Description
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Nextcloud Server | 15.0.6 | — |
Unscored
CVE-2019-15618
EUVD-2019-6575GHSA-fjhc-75vv-2hgm
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Published Feb 4, 2020 · Updated Aug 5, 2024 · Assigned by hackerone