Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32749 State: PUBLISHED Published: 2021-07-16T00:00:00 Last Updated: 2024-08-03T23:33:54.871Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: fail2ban Products: fail2ban Problem Types: CWE-78 Description: fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois o
mail-whois` can execute command if unescaped sequences (`\n~`) are available in "foreign" input (for instance in whois output). To exploit the vulnerability, an attacker would need to insert malicious characters into the response sent by the whois server, either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround, one may avoid the usage of action `mail-whois` or patch the vulnerability manually. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fail2ban/fail2ban/security/advisories/GHSA-m985-3f3v-cwmm - https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024a33c9 - h
dvisories/GHSA-m985-3f3v-cwmm - https://github.com/fail2ban/fail2ban/commit/2ed414ed09b3bb4c478abc9366a1ff22024a33c9 - https://github.com/fail2ban/fail2ban/commit/410a6ce5c80dd981c22752da034f2529b5eee844 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5WHJK2X2MR2WDYZMCW7COZXJDUSDYMY6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZRYQ77MTX5WSV33VCJLK4KBKR55QZ7ZA/ - https://security.gentoo.org/glsa/202310-13
CVE ID: CVE-2021-32750 State: PUBLISHED Published: 2021-07-15T16:35:10 Last Updated: 2024-08-03T23:33:55.577Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: zlatinb Products: muwire Problem Types: CWE-200 Description: MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL with an HTML image tag and the MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fix
e MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fixed in MuWire 0.8.8. As a workaround, users can disable messaging functionality to prevent other users from sending them malicious messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zlatinb/muwire/security/advisories/GHSA-68xh-9h7w-64qg
CVE ID: CVE-2021-32751 State: PUBLISHED Published: 2021-07-20T22:55:12 Last Updated: 2024-08-03T23:33:55.749Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gradle Products: gradle Problem Types: CWE-78 Description: Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and the `gradlew` script are both vulnerable to arbitrary code execution when an attacker is able to change environment variables for the user running the script. This may impact those who use `gradlew` on Unix-like systems or use the scripts generated by Gradle in thieir application on Unix-like systems. For this
adlew` on Unix-like systems or use the scripts generated by Gradle in thieir application on Unix-like systems. For this vulnerability to be exploitable, an attacker needs to be able to set the value of particular environment variables and have those environment variables be seen by the vulnerable scripts. This issue has been patched in Gradle 7.2 by removing the use of `eval` and requiring the use of the `bash` shell. There are a few workarounds available. For CI/CD systems using the Gradle build tool, one may ensure that untrusted users are unable to change environment variables for the user that executes `gradlew`. If one is unable to upgrade to Gradle 7.2, one may generate a new `gradlew`
iables for the user that executes `gradlew`. If one is unable to upgrade to Gradle 7.2, one may generate a new `gradlew` script with Gradle 7.2 and use it for older versions of Gradle. Fpplications using start scripts generated by Gradle, one may ensure that untrusted users are unable to change environment variables for the user that executes the start script. A vulnerable start script could be manually patched to remove the use of `eval` or the use of environment variables that affect the application's command-line. If the application is simple enough, one may be able to avoid the use of the start scripts by running the application directly with Java command. Additional Analyst Notes: - CVE
void the use of the start scripts by running the application directly with Java command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories/GHSA-6j2p-252f-7mw8 - https://medium.com/dot-debug/the-perils-of-bash-eval-cc5f9e309cae - https://mywiki.wooledge.org/BashFAQ/048
CVE ID: CVE-2021-32752 State: PUBLISHED Published: 2021-07-09T14:05:11 Last Updated: 2024-08-03T23:33:55.553Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ethercreative Products: logs Problem Types: CWE-552 Description: Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may disable the plugin if untrustworthy sources have admin access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/et
worthy sources have admin access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethercreative/logs/security/advisories/GHSA-fp63-499m-hq6m - https://github.com/ethercreative/logs/releases/tag/3.0.4
CVE ID: CVE-2021-32753 State: PUBLISHED Published: 2021-07-09T19:05:11 Last Updated: 2024-08-03T23:33:55.604Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: edgexfoundry Products: edgex-go Problem Types: CWE-284, CWE-287, CWE-521 Description: EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy us
he client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and
nd release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/edgexfoundry/edgex-go/security/advisories/GHSA-xph4-vmcc-52gh - https://docs.konghq.com/hub/kong-inc/oauth2/#create-a-consumer
CVE ID: CVE-2021-32754 State: PUBLISHED Published: 2021-07-12T23:00:11 Last Updated: 2024-08-03T23:33:55.825Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: secure-software-engineering Products: FlowDroid Problem Types: CWE-611 Description: FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed an attacker who had control over the source/sink definition file in XML format to read files from external locations. In order for this to occur, the XML-based format for sources and sinks had to be used and the attacker had to able control the source/sink definition file. The vulner
at for sources and sinks had to be used and the attacker had to able control the source/sink definition file. The vulnerability was patched in version 2.9.0. As a workaround, do not allow untrusted entities to control the source/sink definition file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/secure-software-engineering/FlowDroid/security/advisories/GHSA-39r7-275f-rvgw
CVE ID: CVE-2021-32755 State: PUBLISHED Published: 2021-07-13T20:55:09 Last Updated: 2024-08-03T23:33:55.754Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wireapp Products: wire-ios-transport Problem Types: CWE-295 Description: Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new websocket implementation is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced
is not configured to enforce certificate pinning when available. Certificate pinning for the new websocket is enforced in version 3.84 or above. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-v8mx-h3vj-w39v
CVE ID: CVE-2021-32756 State: PUBLISHED Published: 2021-07-21T18:45:15 Last Updated: 2024-08-03T23:33:55.684Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ManageIQ Products: manageiq Problem Types: CWE-74 Description: ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1.
