CVE-2018-3776

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-37779.8Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.CVE-2018-37785.3Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.CVE-2018-37799.8active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoCVE-2018-37805.4A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-intCVE-2018-37815.4A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaCVE-2018-37839.8A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.CVE-2018-37849.8A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.CVE-2018-37859.8A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.CVE-2018-37869.8A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command lineCVE-2018-37877.5Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.CVE-2018-38095.3Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be iCVE-2018-38109.8Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attacker
CVE-2018-3776: Medium severity, CVSS 5.3 | Vulnix