CVE-2024-46958

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/nextcloud/desktop/compare/v3.13.3...v3.13.4Patch
https://github.com/nextcloud/desktop/issues/6863Issue Tracking
https://github.com/nextcloud/desktop/pull/6949Issue Tracking
https://github.com/nextcloud/desktop/pull/7092Patch
https://github.com/nextcloud/security-advisories/security/advisoriesThird Party Advisory

Timeline

Published: Sep 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-469596.5runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1 CVE-2024-46967.5A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system comma CVE-2024-469608.8The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execut CVE-2024-469618.1The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to ex CVE-2024-469629.1The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary CVE-2024-469638.1The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attac CVE-2024-469648.1The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaSc CVE-2024-469655.4The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execut CVE-2024-469668.1The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbit CVE-2024-46975.4The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_tag’ parameter in all ve CVE-2024-469706.1In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible CVE-2024-469717.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.