CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52509 – Nextcloud Mail app does not respect download permissions in shares
https://notcve.org/view.php?id=CVE-2024-52509
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. • https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b https://github.com/nextcloud/mail/pull/9592 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862 https://hackerone.com/reports/1878255 • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2024-52508 – Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
https://notcve.org/view.php?id=CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0. • https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b https://github.com/nextcloud/mail/pull/9964 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vmhx-hwph-q6mc https://hackerone.com/reports/2508422 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52510 – Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
https://notcve.org/view.php?id=CVE-2024-52510
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later. • https://github.com/nextcloud/desktop/commit/97539218e6f63c3a3fd1694cb7d8aef27c5910d7 https://github.com/nextcloud/desktop/pull/7333 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4qc-m9mj-452v https://hackerone.com/reports/2597504 • CWE-295: Improper Certificate Validation •
CVSS: 3.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37885 – Code injection in Nextcloud Desktop Client for macOS
https://notcve.org/view.php?id=CVE-2024-37885
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0. Nextcloud Desktop Client es una herramienta para sincronizar archivos desde Nextcloud Server con su computadora. Una inyección de código en Nextcloud Desktop Client para macOS permitió cargar código arbitrario al iniciar el cliente con DYLD_INSERT_LIBRARIES configurado en el entorno. • https://github.com/nextcloud/desktop/pull/6378 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7 https://hackerone.com/reports/2307625 • CWE-94: Improper Control of Generation of Code ('Code Injection') •