deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-38233
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38234
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38235
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38236
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38237
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38238
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38239
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38240
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38241
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38242
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38243
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38244
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38245
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit an attacker controlled web page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38246
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38247
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38248
Published: 2023-08-10
Description: Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-30.html; https://helpx.adobe.com/security/products/acrobat/apsb23-30.html
CVE: CVE-2023-38397
Published: 2023-08-10
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eggemplo Gestion-Pymes plugin <= 1.5.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gestion-pymes/wordpress-gestion-pymes-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gestion-pymes/wordpress-gestion-pymes-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-39952
Published: 2023-08-10
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1 contain a patch for this issue. No known workarounds are available.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/nextcloud/groupfolders/issues/1906; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-cq8w-v4fh-4rjq; https://github.com/nextcloud/server/pull/38890
CVE: CVE-2023-39953
Published: 2023-08-10
Description: user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-303
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xx3h-v363-q36j; https://github.com/nextcloud/user_oidc/pull/642; https://hackerone.com/reports/2021684
CVE: CVE-2023-37543
Published: 2023-08-10
Description: Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_xport.php. This is a different vulnerability than CVE-2019-16723.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/Cacti/cacti/security/advisories/GHSA-4x82-8w8m-w8hj; https://medium.com/%40hussainfathy99/exciting-news-my-first-cve-discovery-cve-2023-37543-idor-vulnerability-in-cacti-bbb6c386afed; https://github.com/Cacti/cacti/security/advisories/GHSA-4x82-8w8m-w8hj
CVE: CVE-2023-38830
Published: 2023-08-10
Description: An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-2-4fa5e2ccfe2e; https://www.phpjabbers.com/yacht-listing-script; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-2-4fa5e2ccfe2e
CVE: CVE-2023-39776
Published: 2023-08-10
Description: A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-2-4fa5e2ccfe2e; https://www.phpjabbers.com/ticket-support-script; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-2-4fa5e2ccfe2e
CVE: CVE-2023-39954
Published: 2023-08-10
Description: user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.
CVSS Score: 3.8 (LOW)
CWE: CWE-311
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f92-5c8p-f6gq; https://github.com/nextcloud/user_oidc/pull/636; https://hackerone.com/reports/1994328
CVE: CVE-2023-39955
Published: 2023-08-10
Description: Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a patch for the issue. No known workarounds are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/nextcloud/notes/pull/1031; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6g88-37x7-4vw6; https://hackerone.com/reports/1924355
CVE: CVE-2022-47636
Published: 2023-08-10
Description: A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://packetstormsecurity.com/files/174127/OutSystems-Service-Studio-11.53.30-DLL-Hijacking.html; https://www.exploit-db.com/exploits/51678; http://packetstormsecurity.com/files/174127/OutSystems-Service-Studio-11.53.30-DLL-Hijacking.html
CVE: CVE-2023-39957
Published: 2023-08-10
Description: Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. Prior to version 17.0.0, an unprotected intend allowed malicious third party apps to trick the Talk Android app into writing files outside of its intended cache directory. Nextcloud Talk Android version 17.0.0 has a patch for this issue. No known workarounds are available.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36f7-93f3-mcfj; https://github.com/nextcloud/talk-android/pull/3064; https://hackerone.com/reports/1997029
CVE: CVE-2023-40216
Published: 2023-08-10
Description: OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/014_wscons.patch.sig; https://github.com/openbsd/src/commit/9d3f688f46eba347e96ff0ae9506ef2061622e0c; https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/014_wscons.patch.sig
CVE: CVE-2023-36309
Published: 2023-08-10
Description: There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Document Creator v1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/document-creator; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-36310
Published: 2023-08-10
Description: There is a Cross Site Scripting (XSS) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/document-creator; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-36311
Published: 2023-08-10
Description: There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/document-creator; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-36312
Published: 2023-08-10
Description: There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/callback-widget/; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-36313
Published: 2023-08-10
Description: PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "request_feed".
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/document-creator; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-36314
Published: 2023-08-10
Description: There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/callback-widget; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-36315
Published: 2023-08-10
Description: There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4; https://www.phpjabbers.com/callback-widget; https://medium.com/%40milfortutz/multiple-vulnerabilities-in-phpjabbers-part-1-6703becb4cd4
CVE: CVE-2023-4128
Published: 2023-08-10
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208.  Reason: This record is a duplicate of CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. Notes: All CVE users should reference CVE-2023-4206, CVE-2023-4207, CVE-2023-4208 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-39958
Published: 2023-08-10
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, missing protection allows an attacker to brute force the client secrets of configured OAuth2 clients. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vv27-g2hq-v48h; https://github.com/nextcloud/server/pull/38773; https://hackerone.com/reports/1258448
CVE: CVE-2023-39959
Published: 2023-08-10
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g97r-8ffm-hfpj; https://github.com/nextcloud/server/pull/38747; https://hackerone.com/reports/1832126
CVE: CVE-2023-39961
Published: 2023-08-10
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qhgm-w4gx-gvgp; https://github.com/nextcloud/text/pull/4481; https://hackerone.com/reports/1965156
CVE: CVE-2023-39962
Published: 2023-08-10
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. As a workaround, disable app files_external. This also makes the external storage inaccessible but retains the configurations until a patched version has been deployed.
CVSS Score: 7.7 (HIGH)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwxx-2752-w3xm; https://github.com/nextcloud/server/pull/39323; https://hackerone.com/reports/2047168