DeutschShown in its original language — a full translation is planned for a future version.
Nextcloud: Mehrere Schwachstellen
view advisory published 2022-11-27
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-39333US | medium6.1 | — | ||
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that th… | ||||
| CVE-2022-39332US | medium5.4 | — | ||
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and inform… | ||||
| CVE-2022-41926US | medium5.5 | — | ||
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malici… | ||||
| CVE-2022-39346US | medium6.5 | — | ||
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to ove… | ||||
| CVE-2022-39339US | medium4.3OT elevated | — | ||
user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of… | ||||
| CVE-2022-39338US | medium5.4 | — | ||
user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack v… | ||||
| CVE-2022-39334US | medium4.7 | — | ||
Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrect… | ||||
| CVE-2022-39331US | medium5.4 | — | ||
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It i… | ||||
02
references
External citations — patches, advisories, analysis.
- Nextcloud Desktop issue 4927external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan