releases 3.8.3 and 4.2.0 add an additional admin settings for an allowlist of IP addresses that can access the WOPI API. We recommend upgrading and configuring the allowlist to a list of Collabora servers. There is no known workaround. Note that this primarily results a bypass of any configured watermark or download protection using File Access Control. If you do not require or rely on these as a security feature no immediate action is required on your end.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32741 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32734 · Other software · nextcloud · reported by GitHubLow 3.1
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Text is a collaborative document editing application that uses Markdown.CVE-2021-32733 · Other software · nextcloud · reported by GitHubMedium 4.8
Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Android Client is the Android client for Nextcloud.CVE-2021-32727 · Other software · nextcloud · reported by GitHubMedium 5.7
Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vulnerability is patched in version 3.16.1. As a workaround, do not add additional end-to-end encrypted devices to a user account.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32726 · Other software · nextcloud · reported by GitHubHigh 7.1
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32725 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Mail is a mail app for Nextcloud.CVE-2021-32707 · Other software · nextcloud · reported by GitHubMedium 4.3
Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Talk is a fully on-premises audio/video and chat communication service.CVE-2021-32689 · Other software · nextcloud · reported by GitHubHigh 8.1
Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32705 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32703 · Other software · nextcloud · reported by GitHubMedium 5.3
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32688 · Other software · nextcloud · reported by GitHubHigh 8.8
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32680 · Other software · nextcloud · reported by GitHubLow 3.3
Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. This issue is patched in versions 19.0.13, 20.0.11, and 21.0.3.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32679 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-supplied filename was passed unsanitized into a `DownloadResponse`, this could be used to trick users into downloading malicious files with a benign file extension. This would show in UI behaviours where Nextcloud applications would display a benign file extension (e.g. JPEG), but the file will actually be downloaded with an executable file extension. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. Administrators of Nextcloud instances do not have a workaround available, but developers of Nextcloud apps may manually escape the file name before passing it into `DownloadResponse`.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32678 · Other software · nextcloud · reported by GitHubLow 3.7
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2021Nextcloud Android app is the Android client for Nextcloud.CVE-2021-32694 · Other software · nextcloud · reported by GitHubMedium 4.1
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2021Nextcloud Android app is the Android client for Nextcloud.CVE-2021-32695 · Other software · nextcloud · reported by GitHubLow 3.9
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose the malicious app. The shared preferences contain some limited private data such as push tokens and the account name. The vulnerability is patched in version 3.16.1.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2021Nextcloud Talk is a fully on-premises audio/video and chat communication service.CVE-2021-32676 · Other software · nextcloud · reported by GitHubMedium 6.5
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9.0.10, 10.0.8 or 11.2.2. No workarounds for this vulnerability are known to exist.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 11, 2021Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations.CVE-2021-22915 · Other software · Nextcloud · reported by support@hackerone.comCritical 9.8
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Jun 11, 2021Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead oCVE-2021-22913 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.5
Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has been explicitly chosen by the user.
- Product
- Deck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 11, 2021Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only oCVE-2021-22912 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.5
Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user.
- Product
- Nextcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 11, 2021Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock fCVE-2021-22906 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.5
Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.
- Product
- End-to-end Encryption
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 11, 2021Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on thCVE-2021-22905 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.5
Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user.
- Product
- Nextcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 11, 2021Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases forCVE-2021-22896 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.3
Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.
- Product
- Nextcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2021Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register withCVE-2021-22895 · Other software · Nextcloud · reported by support@hackerone.comMedium 5.9
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021Nextcloud Android is the Android client for the Nextcloud open source home cloud system.CVE-2021-32658 · Other software · nextcloud · reported by GitHubMedium 4.7
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that the Nextcloud Android App is upgraded to 3.16.1
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32657 · Other software · nextcloud · reported by GitHubMedium 4.3
Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 1, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32656 · Other software · nextcloud · reported by GitHubHigh 8.6
Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other Nextcloud servers, which can be done automatically when selecting the "Add server automatically once a federated share was created successfully" setting. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2 As a workaround, disable "Add server automatically once a federated share was created successfully" in the Nextcloud settings.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 1, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32655 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. No workarounds are known to exist.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 1, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32654 · Other software · nextcloud · reported by GitHubHigh 8.1
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 1, 2021Nextcloud Server is a Nextcloud package that handles data storage.CVE-2021-32653 · Other software · nextcloud · reported by GitHubLow 2.7
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jun 1, 2021Nextcloud Mail is a mail app for the Nextcloud platform.CVE-2021-32652 · Other software · nextcloud · reported by GitHubHigh 8.8
Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users to access mail metadata of other users. Versions 1.4.3 and 1.8.2 contain patches for this vulnerability; no workarounds other than the patches are known to exist.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Apr 14, 2021Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote CVE-2021-22879 · Other software · Nextcloud · reported by support@hackerone.comHigh 8.8
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Apr 13, 2021The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast.CVE-2021-29438 · Other software · nextcloud · reported by GitHubMedium 4.6
The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.
- Product
- nextcloud-dialogs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.