CVE-2019-5451

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288 CWE-306

Affected software

Vendor	Product	Versions
n/a	com.nextcloud.client	3.6.1

References

https://hackerone.com/reports/507172Third Party Advisory
https://hackerone.com/reports/507172Third Party Advisory

Timeline

Published: Jul 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54522.4Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content CVE-2019-54536.1Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protecti CVE-2019-54549.8SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring CVE-2019-54556.8Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.CVE-2019-54568.1SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP CVE-2019-54575.4Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execu CVE-2019-54585.4Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to exec CVE-2019-54597.1An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.CVE-2019-54605.5Double Free in VLC versions <= 3.0.6 leads to a crash.CVE-2019-54613.5An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary CVE-2019-54628.8A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has cha CVE-2019-54635.3An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. Thi