CVE-2024-52510

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-525116.5Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious use CVE-2024-525126.1user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the us CVE-2024-525134.3Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user CVE-2024-525143.5Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files acc CVE-2024-525156.5Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user CVE-2024-525164.3Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own g CVE-2024-525175.9Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds the CVE-2024-525185.4Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacke CVE-2024-525198.2Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker tha CVE-2024-52525.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shor CVE-2024-525206.5Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked in CVE-2024-525215.3Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased