CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49790 – App PIN code can be bypassed in Nextcloud Files iOS
https://notcve.org/view.php?id=CVE-2023-49790
22 Dec 2023 — The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available. La aplicación Nextcloud iOS Files permite a los usuarios de iOS interactuar con Nextcloud, una plataforma de productividad autohospedada. • https://github.com/nextcloud/ios/pull/2665 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28647 – App pin of the iOS app can be bypassed in Nextcloud iOS
https://notcve.org/view.php?id=CVE-2023-28647
30 Mar 2023 — Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability. • https://github.com/nextcloud/ios/pull/2344 • CWE-281: Improper Preservation of Permissions CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39210 – Access to internal files of the Nextcloud Android app
https://notcve.org/view.php?id=CVE-2022-39210
16 Sep 2022 — Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. • https://github.com/nextcloud/android/pull/10544 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29160 – Sensitive files/data exist after deletion of user account in Nextcloud Android
https://notcve.org/view.php?id=CVE-2022-29160
20 May 2022 — Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related details exist after deletion of a user account. This could result in misuse of the former account holder's information. Nextcloud Android version 3.19.0 contains a patch for this issue. There are no known workarounds available. • https://github.com/nextcloud/android/pull/9644 • CWE-284: Improper Access Control CWE-459: Incomplete Cleanup •
CVSS: 3.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24886 – Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
https://notcve.org/view.php?id=CVE-2022-24886
27 Apr 2022 — Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds. La aplicación Android de Nextcloud es el cliente Android para Nextcloud, una plataforma de productividad autoalojada. • https://github.com/nextcloud/android/pull/9726 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 2.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-24885 – Improper Authentication in Nextcloud Android Files
https://notcve.org/view.php?id=CVE-2022-24885
27 Apr 2022 — Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known workarounds. La aplicación Android de Nextcloud es el cliente Android para Nextcloud, una plataforma de productividad autoalojada. • https://github.com/nextcloud/android/pull/9816 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41166 – Permission bypass in Nextcloud Android App
https://notcve.org/view.php?id=CVE-2021-41166
26 Jan 2022 — The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds. • https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43863 – SQL Injection in FileContentProvider (GHSL-2021-1007)
https://notcve.org/view.php?id=CVE-2021-43863
25 Jan 2022 — The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 ... • https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32727 – End-to-end encryption device setup did not verify public key
https://notcve.org/view.php?id=CVE-2021-32727
12 Jul 2021 — Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vu... • https://github.com/nextcloud/android/pull/8438 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32694 – Malicious Android application can crash the Nextcloud Android Client
https://notcve.org/view.php?id=CVE-2021-32694
17 Jun 2021 — Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1. Una aplicación Nextcloud Android es el cliente Android para Nextcloud. En versiones anteriores a 3.15.1, una aplicación maliciosa en el mismo dispositivo puede bloquear el Nextcloud Android Client debido a una excepción no capturada. • https://github.com/nextcloud/android/pull/7919 • CWE-248: Uncaught Exception •