Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-w5jw-hfvp-gx95 - https://github.com/Combodo/iTop/commit/83125d9ae16cfb2527b9d0ab0805a68b863244a0
CVE ID: CVE-2021-41163 State: PUBLISHED Published: 2021-10-20T22:30:14 Last Updated: 2024-08-04T02:59:31.566Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: discourse Products: discourse Problem Types: CWE-74 Description: Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy. Addition
issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-jcjx-pvpc-qgwq - https://github.com/discourse/discourse/commit/fa3c46cf079d28b086fe1025349bb00223a5d5e9
CVE ID: CVE-2021-41164 State: PUBLISHED Published: 2021-11-17T00:00:00 Last Updated: 2024-08-04T02:59:31.641Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: ckeditor Products: ckeditor4 Problem Types: CWE-79 Description: CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix w
e. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-pvmx-g8h5-cprj - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.drupal.org/sa-core-2021-011 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKU
2.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
CVE ID: CVE-2021-41165 State: PUBLISHED Published: 2021-11-17T19:15:11 Last Updated: 2024-08-04T02:59:31.758Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: ckeditor Products: ckeditor4 Problem Types: CWE-79 Description: CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix wi
. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-417 - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7h26-63m7-qhf2 - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.drupal.org/sa-core-2021-011 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-41166 State: PUBLISHED Published: 2022-01-26T22:35:10.000Z Last Updated: 2025-04-23T19:09:02.193Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-276 Description: The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds. Additional An
ages it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1358597 - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4 - https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086 - https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0c
CVE ID: CVE-2021-41167 State: PUBLISHED Published: 2021-10-20T18:25:12 Last Updated: 2024-08-04T02:59:31.679Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: nicolas-van Products: modern-async Problem Types: CWE-400 Description: modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potentia
ng these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2 - https://github.com/nicolas-van/modern-async/issues/5 - https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436
CVE ID: CVE-2021-41168 State: PUBLISHED Published: 2021-10-21T20:10:12 Last Updated: 2024-08-04T02:59:31.761Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: reddit Products: snudown Problem Types: CWE-400, CWE-20, CWE-327 Description: Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown ` [reference_name]: https://www.example.com` are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably gen
` are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further the hash table allowed for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA(https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). Users are advised to update to version 1.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/reddit/snudown/security/adviso
.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6 - https://github.com/reddit/snudown/commit/1ac2c130b210539ee1e5d67a7bac93f9d8007c0e
CVE ID: CVE-2021-41169 State: PUBLISHED Published: 2021-10-21T20:25:10 Last Updated: 2024-08-04T02:59:31.756Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: sulu Products: sulu Problem Types: CWE-79 Description: Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fx - https://github.com/sulu/su
ntainer: References: - https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fx - https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445
CVE ID: CVE-2021-41170 State: PUBLISHED Published: 2021-11-08T19:10:10 Last Updated: 2024-08-04T02:59:31.638Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sroehrl Products: neoan3-template Problem Types: CWE-277, CWE-74 Description: neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously. In theory all users of the package are affected as long a
nd can therefore be executed either by mistake or maliciously. In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible. Version 1.1.1 has addressed this vulnerability. Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sroehrl/neoan3-template/security/advisories/GHSA-3v56-q6r6-4gcw - https://github.com/sroehrl/neoan3-template/issues/8 - https://github.com/sroehrl/neoan3-template/commit/4a2c9570f071d3c8f4ac
s://github.com/sroehrl/neoan3-template/issues/8 - https://github.com/sroehrl/neoan3-template/commit/4a2c9570f071d3c8f4ac790007599cba20e16934
CVE ID: CVE-2021-41171 State: PUBLISHED Published: 2021-10-22T18:55:11 Last Updated: 2024-08-04T02:59:31.546Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: elabftw Products: elabftw Problem Types: CWE-307 Description: eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute
as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv - https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b - https://github.com/elabftw/elabftw/releases/tag/4.1.0 - https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_
.com/elabftw/elabftw/releases/tag/4.1.0 - https://owasp.org/www-community/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies - https://www.exploit-db.com/docs/50436
