CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0890
https://notcve.org/view.php?id=CVE-2017-0890
08 May 2017 — Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue. Nextcloud Server anterior a 11.0.3 es vulnerable a un escape inadecuado lo que produce una vulnerabilidad XSS en el módulo de búsqueda. Para ser explotable un usuario tiene que escribir o pegar contenido malicioso en el diálogo de búsqueda. • https://hackerone.com/reports/213227 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0894
https://notcve.org/view.php?id=CVE-2017-0894
08 May 2017 — Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token. Nextcloud Server anterior a 11.0.3 es vulnerable a una divulgación de tokens de acciones válidos para los calendarios públicos debido a un error lógico. Por lo tanto, esto permite a un potencial atacante el acceso a calendarios compartidos públicamente sin conocer el token compa... • https://hackerone.com/reports/218876 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0883
https://notcve.org/view.php?id=CVE-2017-0883
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. Note that this only affects folders and files that the adversary has at least read-only permissions for. Nextcloud Server en versiones anteriores a 9.0.55 y ... • https://hackerone.com/reports/169680 • CWE-275: Permission Issues CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0885
https://notcve.org/view.php?id=CVE-2017-0885
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre de un mensaje de error que revela la existencia de archivo en el recurso de sólo escritura. Debido a un error en la lógica de la aplicación, un ... • https://hackerone.com/reports/174524 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0888
https://notcve.org/view.php?id=CVE-2017-0888
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre una vulnerabilidad de Content-Spoofing en la aplicación "files". La barra de navegación superior mostrada en la lista de archivos contenía entradas parcialmente controlables por el usuari... • http://www.securityfocus.com/bid/97491 • CWE-20: Improper Input Validation CWE-451: User Interface (UI) Misrepresentation of Critical Information •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0886
https://notcve.org/view.php?id=CVE-2017-0886
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre de un ataque de denegación de servicio. Debido a un error en la lógica de la aplicación, un adversario autenticado puede desencadenar una recursión interminable en la aplicación que conduce a una posibl... • https://hackerone.com/reports/174524 • CWE-674: Uncontrolled Recursion •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0887
https://notcve.org/view.php?id=CVE-2017-0887
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 Sufre una evasión en la limitación de cuota. Debido a que no se desinfectan correctamente los valores proporcionados por la cabecera "OC-Total-Le... • https://hackerone.com/reports/173622 • CWE-20: Improper Input Validation CWE-807: Reliance on Untrusted Inputs in a Security Decision •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0884
https://notcve.org/view.php?id=CVE-2017-0884
05 Apr 2017 — Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for. Nextcloud Server en versiones anteriores a 9.0.55 y 10.0.2 sufre de una creación de carpetas en carpetas de sólo lectura a pesar del problema ... • https://hackerone.com/reports/169680 • CWE-275: Permission Issues CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 1CVE-2016-9465
https://notcve.org/view.php?id=CVE-2016-9465
28 Mar 2017 — Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack. Nextcloud Server en versiones anteriores a 10.0.1 y ownCloud Server en versiones anteriores a 9.0.6 y 9.1.2 sufren de XSS almacenado en la e... • https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 2CVE-2016-9463
https://notcve.org/view.php?id=CVE-2016-9463
28 Mar 2017 — Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth conf... • https://github.com/nextcloud/apps/commit/b85ace6840b8a6704641086bc3b8eb8e81cb2274 • CWE-287: Improper Authentication CWE-303: Incorrect Implementation of Authentication Algorithm •