CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29163 – Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-29163
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds. Nextcloud Server es el software de servidor de archivos de Nextcloud, una plataforma de productividad auto alojada. • https://github.com/nextcloud/circles/pull/866 https://github.com/nextcloud/circles/pull/926 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx https://hackerone.com/reports/1406926 • CWE-671: Lack of Administrator Control over Security •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24889 – Insufficient Verification of Data Authenticity in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-24889
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1. Nextcloud Server es el software de servidor de archivos de Nextcloud, una plataforma de productividad autoalojada. En versiones anteriores a 21.0.8, 22.2.4 y 23.0.1, es posible engañar a los administradores para que habiliten aplicaciones "recommended" para el servidor Nextcloud que no necesitan, ampliando así su superficie de ataque innecesariamente. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 https://github.com/nextcloud/server/pull/30615 https://hackerone.com/reports/1403614 https://security.gentoo.org/glsa/202208-17 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24888 – Possible Injection in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-24888
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp https://github.com/nextcloud/server/pull/29895 https://hackerone.com/reports/1402249 https://security.gentoo.org/glsa/202208-17 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24741 – High memory usage in Nextcloud server
https://notcve.org/view.php?id=CVE-2022-24741
Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag. El servidor Nextcloud es una plataforma de servicios de código abierto, de estilo de nube autoalojada. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89 https://github.com/nextcloud/server/pull/30291 https://hackerone.com/reports/1261225 https://security.gentoo.org/glsa/202208-17 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •