CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29160 – Sensitive files/data exist after deletion of user account in Nextcloud Android
https://notcve.org/view.php?id=CVE-2022-29160
Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related details exist after deletion of a user account. This could result in misuse of the former account holder's information. Nextcloud Android version 3.19.0 contains a patch for this issue. There are no known workarounds available. • https://github.com/nextcloud/android/pull/9644 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xcj9-3jch-qr2r https://hackerone.com/reports/1222873 • CWE-284: Improper Access Control CWE-459: Incomplete Cleanup •
CVSS: 3.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24886 – Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
https://notcve.org/view.php?id=CVE-2022-24886
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds. La aplicación Android de Nextcloud es el cliente Android para Nextcloud, una plataforma de productividad autoalojada. • https://github.com/nextcloud/android/pull/9726 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq https://hackerone.com/reports/1161401 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 2.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-24885 – Improper Authentication in Nextcloud Android Files
https://notcve.org/view.php?id=CVE-2022-24885
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known workarounds. La aplicación Android de Nextcloud es el cliente Android para Nextcloud, una plataforma de productividad autoalojada. • https://github.com/nextcloud/android/pull/9816 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-32j4-9xf3-h2mg https://hackerone.com/reports/1450368 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41166 – Permission bypass in Nextcloud Android App
https://notcve.org/view.php?id=CVE-2021-41166
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds. • https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086 https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0c https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4 https://hackerone.com/reports/1358597 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43863 – SQL Injection in FileContentProvider (GHSL-2021-1007)
https://notcve.org/view.php?id=CVE-2021-43863
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading. • https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95 https://github.com/nextcloud/android/security/advisories/GHSA-vjp2-f63v-w479 https://hackerone.com/reports/1358597 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •