CVE Vulnerability Catalog

Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1.

In Nextcloud Server before versions 32.0.9 and 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, bypassing password protection or download restrictions.

In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal.

In the Nextcloud Approval app prior to version 2.7.2, a privilege escalation vulnerability allows a user without sharing permissions to force the system to share a file with approvers.

CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.

Vulnerability in Spring Cloud Function allows an OOM (Out of Memory) error by attempting to add an infinite number of functions to the Function Registry. It affects multiple versions of the library.

Vulnerability in Spring Cloud Function allows an OOM (Out of Memory) error through infinite recursion in the routing layer during request handling. It affects multiple versions of the library.

Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms. An authenticated attacker can modify approval flow configurations of other users' forms due to insufficient authorization checks on resource ownership.

Vulnerability in Bottelet DaybydayCRM up to 2.2.1. An unknown function in the Setting Handler component allows missing authentication. Remote exploitation is possible.

In Bottelet DaybydayCRM up to 2.2.1, an improper authorization vulnerability was found in the view function in app/Http/Controllers/DocumentsController.php. The attack can be performed remotely. A patch is recommended.

An OS command injection vulnerability was found in wezterm-mcp version 0.1.0 in the file src/wezterm_executor.ts. The attack can be performed remotely via the request.params.arguments.pane_id argument.

In ishayoyo excel-mcp up to version 1.0.2, the read_file/write_file functions in src/index.ts are vulnerable to path traversal via manipulation of the filePath/outputPath arguments. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in j3k0 mcp-google-workspace up to commit 831790e7d5c2663325733d9f5579cc339a267c4c. The function saveToDisk in src/tools/gmail.ts has improper access controls. The attack can be initiated remotely and the exploit is public.

In hekmon8 Jenkins-server-mcp version 0.1.0, a server-side request forgery vulnerability exists in the jobPath function of src/index.ts. The attack can be performed remotely and the exploit has been disclosed.

In pip, console_scripts and gui_scripts were treated as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

Sulu, an open-source PHP CMS based on Symfony, before versions 2.6.23 and 3.0.6 uses a weak cryptographic hash algorithm for password reset token and API key generation.

In Nextcloud prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.

In Nextcloud, an open source content collaboration platform, versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission but no UPDATE permission can rename files in a team folder. This has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.

Nextcloud Server contains a vulnerability that allows a malicious user with access to a shared file to use the share token to directly access chunking uploads and view temporary part files during ongoing uploads. The issue affects versions from 32.0.0 to 32.0.8 and from 33.0.0 to 33.0.2.

Nextcloud versions 33.0.0 through before 33.1.0 contain a vulnerability in the Android app. After unlocking a locked Android phone, the back-button could bypass the Nextcloud Files app PIN.