Skip to content

Product

Nextcloud talk vulnerabilities

20 published CVES affecting Nextcloud talk, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
20
Critical
1
High
1
Medium
14
Low
4
Unscored
0
CISA KEV
0

Latest Nextcloud talk CVEs

Newest publication first

  2. CVE-2023-45149 Password of talk conversations can be bruteforced in Nextcloud

    Published
    MediumCVSS 4.3 EPSS 0.60%

    Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recom...

  6. CVE-2023-22473 Passcode bypass on Talk-Android app

    Published
    LowCVSS 2.1 EPSS 0.58%

    Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There a...

  7. CVE-2022-41926 Nextcloud Talk Android broadcast incorrect permission handling

    Published
    MediumCVSS 5.5 EPSS 0.28%

    Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to...

  11. CVE-2022-24887 Open Redirect in Nextcloud Talk

    Published
    MediumCVSS 6.1 EPSS 0.94%

    Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sharing a Deck card in conversation, the metaData can be manipulated so users can be tricked into opening arbitrary URLs. Th...

  12. CVE-2021-41181 Nextcloud Talk app exposes chat messages on lockscreen

    Published
    LowCVSS 2.4 EPSS 0.31%

    Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone ca...

  14. CVE-2021-39222 XSS in Talk

    Published
    MediumCVSS 6.1 EPSS 1.1%

    Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the stric...

  16. CVE-2021-32676 Session Fixation in Nextcloud Talk

    Published
    MediumCVSS 6.5 EPSS 0.95%

    Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk...

  20. CVE-2018-3781 A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, he...

    Published
    MediumCVSS 5.4 EPSS 0.74%

    A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.