CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52507 – Share information of the Nextcloud Tables app is not limited to affected users
https://notcve.org/view.php?id=CVE-2024-52507
Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45 https://github.com/nextcloud/tables/commit/13ca45f1b9f70f694aea81b78bc7416ec840c332 https://github.com/nextcloud/tables/pull/1406 https://hackerone.com/reports/2705507 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52511 – Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables
https://notcve.org/view.php?id=CVE-2024-52511
Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7 https://github.com/nextcloud/tables/commit/52846ad81fe192ee977f14c82a229b0d9cdc406c https://github.com/nextcloud/tables/pull/1351 https://hackerone.com/reports/2671404 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40636 – Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness
https://notcve.org/view.php?id=CVE-2024-40636
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is `_logger.LogError(e, "FetchRegistry Failed for Eureka service urls: {EurekaServerServiceUrls}", new Uri(ClientConfig.EurekaServerServiceUrls).ToMaskedString());` in the `DiscoveryClient.cs` file which may leak credentials into logs. This issue has been addressed in version 3.2.8 of the Steeltoe.Discovery.Eureka nuget package. Steeltoe es un proyecto de código abierto que proporciona una colección de librerías que ayudan a los usuarios a crear aplicaciones nativas de la nube de nivel de producción mediante configuración externalizada, descubrimiento de servicios, seguimiento distribuido, gestión de aplicaciones y más. • https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37886 – Nextcloud user_oidc's ID4me does not validate signature or expiration
https://notcve.org/view.php?id=CVE-2024-37886
user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0. La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. Un atacante podría engañar a la aplicación para que acepte una solicitud que no esté firmada por el servidor correcto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw5h-29xf-g55g https://github.com/nextcloud/user_oidc/pull/715 https://hackerone.com/reports/1878391 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 3.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37885 – Code injection in Nextcloud Desktop Client for macOS
https://notcve.org/view.php?id=CVE-2024-37885
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0. Nextcloud Desktop Client es una herramienta para sincronizar archivos desde Nextcloud Server con su computadora. Una inyección de código en Nextcloud Desktop Client para macOS permitió cargar código arbitrario al iniciar el cliente con DYLD_INSERT_LIBRARIES configurado en el entorno. • https://github.com/nextcloud/desktop/pull/6378 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7 https://hackerone.com/reports/2307625 • CWE-94: Improper Control of Generation of Code ('Code Injection') •