Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,825

CVE-2024-52519

Nextcloud Server's OAuth2 client secrets were stored in a recoverable way

Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
Nextcloud Server
CVE-2024-52521

Nextcloud Server has a potential hash collision for background jobs could skip queuing them

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
Nextcloud Server
CVE-2024-47759

GLPI has a stored XSS via document upload

GLPI is a free Asset and IT management software package. An technician can upload a SVG containing a malicious script. The script will then be executed when any user will try to see the document contents. Upgrade to 10.0.17.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Glpi-project
Products
Glpi
CVE-2024-55410

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—