{"containers": {"cna": {"affected": [{"product": "Nextcloud Server", "vendor": "n/a", "versions": [{"status": "affected", "version": "16.0.4"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (XSS) - Stored (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-02-04T19:08:57", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/662204"}, {"tags": ["x_refsource_MISC"], "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-008"}, {"tags": ["x_refsource_MISC"], "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-009"}, {"tags": ["x_refsource_MISC"], "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-010"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2019-15619", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Nextcloud Server", "version": {"version_data": [{"version_value": "16.0.4"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-site Scripting (XSS) - Stored (CWE-79)"}]}]}, "references": {"reference_data": [{"name": "https://hackerone.com/reports/662204", "refsource": "MISC", "url": "https://hackerone.com/reports/662204"}, {"name": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-008", "refsource": "MISC", "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-008"}, {"name": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-009", "refsource": "MISC", "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-009"}, {"name": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-010", "refsource": "MISC", "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-010"}]}}}}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2019-15619", "datePublished": "2020-02-04T19:08:57", "dateReserved": "2019-08-26T00:00:00", "dateUpdated": "2020-02-04T19:08:57", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF74F6C8-E3B7-4AC5-820E-02B75C748DC5", "versionEndExcluding": "0.6.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F7379C3-F476-42A7-BD34-63BEBB2745FB", "versionEndExcluding": "16.0.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*", "matchCriteriaId": "31253046-1C67-45F5-AE9D-BF23F6846253", "versionEndExcluding": "6.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project."}, {"lang": "es", "value": "Una neutralizaci\u00f3n inapropiada de los nombres de archivo, nombres de conversaci\u00f3n y nombres de tarjeta en Nextcloud Server versi\u00f3n 16.0.3, Nextcloud Talk versi\u00f3n 6.0.3 y Nextcloud Deck versi\u00f3n 0.6.5, causa una vulnerabilidad de tipo XSS cuando se vinculan entre s\u00ed en un proyecto."}], "id": "CVE-2019-15619", "lastModified": "2020-02-12T16:23:41.450", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-04T20:15:12.340", "references": [{"source": "support@hackerone.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/662204"}, {"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-008"}, {"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-009"}, {"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-010"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}