CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0892
https://notcve.org/view.php?id=CVE-2017-0892
08 May 2017 — Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file. Nextcloud Server anterior a 11.0.3 es vulnerable a una manipulación incorrecta de la sesión, lo que permite especificar una contraseña a la aplicación sin permiso de acceso a ficheros o al fichero de usuarios • https://hackerone.com/reports/191979 • CWE-285: Improper Authorization CWE-384: Session Fixation •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0895
https://notcve.org/view.php?id=CVE-2017-0895
08 May 2017 — Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed. Nextcloud Server anterior a 10.0.4 y 11.0.2 son vulnerables a la divulgación de los nombres de calendario y de libreta de direcciones a otros usuarios registrados. Tenga en cuenta que no se ha revelado ningún contenido real del calendario y de la libreta de direcciones. • https://hackerone.com/reports/203594 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 0CVE-2017-0894
https://notcve.org/view.php?id=CVE-2017-0894
08 May 2017 — Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token. Nextcloud Server anterior a 11.0.3 es vulnerable a una divulgación de tokens de acciones válidos para los calendarios públicos debido a un error lógico. Por lo tanto, esto permite a un potencial atacante el acceso a calendarios compartidos públicamente sin conocer el token compa... • https://hackerone.com/reports/218876 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0890
https://notcve.org/view.php?id=CVE-2017-0890
08 May 2017 — Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue. Nextcloud Server anterior a 11.0.3 es vulnerable a un escape inadecuado lo que produce una vulnerabilidad XSS en el módulo de búsqueda. Para ser explotable un usuario tiene que escribir o pegar contenido malicioso en el diálogo de búsqueda. • https://hackerone.com/reports/213227 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0888
https://notcve.org/view.php?id=CVE-2017-0888
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre una vulnerabilidad de Content-Spoofing en la aplicación "files". La barra de navegación superior mostrada en la lista de archivos contenía entradas parcialmente controlables por el usuari... • http://www.securityfocus.com/bid/97491 • CWE-20: Improper Input Validation CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0884
https://notcve.org/view.php?id=CVE-2017-0884
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre de una creación de carpetas en carpetas de sólo lectura a pesar del problema ... • https://hackerone.com/reports/169680 • CWE-275: Permission Issues CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0885
https://notcve.org/view.php?id=CVE-2017-0885
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre de un mensaje de error que revela la existencia de archivo en el recurso de sólo escritura. Debido a un error en la lógica de la aplicación, un ... • https://hackerone.com/reports/174524 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0883
https://notcve.org/view.php?id=CVE-2017-0883
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. Note that this only affects folders and files that the adversary has at least read-only permissions for. Nextcloud Server en versiones anteriores a 9.0.55 y ... • https://hackerone.com/reports/169680 • CWE-275: Permission Issues CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0887
https://notcve.org/view.php?id=CVE-2017-0887
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 Sufre una evasión en la limitación de cuota. Debido a que no se desinfectan correctamente los valores proporcionados por la cabecera "OC-Total-Le... • https://hackerone.com/reports/173622 • CWE-20: Improper Input Validation CWE-807: Reliance on Untrusted Inputs in a Security Decision •
CVSS: 6.5EPSS: 1%CPEs: 2EXPL: 0CVE-2017-0886
https://notcve.org/view.php?id=CVE-2017-0886
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre de un ataque de denegación de servicio. Debido a un error en la lógica de la aplicación, un adversario autenticado puede desencadenar una recursión interminable en la aplicación que conduce a una posibl... • https://hackerone.com/reports/174524 • CWE-674: Uncontrolled Recursion •