CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-3761
https://notcve.org/view.php?id=CVE-2018-3761
Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised. Nextcloud Server en versiones anteriores a la 12.0.8 y la 13.0.3 sufre de una autorización incorrecta en el endpoint del token OAuth2. La falta de comprobaciones pudo permitir la repartición de nuevos tokens en caso de que el cliente OAuth2 se hubiese visto parcialmente comprometido. • https://hackerone.com/reports/343111 https://nextcloud.com/security/advisory/?id=nc-sa-2018-003 • CWE-287: Improper Authentication •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0936
https://notcve.org/view.php?id=CVE-2017-0936
Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user. Nextcloud Server en versiones anteriores a la 11.0.7 y versiones 12.0.5 contiene una vulnerabilidad de omisión de autorización mediante una clave controlada por el usuario. La falta de una verificación de propiedad permitía a los usuarios con sesión iniciada modificar el alcance de las contraseñas de la aplicación de otros usuarios. • https://hackerone.com/reports/297751 https://nextcloud.com/security/advisory/?id=nc-sa-2018-001 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-0893
https://notcve.org/view.php?id=CVE-2017-0893
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers. Nextcloud Server anterior a 9.0.58, a 10.0.5, y a 11.0.3 utiliza una biblioteca de JavaScript vulnerable para desinfectar la entrada de usuario no confiable que sufrió una vulnerabilidad XSS causada por un cambio de comportamiento en Safari 10.1 y 10.2. Tenga en cuenta que Nextcloud emplea una estricta política de seguridad de contenido que impide la explotación de este problema XSS en los navegadores web modernos. • https://hackerone.com/reports/222838 https://nextcloud.com/security/advisory/?id=nc-sa-2017-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0892
https://notcve.org/view.php?id=CVE-2017-0892
Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file. Nextcloud Server anterior a 11.0.3 es vulnerable a una manipulación incorrecta de la sesión, lo que permite especificar una contraseña a la aplicación sin permiso de acceso a ficheros o al fichero de usuarios • https://hackerone.com/reports/191979 https://nextcloud.com/security/advisory/?id=nc-sa-2017-009 • CWE-285: Improper Authorization CWE-384: Session Fixation •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-0891 – NextCloud / OwnCloud Cross Site Scripting
https://notcve.org/view.php?id=CVE-2017-0891
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components. Nextcloud Server anterior a 9.0.58 a 10.0.5 y a 11.0.3 son vulnerables a un escape inadecuado de mensajes de error que conducen a vulnerabilidades XSS en múltiples componentes. NextCloud and OwnCloud suffer from a cross site scripting vulnerability in their error pages. OwnCloud versions 9.1.5 and below are affected. NextCloud versions prior to 11.0.3, 10.0.5, and 9.0.58 are affected. • https://hackerone.com/reports/216812 https://nextcloud.com/security/advisory/?id=nc-sa-2017-008 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •