Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15582 State: PUBLISHED Published: 2020-01-28T02:36:05 Last Updated: 2024-08-05T00:49:13.762Z Vendors: GitLab Products: GitLab EE Problem Types: CWE-639 Description: An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any private group to a protected environment. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - https://hackerone.com/reports/566216
CVE ID: CVE-2019-15583 State: PUBLISHED Published: 2020-01-28T02:24:38 Last Updated: 2024-08-05T00:49:13.753Z Vendors: GitLab Products: GitLab CE/EE Problem Types: CWE-200 Description: An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - https://hackerone.com/reports/643854
CVE ID: CVE-2019-15584 State: PUBLISHED Published: 2019-12-20T21:02:40 Last Updated: 2024-08-05T00:49:13.651Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-400 Description: A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/670572
CVE ID: CVE-2019-15585 State: PUBLISHED Published: 2020-01-28T02:21:16 Last Updated: 2024-08-05T00:49:13.654Z Vendors: GitLab Products: Gitlab CE/EE Problem Types: CWE-287 Description: Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/ - https://hackerone.com/reports/471323
CVE ID: CVE-2019-15586 State: PUBLISHED Published: 2020-01-28T02:14:59 Last Updated: 2024-08-05T00:49:13.628Z Vendors: GitLab Products: Gitlab CE/EE Problem Types: CWE-79 Description: A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/645043 - https://about.gitlab.com/blog/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/
CVE ID: CVE-2019-15587 State: PUBLISHED Published: 2019-10-22T20:07:47 Last Updated: 2024-08-05T00:49:13.632Z Vendors: n/a Products: Loofah (rubygem) Problem Types: CWE-79 Description: In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/709009 - https://github.com/flavorjones/loofah/issues/171 - https://www.debian.org/security/2019/dsa-4554 - https://security.netapp.com/advisory/ntap-20191122-0003/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4X
3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5/ - https://usn.ubuntu.com/4498-1/
CVE ID: CVE-2019-15588 State: PUBLISHED Published: 2019-11-01T14:46:12 Last Updated: 2024-08-05T00:49:13.756Z Vendors: n/a Products: Nexus Repository Manager Problem Types: CWE-77 Description: There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/688270 - https://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-
tps://support.sonatype.com/hc/en-us/articles/360033490774-CVE-2019-5475-Nexus-Repository-Manager-2-OS-Command-Injection-2019-08-09
CVE ID: CVE-2019-15589 State: PUBLISHED Published: 2019-12-18T21:00:39 Last Updated: 2024-08-05T00:49:13.715Z Vendors: n/a Products: GitLab CE/EE Problem Types: CWE-284 Description: An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/497047
CVE ID: CVE-2019-15590 State: PUBLISHED Published: 2020-01-28T02:31:05 Last Updated: 2024-08-05T00:49:13.635Z Vendors: GitLab Products: GitLab EE Problem Types: CWE-284 Description: An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/701144 - https://about.gitlab.com/releases/2019/10/07/security-release-gitlab-12-dot-3-dot-5-released/
CVE ID: CVE-2019-15591 State: PUBLISHED Published: 2019-12-18T20:51:27 Last Updated: 2024-08-05T00:49:13.787Z Vendors: n/a Products: GitLab Problem Types: CWE-284 Description: An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/676976
CVE ID: CVE-2019-15592 State: PUBLISHED Published: 2020-02-14T21:27:56 Last Updated: 2024-08-05T00:49:13.674Z Vendors: n/a Products: GitLab Problem Types: CWE-200 Description: GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/588876 - https://about.gitlab.com/releases/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE ID: CVE-2019-15593 State: PUBLISHED Published: 2019-11-22T21:57:26 Last Updated: 2024-08-05T00:49:13.649Z Vendors: n/a Products: GitLab Problem Types: CWE-400 Description: GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/557154
CVE ID: CVE-2019-15594 State: PUBLISHED Published: 2020-02-14T21:29:53 Last Updated: 2024-08-05T00:49:13.721Z Vendors: n/a Products: GitLab Problem Types: CWE-200 Description: GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/ - https://hackerone.com/reports/507064
CVE ID: CVE-2019-15595 State: PUBLISHED Published: 2019-11-25T23:19:35 Last Updated: 2024-08-05T00:49:13.715Z Vendors: n/a Products: UniFi Video Server Problem Types: CWE-77 Description: A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/544928
CVE ID: CVE-2019-15596 State: PUBLISHED Published: 2019-12-18T20:59:06 Last Updated: 2024-08-05T00:49:13.624Z Vendors: n/a Products: statics-server Problem Types: CWE-22 Description: A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/695416
CVE ID: CVE-2019-15597 State: PUBLISHED Published: 2019-12-18T20:58:51 Last Updated: 2024-08-05T00:49:13.599Z Vendors: n/a Products: node-df Problem Types: CWE-94 Description: A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/703412
