Skip to contentKiteworks vulnerabilities
Newest
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of themCVE-2024-525163.0 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's global credentials of external storages are sent back to the frontendCVE-2024-525174.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server is missing password confirmation when changing external storage optionsCVE-2024-525184.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's OAuth2 client secrets were stored in a recoverable wayCVE-2024-525192.7 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's link reference provider can be tricked into downloading bigger files than intendedCVE-2024-525205.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has a potential hash collision for background jobs could skip queuing themCVE-2024-525212.6 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server Custom defined credentials of external storages are sent back to the frontendCVE-2024-525234.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server User password is available in memory of the PHP processCVE-2024-525251.8 Low
- kiteworks owncloudCross Site Request Forgery in Kiteworks OwnCloudCVE-2023-72736.8 Medium
- steeltoeoss discovery, kiteworks security-advisories +1 moreBasic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer AwarenessCVE-2024-40636Fix available5.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's events information leaked with shared calendars on recurrence exceptionsCVE-2024-378873.5 Low
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc's ID4me does not validate signature or expirationCVE-2024-378865.4 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreCode injection in Nextcloud Desktop Client for macOSCVE-2024-378853.8 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's users can delete old versions of read-only shared filesCVE-2024-378843.5 Low
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck can access comments and attachments of deleted cardsCVE-2024-378834.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server can reshare read&share only folder with more permissionsCVE-2024-378828.1 High
- nextcloud notes, kiteworks security-advisories +1 moreNextcloud Notes app can be tricked into using a received share created before the user logged inCVE-2024-373174.6 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreNextcloud Calendar's event create can create attachments that link to other websitesCVE-2024-373164.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's read-only users can restore old versionsCVE-2024-373153.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Photos' shared albums have no restriction on photo removalCVE-2024-373143.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud server allows the by-pass the second factorCVE-2024-373137.3 High
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc app's ID4me feature is available even when disabledCVE-2024-373126.3 Medium
- kiteworks totemomailKiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId...CVE-2024-280649.8 Critical
- kiteworks totemomailKiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient...CVE-2024-280636.1 Medium
- nextcloud guests, kiteworks security-advisories +1 moreImproper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlistCVE-2024-224025.4 Medium
- nextcloud guests, kiteworks security-advisories +1 moreAll users can reset the allowed apps list for Nextcloud Guest App usersCVE-2024-224014.1 Medium
- kiteworks security-advisories, nextcloud zipper +1 morePermissions bypass in Nextcloud with the files zip appCVE-2024-224044.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreOAuth2 authorization codes are valid indefinetly in Nextcloud serverCVE-2024-224033.0 Low
- kiteworks security-advisories, nextcloud sso \& saml authentication +1 moreOpen redirect in user_saml via RelayState parameter in Nextcloud User SamlCVE-2024-224003.1 Low
- nextcloud deck, kiteworks security-advisories +1 moreCross-site Scripting when sending HTML as a comment in the Nextcloud Deck appCVE-2024-222130.0 None
- nextcloud global site selector, kiteworks security-advisories +1 moreNextcloud global site selector authentication bypassCVE-2024-222129.7 Critical
- nextcloud server, kiteworks security-advisories +1 moreBruteforce protection can be bypassed with misconfigured proxyCVE-2023-49792Public exploit5.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreWorkflows do not require password confirmation on API levelCVE-2023-497915.4 Medium
- nextcloud, kiteworks security-advisories +1 moreApp PIN code can be bypassed in Nextcloud Files iOSCVE-2023-49790Fix available4.3 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreCalendar app returns full stacktrace when an error happens while editing appointmentCVE-2023-483083.5 Low
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail app vulnerable to Server-Side Request ForgeryCVE-2023-483073.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRFCVE-2023-483065.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server user_ldap app logs user passwords in the log file on level debugCVE-2023-483054.2 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any userCVE-2023-483044.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server admins can change authentication details of user configured external storageCVE-2023-483032.4 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+VCVE-2023-483023.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server HTML injection in search UI when selecting a circle with HTML in the display nameCVE-2023-483013.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server users can make external storage mount points inaccessible for other usersCVE-2023-482398.5 High
- nextcloud calendar, kiteworks security-advisories +1 moreInviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsiveCVE-2023-451504.3 Medium
- nextcloud talk, kiteworks security-advisories +1 morePassword of talk conversations can be bruteforced in NextcloudCVE-2023-451494.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreRate limiter not working reliable when Memcached is installed in NextcloudCVE-2023-451484.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreOAuth2 client_secret stored in plain text in the Nextcloud databaseCVE-2023-451516.5 Medium
- nextcloud mail, kiteworks security-advisories +1 moreRequire strict cookies for image proxy requests in Nextcloud MailCVE-2023-456604.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpointCVE-2023-399605.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreMissing password confirmation when creating app passwordsCVE-2023-399638.1 High
- Show moreLoading…