CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26041 – Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
https://notcve.org/view.php?id=CVE-2023-26041
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j53p-r755-v4jf https://github.com/nextcloud/spreed/pull/8515 https://hackerone.com/reports/1784310 • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-41971 – Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation
https://notcve.org/view.php?id=CVE-2022-41971
Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4 https://github.com/nextcloud/spreed/pull/7974 https://hackerone.com/reports/1706248 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-15619
https://notcve.org/view.php?id=CVE-2019-15619
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project. Una neutralización inapropiada de los nombres de archivo, nombres de conversación y nombres de tarjeta en Nextcloud Server versión 16.0.3, Nextcloud Talk versión 6.0.3 y Nextcloud Deck versión 0.6.5, causa una vulnerabilidad de tipo XSS cuando se vinculan entre sí en un proyecto. • https://hackerone.com/reports/662204 https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 https://nextcloud.com/security/advisory/?id=NC-SA-2020-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •