CVSS: 2.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52519 – Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
https://notcve.org/view.php?id=CVE-2024-52519
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fvpc-8hq6-jgq2 https://github.com/nextcloud/server/commit/09b8aea8f6783514bffe00df6abbf9fa542faac5 https://github.com/nextcloud/server/pull/47635 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52520 – Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended
https://notcve.org/view.php?id=CVE-2024-52520
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxqf-cfxw-mqmj https://github.com/nextcloud/server/commit/873c42b0f1383d5b6f2b7a481e1d9620ed30f44a https://github.com/nextcloud/server/pull/47627 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-400: Uncontrolled Resource Consumption •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52521 – Nextcloud Server has a potential hash collision for background jobs could skip queuing them
https://notcve.org/view.php?id=CVE-2024-52521
Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4 https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d https://github.com/nextcloud/server/pull/47769 • CWE-328: Use of Weak Hash •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52523 – Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
https://notcve.org/view.php?id=CVE-2024-52523
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27 https://github.com/nextcloud/server/pull/49009 • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 1.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52525 – Nextcloud Server User password is available in memory of the PHP process
https://notcve.org/view.php?id=CVE-2024-52525
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mgxm-v6gm https://github.com/nextcloud/server/commit/d25a0a2896a2a981939cacb8ee0d555feef22b3b https://github.com/nextcloud/server/pull/48915 • CWE-312: Cleartext Storage of Sensitive Information •