Nextcloud Server — набор клиент-серверных программ для создания и использования хранилища данных.

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message ...

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission in ...

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the ...

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Ser ...

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoof ...

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of f ...

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.