CVE Vulnerability Catalog

Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attacker to take away a 2FA WebAuthn device when correctly guessing an 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login; the attacker cannot authenticate as the victim.

In Nextcloud Talk prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.

In the Nextcloud Contacts app prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. JavaScript and other options were correctly blocked by the content security policy of the Nextcloud Server code. This vulnerability is fixed in 5.5.4, 6.0.6, and 7.2.5.

Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was sent to the server unencrypted, making it possible for administrators to see it in log files.

In Nextcloud Deck prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into downloading files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.

Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin.

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user's file into "pending approval" without access to the file by using the numeric file id.

In the Nextcloud Mail app prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into email subjects. JavaScript was correctly blocked by the content security policy of the Nextcloud Server code.

Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a sequential ID without knowing the appointment token. This vulnerability is fixed in 4.7.19, 5.5.6, and 6.0.1.

Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level. Prior to 0.0.16, a bug in the sandboxing logic meant that network sandboxing was not properly enforced if the sandbox policy did not configure any allowed domains, allowing sandboxed code to make network requests outside the sandbox. A patch was released in v0.0.16.

An Insecure Direct Object Reference vulnerability in Medtronic CareLink Network allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network before December 4, 2025.

A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of /index.php/admins/Comment/addcomment.html of the Comment Handler component. Manipulating the body argument leads to cross site scripting, the attack may be initiated remotely, and the exploit is publicly available. The vendor was contacted but did not respond.

A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1 in an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile in the Domain Name Binding Page component. The manipulation results in cross site scripting. The attack may be performed remotely and has a high complexity level.

A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1 in some unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 in the Add Data Validation Page component. Manipulation of the data[name] argument leads to cross site scripting. The attack is possible remotely.

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify that a user has access to a specific event when duplicating it, leading to arbitrary event disclosure to users with a role as low as Contributor.

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to modify or erase tamper events via the Chassis management board.

Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. Allows an authenticated user with administrator privileges to list directories outside the authorized area using the 'directory' parameter in '/mod/ajax.php?action=sections/list/list'.

Mattermost versions 10.11.x <= 10.11.4 and 10.5.x <= 10.5.12 fail to validate user permissions when accessing files and subscribing to blocks in Boards. An authenticated user can access files from other boards and subscribe to blocks from boards they do not have access to.

Vulnerability in nutzam NutzBoot up to 2.6.0-SNAPSHOT, affecting the getInputStream function in nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the LiteRpc-Serializer component, leading to deserialization. The attack can be launched remotely but is difficult to exploit.