ot privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq
CVE ID: CVE-2021-32758 State: PUBLISHED Published: 2021-08-27T17:30:10 Last Updated: 2024-08-03T23:33:55.894Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenMage Products: magento-lts Problem Types: CWE-91 Description: OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-26rr-v2j2-25fh - https://github.com
iner: References: - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-26rr-v2j2-25fh - https://github.com/OpenMage/magento-lts/releases/tag/v19.4.15 - https://github.com/OpenMage/magento-lts/releases/tag/v20.0.11
CVE ID: CVE-2021-32759 State: PUBLISHED Published: 2021-08-27T22:00:11 Last Updated: 2024-08-03T23:33:55.914Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenMage Products: magento-lts Problem Types: CWE-20 Description: OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/releases/tag/v19.4.15 - https:/
st Notes: - CVE Program Container: References: - https://github.com/OpenMage/magento-lts/releases/tag/v19.4.15 - https://github.com/OpenMage/magento-lts/security/advisories/GHSA-xm9f-vxmx-4m58 - https://github.com/OpenMage/magento-lts/releases/tag/v20.0.13
CVE ID: CVE-2021-32760 State: PUBLISHED Published: 2021-07-19T00:00:00 Last Updated: 2024-11-19T14:27:20.905Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: containerd Products: containerd Problem Types: CWE-668 Description: containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow
he file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-r
er: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w - https://github.com/containerd/containerd/releases/tag/v1.4.8 - https://github.com/containerd/containerd/releases/tag/v1.5.4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDMNDPJJTP3J5GOEDB66F6MGXUTRG3Y3/ - https://security.gentoo.org/glsa/202401-31
CVE ID: CVE-2021-32761 State: PUBLISHED Published: 2021-07-21T20:50:09 Last Updated: 2024-08-03T23:33:55.821Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-125, CWE-680 Description: Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves c
ploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command. Add
onfiguration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj - https://lists.debian.org/debian-lts-announce/2021/07/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGX7RRAWGXWXEAKJTQYSDSBO2BC3SAHD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6O7AUOROBYGP5IMGJPC5HZ3R2RB6GZ5X/ - https://security.netapp.com/advisory/ntap-20210827-0004/ - https://lists.debian.org/debian-lts-announce/2021/0
B6GZ5X/ - https://security.netapp.com/advisory/ntap-20210827-0004/ - https://lists.debian.org/debian-lts-announce/2021/08/msg00026.html - https://www.debian.org/security/2021/dsa-5001 - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2021-32762 State: PUBLISHED Published: 2021-10-04T18:00:11 Last Updated: 2024-08-03T23:33:55.894Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: redis Problem Types: CWE-190, CWE-680 Description: Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocat
n overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr - https://github.com/redis/redis/commit/0215324a66af949be39b34be2d55143232c1cb71 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
5324a66af949be39b34be2d55143232c1cb71 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/ - https://www.debian.org/security/2021/dsa-5001 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211104-0003/ - https://security.gentoo.org/glsa/202209-17
CVE ID: CVE-2021-32763 State: PUBLISHED Published: 2021-07-20T16:50:10 Last Updated: 2024-08-03T23:33:55.735Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: opf Products: openproject Problem Types: CWE-400 Description: OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `<pre>` tags from the message being quoted. The `(.|\s)` part can match a space character in two ways, so an unterminated `<pre>` tag containing `n` spaces causes Ruby's regex en
art can match a space character in two ways, so an unterminated `<pre>` tag containing `n` spaces causes Ruby's regex engine to backtrack to try 2<sup>n</sup> states in the NFA. This will result in a Regular Expression Denial of Service. The issue is fixed in OpenProject 11.3.3. As a workaround, one may install the patch manually. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56f - https://github.com/opf/openproject/pull/9447.patch
CVE ID: CVE-2021-32764 State: PUBLISHED Published: 2021-07-15T20:40:13 Last Updated: 2024-08-03T23:33:56.227Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As a workaround, ensure that the Content Security
6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-9x4c-29xg-56hw
CVE ID: CVE-2021-32765 State: PUBLISHED Published: 2021-10-04T00:00:00 Last Updated: 2024-08-03T23:33:55.893Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: redis Products: hiredis Problem Types: CWE-190, CWE-680 Description: Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a sh
epresented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2 - https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e - https://wiki.sei.cmu.edu/confluence/display/c/MEM07-C.+Ensure+that+the+arguments+to+calloc%28%29%2C+when+multipli
ed1e - https://wiki.sei.cmu.edu/confluence/display/c/MEM07-C.+Ensure+that+the+arguments+to+calloc%28%29%2C+when+multiplied%2C+do+not+wrap - https://lists.debian.org/debian-lts-announce/2021/10/msg00007.html - https://security.netapp.com/advisory/ntap-20211104-0003/ - https://security.gentoo.org/glsa/202210-32
CVE ID: CVE-2021-32766 State: PUBLISHED Published: 2021-09-07T21:05:11 Last Updated: 2024-08-03T23:33:55.653Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-209 Description: Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application returned different error messages depending on whether a folder existed in a public link share. This is problematic in case the public link share has been created with "Upload Only" privileges. (aka "File Drop"). A link share recipient is not expected to see which folders or fi