Nextcloud Talk vulnerabilities

CVE-2023-26041 [MEDIUM] CWE-359 CVE-2023-26041: Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs wer Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available.

CVE-2022-41971 [MEDIUM] CWE-200 CVE-2022-41971: Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8 Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, pro

CVE-2020-8180 [CRITICAL] CWE-94 CVE-2020-8180: A too lax check in Nextcloud Talk 6 A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

CVE-2019-15620 [LOW] CWE-287 CVE-2019-15620: Improper access control in Nextcloud Talk 6 Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.

CVE-2018-3781 [MEDIUM] CWE-79 CVE-2018-3781: A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could le A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.