CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37885 – Code injection in Nextcloud Desktop Client for macOS
https://notcve.org/view.php?id=CVE-2024-37885
14 Jun 2024 — The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0. Nextcloud Desktop Client es una herramienta para sincronizar archivos desde Nextcloud Server con su computadora. Una inyección de código en Nextcloud Desktop Client para macO... • https://github.com/nextcloud/desktop/pull/6378 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37884 – Nextcloud Server's users can delete old versions of read-only shared files
https://notcve.org/view.php?id=CVE-2024-37884
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3. Nextcloud Server es un sistema de nube personal autohospedado. Un usuario malintencionado pudo enviar solicitudes de eliminación de versiones antiguas de archivos ... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2024-37883 – Nextcloud Deck can access comments and attachments of deleted cards
https://notcve.org/view.php?id=CVE-2024-37883
14 Jun 2024 — Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1. Nextcloud Deck es una herramienta de organización estilo kanban destinada a la planificación personal y organización de proyectos para equipos integrada... • https://github.com/nextcloud/deck/pull/5423 • CWE-284: Improper Access Control •
CVSS: 8.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-37882 – Nextcloud Server can reshare read&share only folder with more permissions
https://notcve.org/view.php?id=CVE-2024-37882
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4. Nextcloud Server es un sistema de nube personal autohospedado. Un destinatario de un recurso compartido con permisos de lectura y uso compartido podría volver a compartir el elemento con... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq • CWE-281: Improper Preservation of Permissions CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37317 – Nextcloud Notes app can be tricked into using a received share created before the user logged in
https://notcve.org/view.php?id=CVE-2024-37317
14 Jun 2024 — The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3. La aplicación Nextcloud Notes es una aplicación para tomar notas sin distracciones para Nextcloud. Si un atacante lograba compartir una carpeta llamada `Notas/` con un usuario recién creado antes d... • https://github.com/nextcloud/notes/pull/1260 • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-37316 – Nextcloud Calendar's event create can create attachments that link to other websites
https://notcve.org/view.php?id=CVE-2024-37316
14 Jun 2024 — Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2. Nextcloud Calendar es una aplicación de calendario para Nextcloud. Los usuarios autenticados podrían crear un evento con datos adjuntos manipulados que provoquen una mala redirección para los participantes cuando se haga clic en ellos. • https://github.com/nextcloud/calendar/pull/5966 • CWE-241: Improper Handling of Unexpected Data Type •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37315 – Nextcloud Server's read-only users can restore old versions
https://notcve.org/view.php?id=CVE-2024-37315
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3. Nextcloud Server es un sistema de nube personal autohospedado. Un atacante con acceso de solo lectura a un archivo puede... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5mq8-738w-5942 • CWE-284: Improper Access Control •
CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-37314 – Nextcloud Photos' shared albums have no restriction on photo removal
https://notcve.org/view.php?id=CVE-2024-37314
14 Jun 2024 — Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2. Nextcloud Photos es una aplicación de gestión de fotografías. Los usuarios pueden eliminar fotos del álbum de usuarios registrados. • https://github.com/nextcloud/photos/pull/1749 • CWE-284: Improper Access Control •
CVSS: 7.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37313 – Nextcloud server allows the by-pass the second factor
https://notcve.org/view.php?id=CVE-2024-37313
14 Jun 2024 — Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4. El servidor Nextcloud es un sistema de nube personal autohospedado. En algunas circunstancias, fue posible omiti... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v72-9xv5-3p7c • CWE-287: Improper Authentication •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37312 – Nextcloud user_oidc app's ID4me feature is available even when disabled
https://notcve.org/view.php?id=CVE-2024-37312
14 Jun 2024 — user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28). La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. La falta de control de acceso en el terminal ID4me permite ... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q • CWE-284: Improper Access Control •