CVE ID: CVE-2019-15598 State: PUBLISHED Published: 2019-12-18T20:58:31 Last Updated: 2024-08-05T00:49:13.755Z Vendors: n/a Products: treekill Problem Types: CWE-94 Description: A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/703415
CVE ID: CVE-2019-15599 State: PUBLISHED Published: 2019-12-18T20:56:56 Last Updated: 2024-08-05T00:49:13.640Z Vendors: n/a Products: tree-kill Problem Types: CWE-94 Description: A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/701183
CVE ID: CVE-2019-15600 State: PUBLISHED Published: 2019-12-18T20:56:21 Last Updated: 2024-08-05T00:49:13.746Z Vendors: n/a Products: http_server Problem Types: CWE-22 Description: A Path traversal exists in http_server which allows an attacker to read arbitrary system files. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/692262
CVE ID: CVE-2019-15601 State: REJECTED Published: 2020-01-06T16:32:53 Last Updated: 2020-04-16T19:09:37 Description: No description available.
CVE ID: CVE-2019-15602 State: PUBLISHED Published: 2020-01-06T16:32:41 Last Updated: 2024-08-05T00:49:13.761Z Vendors: n/a Products: fileview Problem Types: CWE-79 Description: The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/507159
CVE ID: CVE-2019-15603 State: PUBLISHED Published: 2020-01-06T16:32:36 Last Updated: 2024-08-05T00:49:13.727Z Vendors: n/a Products: seeftl Problem Types: CWE-79 Description: The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/665302
CVE ID: CVE-2019-15604 State: PUBLISHED Published: 2020-02-07T14:57:07 Last Updated: 2025-04-30T22:24:22.492Z Vendors: NodeJS Products: Node Problem Types: CWE-295 Description: Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2020:0573 - https://access.redhat.com/errata/RHSA-2020:0579 - https://access.redhat.com/errata/RHSA-2020:0597 - https://access.redhat.com/errata/RHSA-2020:0598 - https://access.redhat.com/errata/RHSA-2020:0602 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html - http
ess.redhat.com/errata/RHSA-2020:0602 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html - https://security.gentoo.org/glsa/202003-48 - https://www.debian.org/security/2020/dsa-4669 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://hackerone.com/reports/746733 - https://nodejs.org/en/blog/release/v13.8.0/ - https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/ - https://nodejs.org/en/blog/release/v10.19.0/ - https://nodejs.org/en/blog/release/v12.15.0/ - https://security.netapp.com/advisory/ntap-20200221-0004/
CVE ID: CVE-2019-15605 State: PUBLISHED Published: 2020-02-07T14:55:22 Last Updated: 2025-04-30T22:24:23.404Z Vendors: NodeJS Products: Node Problem Types: CWE-444 Description: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/ - https://access.redhat.com/errata/RHSA-2020:0573 - https://access.redhat.c
rg/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/ - https://access.redhat.com/errata/RHSA-2020:0573 - https://access.redhat.com/errata/RHSA-2020:0579 - https://access.redhat.com/errata/RHSA-2020:0597 - https://access.redhat.com/errata/RHSA-2020:0598 - https://access.redhat.com/errata/RHSA-2020:0602 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html - https://access.redhat.com/errata/RHSA-2020:0703 - https://access.redhat.com/errata/RHSA-2020:0707 - https://access.redhat.com/errata/RHSA-2020:0708 - https://security.gentoo.org/glsa/202003-48 - https://www.debian.org/security/2020/dsa-4669 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com//se
.debian.org/security/2020/dsa-4669 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://nodejs.org/en/blog/release/v13.8.0/ - https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/ - https://nodejs.org/en/blog/release/v10.19.0/ - https://nodejs.org/en/blog/release/v12.15.0/ - https://security.netapp.com/advisory/ntap-20200221-0004/ - https://hackerone.com/reports/735748
CVE ID: CVE-2019-15606 State: PUBLISHED Published: 2020-02-07T14:58:08 Last Updated: 2025-04-30T22:24:24.274Z Vendors: NodeJS Products: Node Problem Types: CWE-20 Description: Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2020:0573 - https://access.redhat.com/errata/RHSA-2020:0579 - https://access.redhat.com/errata/RHSA-2020:0597 - https://access.redhat.com/errata/RHSA-2020:0598 - https://access.redhat.com/errata/RHSA-2020:0602 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00
8 - https://access.redhat.com/errata/RHSA-2020:0602 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00008.html - https://security.gentoo.org/glsa/202003-48 - https://www.debian.org/security/2020/dsa-4669 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://nodejs.org/en/blog/release/v13.8.0/ - https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/ - https://nodejs.org/en/blog/release/v10.19.0/ - https://nodejs.org/en/blog/release/v12.15.0/ - https://security.netapp.com/advisory/ntap-20200221-0004/ - https://hackerone.com/reports/730779