CVE ID: CVE-2021-41172 State: PUBLISHED Published: 2021-10-26T14:00:12 Last Updated: 2024-08-04T02:59:31.617Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Medicean Products: AS_Redis Problem Types: CWE-79 Description: AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is patched in version 0.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Medicean/AS_Redis/security/advisories/GHSA
onal Analyst Notes: - CVE Program Container: References: - https://github.com/Medicean/AS_Redis/security/advisories/GHSA-j8j6-f829-w425 - https://github.com/AntSword-Store/AS_Redis/issues/1 - https://mp.weixin.qq.com/s/yjuG6DLT_bSRnpggPj21Xw
CVE ID: CVE-2021-41173 State: PUBLISHED Published: 2021-10-26T14:05:12 Last Updated: 2024-08-04T02:59:31.575Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: ethereum Products: go-ethereum Problem Types: CWE-20 Description: Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59
nalyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v - https://github.com/ethereum/go-ethereum/pull/23801 - https://github.com/ethereum/go-ethereum/commit/e40b37718326b8b4873b3b00a0db2e6c6d9ea738 - https://github.com/ethereum/go-ethereum/releases/tag/v1.10.9
CVE ID: CVE-2021-41174 State: PUBLISHED Published: 2021-11-03T18:00:12 Last Updated: 2024-08-04T02:59:31.645Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: grafana Products: grafana Problem Types: CWE-79 Description: Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit
ed and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can
n contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8 - https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912 - https://github.com/grafana/grafana/commit/3cb5214fa45eb5a571fd70d6c6edf0d729983f82 - https://github.com/grafana/grafana/commit/fb85ed691290d211a5baa44d9a641ab137f0de88 - https://security.netapp.com/advisory/ntap-20211125-0003/
CVE ID: CVE-2021-41175 State: PUBLISHED Published: 2021-10-26T14:10:12 Last Updated: 2024-08-04T02:59:31.690Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: pi-hole Products: AdminLTE Problem Types: CWE-79 Description: Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistics generated by FTLDNS. Prior to version 5.8, cross-site scripting is possible when adding a client via the groups-clients management page. This issue was patched in version 5.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43 - https:/
E Program Container: References: - https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43 - https://github.com/pi-hole/AdminLTE/commit/01191c7a1b8d5032991ed9d88e0db8d3dbec744d - https://github.com/pi-hole/AdminLTE/releases/tag/v5.8
CVE ID: CVE-2021-41176 State: PUBLISHED Published: 2021-10-25T16:50:10 Last Updated: 2024-08-04T02:59:31.636Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pterodactyl Products: panel Problem Types: CWE-352 Description: Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is
Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6 - https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2 - https://github.com/pterodactyl/panel/releases/tag/v1.6.3
CVE ID: CVE-2021-41177 State: PUBLISHED Published: 2021-10-25T21:50:11 Last Updated: 2024-08-04T02:59:31.688Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-799 Description: Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrottle` or `UserRateThrottle`) was thus not rate limited on instances not having a memory cache backend configured. In the case of a default installation, this would notably incl
n instances not having a memory cache backend configured. In the case of a default installation, this would notably include the rate-limits on the two factor codes. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5, or 22.2.0. As a workaround, enable a memory cache backend in `config.php`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fj39-4qx4-m3f2 - https://github.com/nextcloud/server/pull/28728 - https://hackerone.com/reports/1265709 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-41178 State: PUBLISHED Published: 2021-10-25T21:55:11 Last Updated: 2024-08-04T02:59:31.637Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-23, CWE-434 Description: Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link t
, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jp9c-vpr3-m5rf - https://github.com/nextcloud/server/pull/28726 - https://hackerone.com/reports/1302155 - https://security.gentoo.org/glsa/20
s://github.com/nextcloud/server/pull/28726 - https://hackerone.com/reports/1302155 - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-41179 State: PUBLISHED Published: 2021-10-25T22:00:13 Last Updated: 2024-08-04T02:59:31.640Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-304 Description: Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat ch
is particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hvh-rc6f-px23 - https://github.com/nextcloud/server/pull/28725 - https://hackerone.com/reports/1322865
CVE ID: CVE-2021-41180 State: PUBLISHED Published: 2022-03-08T17:45:12.000Z Last Updated: 2025-04-22T18:20:21.541Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-601 Description: Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known
sers of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4fxr-mrw2-cq92 - https://github.com/nextcloud/spreed/pull/6239 - https://hackerone.com/reports/1337178
CVE ID: CVE-2021-41181 State: PUBLISHED Published: 2022-03-08T17:50:10.000Z Last Updated: 2025-04-23T18:58:39.326Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.