CVSS: 2.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52519 – Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
https://notcve.org/view.php?id=CVE-2024-52519
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fvpc-8hq6-jgq2 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52520 – Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended
https://notcve.org/view.php?id=CVE-2024-52520
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxqf-cfxw-mqmj • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-400: Uncontrolled Resource Consumption •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52521 – Nextcloud Server has a potential hash collision for background jobs could skip queuing them
https://notcve.org/view.php?id=CVE-2024-52521
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4 • CWE-328: Use of Weak Hash •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52523 – Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
https://notcve.org/view.php?id=CVE-2024-52523
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 1.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52525 – Nextcloud Server User password is available in memory of the PHP process
https://notcve.org/view.php?id=CVE-2024-52525
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mgxm-v6gm • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37887 – Nextcloud Server's events information leaked with shared calendars on recurrence exceptions
https://notcve.org/view.php?id=CVE-2024-37887
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1. Nextcloud Server es un sistema de nube personal autohospedado. Los participantes pueden leer las excepciones de recurrencia de los eventos privados del calendario compartido. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h4xv-cjpm-j595 • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37884 – Nextcloud Server's users can delete old versions of read-only shared files
https://notcve.org/view.php?id=CVE-2024-37884
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3. Nextcloud Server es un sistema de nube personal autohospedado. Un usuario malintencionado pudo enviar solicitudes de eliminación de versiones antiguas de archivos ... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37315 – Nextcloud Server's read-only users can restore old versions
https://notcve.org/view.php?id=CVE-2024-37315
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3. Nextcloud Server es un sistema de nube personal autohospedado. Un atacante con acceso de solo lectura a un archivo puede... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5mq8-738w-5942 • CWE-284: Improper Access Control •
CVSS: 7.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37313 – Nextcloud server allows the by-pass the second factor
https://notcve.org/view.php?id=CVE-2024-37313
14 Jun 2024 — Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4. El servidor Nextcloud es un sistema de nube personal autohospedado. En algunas circunstancias, fue posible omiti... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v72-9xv5-3p7c • CWE-287: Improper Authentication •