CVE-2019-15621

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-281

Affected software

VendorProductVersions
n/aNextcloud Server16.0.2

References

Timeline

Published
Feb 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-156222.4Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables wheCVE-2019-156235.3Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup ServerCVE-2019-156244.9Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.CVE-2019-156255.5A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victCVE-2019-156267.5The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communicatCVE-2019-156277.1Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to avaCVE-2019-156287.8Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to useCVE-2019-156297.5Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to alCVE-2019-15633.7In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sendingCVE-2019-156307.5Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before AuguCVE-2019-156319.8Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers CVE-2019-156354.9An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reve
CVE-2019-15621: Medium severity, CVSS 6.5 | Vulnix