CVE-2021-41256

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published
Nov 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-412585.4Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is tCVE-2021-41266.5When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer addedCVE-2021-412608.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do nCVE-2021-412614.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412628.8Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are CVE-2021-412638.8rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications usiCVE-2021-412649.8OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may bCVE-2021-412658.8Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability iCVE-2021-412669.8Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versiCVE-2021-412676.5Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP comCVE-2021-412688.8Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP componCVE-2021-412699.8cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected vers
CVE-2021-41256: High severity, CVSS 7.1 | Vulnix