CVE ID: CVE-2019-15607 State: PUBLISHED Published: 2020-01-28T02:13:16 Last Updated: 2024-08-05T00:49:13.677Z Vendors: n/a Products: node-red Problem Types: CWE-79 Description: A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/681986
CVE ID: CVE-2019-15608 State: PUBLISHED Published: 2020-03-15T17:08:13 Last Updated: 2024-08-05T00:49:13.783Z Vendors: n/a Products: yarn Problem Types: CWE-840 Description: The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/703138 - https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c - https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190
CVE ID: CVE-2019-15609 State: PUBLISHED Published: 2020-02-28T19:30:41 Last Updated: 2024-08-05T00:49:13.714Z Vendors: n/a Products: kill-port-process Problem Types: CWE-77 Description: The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/661959
CVE ID: CVE-2019-15610 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.860Z Vendors: n/a Products: Nextcloud Circles Problem Types: CWE-285 Description: Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/673724 - https://nextcloud.com/security/advisory/?id=NC-SA-2019-013
CVE ID: CVE-2019-15611 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.928Z Vendors: n/a Products: Nextcloud iOS Problem Types: CWE-657 Description: Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/672623 - https://nextcloud.com/security/advisory/?id=NC-SA-2019-017
CVE ID: CVE-2019-15612 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:21.976Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-384 Description: A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/486693 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-001
CVE ID: CVE-2019-15613 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.890Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-20 Description: A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/697959 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-002 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html
CVE ID: CVE-2019-15614 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.821Z Vendors: n/a Products: Nextcloud iOS App Problem Types: CWE-79 Description: Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/575562 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-003
CVE ID: CVE-2019-15615 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.881Z Vendors: n/a Products: Nextcloud Android Problem Types: CWE-284 Description: A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/747726 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-004
CVE ID: CVE-2019-15616 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.887Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-93 Description: Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/592864 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-005
CVE ID: CVE-2019-15617 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.894Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-287 Description: A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/722748 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-006
CVE ID: CVE-2019-15618 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:22.096Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-79 Description: Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/515484 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-007
CVE ID: CVE-2019-15619 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:22.104Z Vendors: n/a Products: Nextcloud Server Problem Types: CWE-79 Description: Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/662204 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-008 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-009 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-010
CVE ID: CVE-2019-15620 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:22.101Z Vendors: n/a Products: Nextcloud Talk Problem Types: CWE-287 Description: Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/662218 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-011
CVE ID: CVE-2019-15621 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:22.056Z Vendors: n/a Products: Nextcloud Server Problem Types: Privilege Escalation (CAPEC-233) Description: Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/619484 - https://nextcloud.com/security/advisory/?id=NC-SA-2020-012 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html - http://lists.opensuse.org/opensuse-security-announce/
ts.opensuse.org/opensuse-security-announce/2020-02/msg00019.html - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html
CVE ID: CVE-2019-15622 State: PUBLISHED Published: 2020-02-04T19:08:57 Last Updated: 2024-08-05T00:56:20.921Z Vendors: n/a Products: Nextcloud Android Problem Types: CWE-89 Description: Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/518669 - https://nextcloud.com/security/advisory/?id=NC-SA-2019-011