Skip to content
OpenAdvisories

Archive

20 May 2022

Vulnerabilities first published on this day (UTC), newest first.

4 results · Clear filters · Feed

  • Low 3.4

    WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

    Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable p…

  • Low 3.5

    Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server

    Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Ve…

  • Low 2.8

    Sensitive files/data exist after deletion of user account in Nextcloud Android

    Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related details exist after deletion of a user account. This could result in misuse of the former account h…

  • Low 3.5

    Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck

    Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. Ther…