CVE-2019-15620

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Nextcloud Talk	6.0.4

References

https://hackerone.com/reports/662218Permissions Required
https://nextcloud.com/security/advisory/?id=NC-SA-2020-011Vendor Advisory
https://hackerone.com/reports/662218Permissions Required
https://nextcloud.com/security/advisory/?id=NC-SA-2020-011Vendor Advisory

Timeline

Published: Feb 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156216.5Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mo CVE-2019-156222.4Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables whe CVE-2019-156235.3Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server CVE-2019-156244.9Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.CVE-2019-156255.5A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the vict CVE-2019-156267.5The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communicat CVE-2019-156277.1Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to ava CVE-2019-156287.8Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use CVE-2019-156297.5Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to al CVE-2019-15633.7In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending CVE-2019-156307.5Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before Augu CVE-2019-156319.8Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers