CVE-2019-15622

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	Nextcloud Android	3.6.0

References

https://hackerone.com/reports/518669Exploit, Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2019-011Vendor Advisory
https://hackerone.com/reports/518669Exploit, Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2019-011Vendor Advisory

Timeline

Published: Feb 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-156235.3Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server CVE-2019-156244.9Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.CVE-2019-156255.5A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the vict CVE-2019-156267.5The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communicat CVE-2019-156277.1Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to ava CVE-2019-156287.8Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use CVE-2019-156297.5Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to al CVE-2019-15633.7In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending CVE-2019-156307.5Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before Augu CVE-2019-156319.8Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers CVE-2019-156354.9An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reve CVE-2019-156378.1Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a