QwikSec

Security Database

CVE

CWE

Training

CVE-2018-3763

Published: Jul 5, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.

Vendor	Product	Versions
Nextcloud	Nextcloud Calendar application	affected `<1.6.1, <1.5.8`

Weaknesses (CWE)

References

https://nextcloud.com/security/advisory/?id=nc-sa-2018-004

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.