CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52523 – Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
https://notcve.org/view.php?id=CVE-2024-52523
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 1.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52525 – Nextcloud Server User password is available in memory of the PHP process
https://notcve.org/view.php?id=CVE-2024-52525
15 Nov 2024 — Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mgxm-v6gm • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46958
https://notcve.org/view.php?id=CVE-2024-46958
16 Sep 2024 — In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. • https://github.com/nextcloud/desktop/compare/v3.13.3...v3.13.4 •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37887 – Nextcloud Server's events information leaked with shared calendars on recurrence exceptions
https://notcve.org/view.php?id=CVE-2024-37887
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1. Nextcloud Server es un sistema de nube personal autohospedado. Los participantes pueden leer las excepciones de recurrencia de los eventos privados del calendario compartido. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h4xv-cjpm-j595 • CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37886 – Nextcloud user_oidc's ID4me does not validate signature or expiration
https://notcve.org/view.php?id=CVE-2024-37886
14 Jun 2024 — user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0. La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. Un atacante podría engañar a la aplicación para que acepte una solicitud que no esté firmada por el servidor correcto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw5h-29xf-g55g • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37885 – Code injection in Nextcloud Desktop Client for macOS
https://notcve.org/view.php?id=CVE-2024-37885
14 Jun 2024 — The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0. Nextcloud Desktop Client es una herramienta para sincronizar archivos desde Nextcloud Server con su computadora. Una inyección de código en Nextcloud Desktop Client para macO... • https://github.com/nextcloud/desktop/pull/6378 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37884 – Nextcloud Server's users can delete old versions of read-only shared files
https://notcve.org/view.php?id=CVE-2024-37884
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3. Nextcloud Server es un sistema de nube personal autohospedado. Un usuario malintencionado pudo enviar solicitudes de eliminación de versiones antiguas de archivos ... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2024-37883 – Nextcloud Deck can access comments and attachments of deleted cards
https://notcve.org/view.php?id=CVE-2024-37883
14 Jun 2024 — Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1. Nextcloud Deck es una herramienta de organización estilo kanban destinada a la planificación personal y organización de proyectos para equipos integrada... • https://github.com/nextcloud/deck/pull/5423 • CWE-284: Improper Access Control •
CVSS: 8.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-37882 – Nextcloud Server can reshare read&share only folder with more permissions
https://notcve.org/view.php?id=CVE-2024-37882
14 Jun 2024 — Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4. Nextcloud Server es un sistema de nube personal autohospedado. Un destinatario de un recurso compartido con permisos de lectura y uso compartido podría volver a compartir el elemento con... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq • CWE-281: Improper Preservation of Permissions CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37317 – Nextcloud Notes app can be tricked into using a received share created before the user logged in
https://notcve.org/view.php?id=CVE-2024-37317
14 Jun 2024 — The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3. La aplicación Nextcloud Notes es una aplicación para tomar notas sin distracciones para Nextcloud. Si un atacante lograba compartir una carpeta llamada `Notas/` con un usuario recién creado antes d... • https://github.com/nextcloud/notes/pull/1260 • CWE-284: Improper Access Control •