Lukas Reschke

The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) issue. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due to the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy.

The Nextcloud Contacts application is vulnerable to a stored Cross-Site Scripting (XSS) issue. To exploit this, a user must right-click on a malicious file and open it in a new tab. However, due to the strict Content-Security-Policy in Nextcloud, this issue is not exploitable on modern browsers that support Content-Security-Policy.

A missing permission check in Nextcloud Deck allows another authenticated user to access Deck cards of another user.

The Nextcloud OfficeOnline application returned verbatim exception messages to the user, which could result in a full path disclosure on shared files. For example, an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`.

The Nextcloud Richdocuments application returned verbatim exception messages to the user, which could result in a full path disclosure on shared files. For example, an attacker could see that the file `shared.txt` is located within `/files/$username/Myfolder/Mysubfolder/shared.txt`.

The Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) issue. Due to the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. A notable exemption is Internet Explorer, which does not support Content-Security-Policy properly.

The File Drop feature in Nextcloud Richdocuments can be bypassed, allowing an attacker to read arbitrary files in a shared folder. This issue affects the "Upload Only" public link shares in Nextcloud when using the Nextcloud Richdocuments app.

The Nextcloud server, an open-source, self-hosted personal cloud, has a issue where logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality.

The issue affects Nextcloud server, an open-source, self-hosted personal cloud. An attacker can bypass Two Factor Authentication in Nextcloud, allowing access to an account with knowledge of a password or access to a WebAuthN trusted device of a user.

The Nextcloud Text application, which ships with the Nextcloud Server, returns different error messages depending on whether a folder exists in a public link share. This is problematic when the public link share has been created with "Upload Only" privileges, also known as "File Drop". A link share recipient should not be able to see which folders or files exist in a "File Drop" share. An attacker can exploit this issue to enumerate folders in such a share, but they must have access to a valid affected "File Drop" link share.

A reflected XSS issue was found in Collabora Online, allowing an attacker to inject unescaped HTML into a variable as they created the Collabora Online iframe. This could execute scripts inside the context of the Collabora Online iframe, giving access to a small set of user settings stored in the browser and the session's authentication token.

Collabora Online is a collaborative online office suite. Unauthenticated attackers can gain access to files currently opened by other users in the Collabora Online editor. The attacker must guess the file identifier, which is dependent on external file-storage implementations. This is a potential Insecure Direct Object Reference vulnerability.

The issue is related to a lack of ratelimiting on the "shareinfo" endpoint, which may have allowed an attacker to enumerate potentially valid share tokens.

Name of the Vulnerable Software and Affected Versions: @nextcloud/dialogs versions prior to 3.1.2 Description: The issue arises from insufficient escaping of text input passed to a toast in the Nextcloud dialogs library. This could lead to a XSS vulnerability if the application displays toasts with user-supplied input. Nextcloud Server has a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities. Recommendations: For versions prior to 3.1.2, update to version 3.1.2 to patch the vulnerability. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag. As a temporary workaround, ensure no user-supplied input flows into toasts.

The issue is related to a logical error that leads to the disclosure of valid share tokens for public calendars. This could potentially allow an attacker to access publicly shared calendars without knowing the share token.

A cross-site request forgery (CSRF) issue exists in the CSRF content-type check in Jackrabbit-Webdav. This allows remote attackers to hijack the authentication of victims for requests that create a resource via an HTTP POST request with a missing or crafted Content-Type header.

The issue is related to the sapi header op function in PHP, which supports deprecated line folding without considering browser compatibility. This allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging mishandling of certain characters in the header function, such as %0A%20 or %0D%0A%20. The vulnerability is associated with the failure to protect the structure of web pages.

The issue allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding. This can be demonstrated by uploading a .htaccess file.

The issue allows remote attackers to inject arbitrary web script or HTML via various means, including style, font name, javascript, or data URI. This can be exploited to execute malicious scripts on the client-side.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service via an XML External Entity (XXE) attack. This occurs due to an incomplete fix for a previous issue.