CVE-2023-28647

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-286486.1Osprey Pump Controller version 1.01 inputs passed to a GET parameter are not properly sanitized before being returned to the user. This can CVE-2023-286497.5The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists CVE-2023-28659.8A vulnerability was found in SourceCodester Theme Park Ticketing System 1.0. It has been classified as critical. This affects an unknown par CVE-2023-286506.1An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attack CVE-2023-286514.8Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected produ CVE-2023-286526.5An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.CVE-2023-286537.8The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a use-afte CVE-2023-286549.8Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web m CVE-2023-286555.4A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted pri CVE-2023-286568.1NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. CVE-2023-286578.8Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected prod CVE-2023-286587.8Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable