Most severe vulnerabilities for "nextcloud notes"

Where

Sort:

Versions

4.4.0

4.6.0

Nextcloud Notes NextcloudNotes attachment render HTML in preview mode

Risk 38

Severity

6.1

XSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Notes is a note-taking app for Nextcloud, an open-source cloud platform. Starting in version 4.4.0 and prior to version 4.8.0, when creating a note file with HTML, the content is rendered in the preview instead of the file being offered to download. Nextcloud Notes app version 4.8.0 contains a patch for the issue. No known workarounds are available.

First published (updated )

CVE-2023-39955

Nextcloud Notes NextcloudNextcloud Notes app can be tricked into using a received share created before the user logged in

Risk 35

Severity

4.6

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called Notes/ with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.

First published (updated )

CVE-2024-37317

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.