CVE-2019-15619

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Nextcloud Server	16.0.4

References

https://hackerone.com/reports/662204Permissions Required
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008Vendor Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009Vendor Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010Vendor Advisory
https://hackerone.com/reports/662204Permissions Required
https://nextcloud.com/security/advisory/?id=NC-SA-2020-008Vendor Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-009Vendor Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-010Vendor Advisory

Timeline

Published: Feb 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156202.7Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared CVE-2019-156216.5Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mo CVE-2019-156222.4Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables whe CVE-2019-156235.3Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server CVE-2019-156244.9Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.CVE-2019-156255.5A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the vict CVE-2019-156267.5The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communicat CVE-2019-156277.1Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to ava CVE-2019-156287.8Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use CVE-2019-156297.5Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to al CVE-2019-15633.7In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending CVE-2019-156307.5Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before Augu