Lukasreschke

The issue allows a malicious user to download attachments referenced in text files without providing a password after receiving a "Files drop" or "Password protected" share link.

The issue is related to missing access control on the ID4me endpoint, allowing an attacker to register an account and potentially gain access to data available to all registered users.

The issue arises from the talk app not properly filtering access to a conversation's member list. This allows an attacker to gain information about the members of a Talk conversation, even if they are not members themselves.

Nextcloud is an open-source, self-hosted productivity platform. The Two-Factor Authentication wasn't enforced for pages marked as `@PublicPage`. This could be leveraged to gain access to any private chat channel without going through the Two-Factor flow, particularly affecting the Nextcloud Talk application.

Nextcloud Richdocuments is an open source collaborative office suite. In affected versions, there is a lack of rate limiting on the "Richdocuments OCS endpoint". This may have allowed an attacker to enumerate potentially valid share tokens.

The issue is related to a logical error that leads to the disclosure of valid share tokens for public calendars. This could potentially allow an attacker to access publicly shared calendars without knowing the share token.

The issue concerns a Stored XSS in the CardDAV image export functionality. This functionality allows the download of images stored within a vCard. Due to the lack of verification on the image content, it is prone to a stored Cross-Site Scripting attack.