nextcloud / server

1. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:114 99%
2. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:55 99%
3. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:59 99%
4. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:63 99%
5. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:67 99%
6. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:71 99%
7. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:75 99%
8. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:79 99%
9. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:85 99%
10. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:89 99%
11. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:93 99%
12. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:103 99%
13. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:51 99%
14. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:47 99%
15. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:42 99%
16. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:38 99%
17. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:33 99%
18. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:22 99%
19. high Semgrep FTP allows for unencrypted file transfers. Consider using an encrypted alternative. /apps/files_external/lib/Lib/Storage/FtpConnection.php:20 99%
20. high Semgrep Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit. /resources/config/freedesktop.org.xml:289 99%
21. high GuardDog Detects DNS-based data exfiltration: encoding data in DNS queries [threat-network-dns-exfil] /apps/sharebymail/l10n/da.js:28 98%
22. high GuardDog Detects DNS-based data exfiltration: encoding data in DNS queries [threat-network-dns-exfil] /apps/dav/l10n/sv.js:161 98%
23. high GuardDog Detects DNS-based data exfiltration: encoding data in DNS queries [threat-network-dns-exfil] /apps/dav/l10n/da.js:129 98%
24. high Dependency checker Typosquatting: 'color' is suspiciously similar to 'colors' package.json 90%
25. high Dependency checker Typosquatting: 'vuex' is suspiciously similar to 'vue' package.json 90%
26. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/performance.yml:74 57%
27. high Semgrep Generic Secret detected /.github/workflows/object-storage.yml:53 50%
28. high Semgrep Generic Secret detected /.github/workflows/files-external.yml:99 50%
29. high Semgrep Generic Secret detected /.github/workflows/phpunit-object-store-primary.yml:61 50%
30. high Semgrep Executing non-constant commands. This can lead to command injection. /.php-cs-fixer.dist.php:26 43%
31. high Semgrep Executing non-constant commands. This can lead to command injection. /lib/private/Preview/Movie.php:288 43%
32. high Semgrep Executing non-constant commands. This can lead to command injection. /lib/private/LargeFileHelper.php:186 43%
33. high Semgrep Executing non-constant commands. This can lead to command injection. /lib/private/Preview/Movie.php:342 43%
34. high Semgrep Executing non-constant commands. This can lead to command injection. /lib/private/Preview/Office.php:79 43%
35. high YARA YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns /build/frontend-legacy/package-lock.json 36%
36. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-main.js.map 3%
37. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/util-Da-EotHR.chunk.mjs.map 3%
38. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/settings-vue-settings-personal-webauthn.js.map 3%
39. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/index-D66PyPaN.chunk.mjs.map 3%
40. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/index-D1micRRo.chunk.mjs.map 3%
41. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/settings-vue-settings-profile-contact.js 3%
42. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-recommendedapps.js 3%
43. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/settings-vue-settings-personal-webauthn.js 3%
44. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-unsupported-browser.js.map 3%
45. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-login.js.map 3%
46. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/settings-vue-settings-profile-contact.js.map 3%
47. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-recommendedapps.js.map 3%
48. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-common.js 3%
49. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-common.js.map 3%
50. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /dist/core-login.js 3%
51. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dist/index-HmgsQy8-.chunk.mjs 1%
52. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dist/index-HmgsQy8-.chunk.mjs.map 1%
53. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.devcontainer/Dockerfile 1%
54. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dist/5862-5862.js.map 1%
55. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dist/5862-5862.js 1%
56. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-recommendedapps.js 1%
57. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/preload-helper-DzJkBi1V.chunk.mjs.map 1%
58. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/GetComments-4hfJnTvv.chunk.mjs 1%
59. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/settings-vue-settings-personal-webauthn.js 1%
60. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/index-BEngW5-6.chunk.mjs.map 1%
61. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/6198-6198.js 1%
62. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-main.js.map 1%
63. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/settings-vue-settings-admin-sharing.js.map 1%
64. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/index-D66PyPaN.chunk.mjs 1%
65. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/TrashCanOutline-Ba5BzjR9.chunk.mjs.map 1%
66. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/NcAvatar-CcU-kaZs.chunk.mjs.map 1%
67. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-login.js.map 1%
68. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/6198-6198.js.map 1%
69. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/NcRichText-rE0H191n.chunk.mjs.map 1%
70. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/files_sharing-init.js.map 1%
71. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/562-562.js.map 1%
72. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-recommendedapps.js.map 1%
73. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-common.js 1%
74. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-common.js.map 1%
75. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/index-DX9CmdSq.chunk.mjs.map 1%
76. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-login.js 1%
77. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/util-Da-EotHR.chunk.mjs.map 1%
78. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/settings-vue-settings-personal-webauthn.js.map 1%
79. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/NcRichText-rE0H191n.chunk.mjs 1%
80. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/index-D66PyPaN.chunk.mjs.map 1%
81. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/util-Da-EotHR.chunk.mjs 1%
82. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/GetComments-4hfJnTvv.chunk.mjs.map 1%
83. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/index-D1micRRo.chunk.mjs.map 1%
84. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/settings-vue-settings-profile-contact.js 1%
85. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/index-BEngW5-6.chunk.mjs 1%
86. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /dist/core-main.js 1%
87. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /.devcontainer/Dockerfile 0%
88. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/updatenotification/src/views/AdminSettingsSection.vue:146 100%
89. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/settings/src/components/PersonalInfo/DetailsSection.vue:31 100%
90. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/settings/src/components/SettingsSetupChecks/SettingsSetupChecksListItem.vue:74 100%
91. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/settings/src/components/BasicSettings/BackgroundJob.vue:64 100%
92. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/settings/src/views/AdminSettingsSetupChecks.vue:128 100%
93. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/settings/src/views/AdminSettingsSetupChecks.vue:132 100%
94. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/systemtags/src/components/SystemTagPicker.vue:112 100%
95. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/theming/src/views/UserTheming.vue:11 100%
96. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/theming/src/views/UserTheming.vue:13 100%
97. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/updatenotification/src/views/AdminSettingsSection.vue:15 100%
98. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/updatenotification/src/views/AdminSettingsSection.vue:18 100%
99. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/dav/src/views/CalDavSettings.vue:54 100%
100. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/dav/src/views/CalDavSettings.vue:25 100%
101. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/dav/src/views/CalDavSettings.vue:13 100%
102. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /apps/appstore/src/components/MarkdownPreview.vue:28 100%
103. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /core/src/views/WebInstaller.vue:29 100%
104. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /core/src/components/PublicPageMenu/PublicPageMenuCustomEntry.vue:7 100%
105. medium Semgrep `query.replace` method will only replace the first occurrence when used with a string argument ('%'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. /apps/files/src/services/WebDavSearch.ts:69 99%
106. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:236 99%
107. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:184 99%
108. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:121 99%
109. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:64 99%
110. medium YARA YARA rule matched: detect_clipboard_hijack — Reads the clipboard alongside crypto-wallet-address-shaped patterns - a known \'clipper\' malware technique that swaps a copied address for the attacker\'s own /dist/core-common.js.map 99%
111. medium YARA YARA rule matched: detect_clipboard_hijack — Reads the clipboard alongside crypto-wallet-address-shaped patterns - a known \'clipper\' malware technique that swaps a copied address for the attacker\'s own /dist/core-recommendedapps.js.map 99%
112. medium GuardDog Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] /apps/comments/l10n/mk.js:5 98%
113. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /dist/NcRichText-rE0H191n.chunk.mjs:15 98%
114. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /dist/6198-6198.js:1 98%
115. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /dist/core-common.js:1 98%
116. medium Semgrep The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site. /core/src/utils/xhr-request.js:57 98%
117. medium Semgrep RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /core/src/Util/get-url-parameter.js:10 76%
118. medium Semgrep Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. /lib/private/DB/Middleware/ConnectionActivityConnection.php:41 67%
119. medium Semgrep Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. /status.php:44 53%
120. medium Semgrep The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`. /apps/encryption/lib/Crypto/Crypt.php:534 52%
121. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /apps/files/src/newMenu/newTemplatesFolder.ts:32 37%
122. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /apps/files/src/newMenu/newTemplatesFolder.ts:32 37%
123. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /apps/files/src/services/Files.ts:84 37%
124. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /apps/files/src/services/Files.ts:43 37%
125. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/Profiler/FileProfilerStorage.php:303 36%
126. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/TaskProcessing/Manager.php:961 36%
127. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/Repair/RemoveBrokenProperties.php:48 36%
128. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/Profiler/FileProfilerStorage.php:125 36%
129. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/OpenMetrics/Exporters/Cached.php:48 36%
130. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/Command/CommandJob.php:24 36%
131. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/Command/QueueBus.php:47 36%
132. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /lib/private/Authentication/Token/PublicKeyTokenProvider.php:168 36%
133. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /apps/dav/lib/DAV/CustomPropertiesBackend.php:679 36%
134. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/Storage/LocalPreviewStorage.php:111 21%
135. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Files/Storage/Local.php:338 21%
136. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/Storage/LocalPreviewStorage.php:67 21%
137. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Setup.php:487 21%
138. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Updater.php:91 21%
139. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/public/Files.php:40 21%
140. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/public/Files.php:44 21%
141. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/public/Files.php:52 21%
142. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Archive/ZIP.php:231 20%
143. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/legacy/OC_Util.php:337 20%
144. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Setup/Sqlite.php:61 20%
145. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Setup.php:308 20%
146. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Repair/NC30/RemoveLegacyDatadirFile.php:32 20%
147. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/Storage/LocalPreviewStorage.php:249 20%
148. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/ProviderV2.php:106 20%
149. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/Movie.php:373 20%
150. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/Movie.php:367 20%
151. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Preview/Movie.php:338 20%
152. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Files/View.php:1128 20%
153. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Files/Storage/Local.php:123 20%
154. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Files/Storage/DAV.php:750 20%
155. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /apps/files_external/lib/Lib/Storage/SMB.php:488 20%
156. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Files/ObjectStore/ObjectStoreStorage.php:390 20%
157. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /apps/files_external/lib/Lib/Storage/AmazonS3.php:622 20%
158. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /apps/files_external/lib/Lib/Storage/FTP.php:298 20%
159. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /apps/files_external/lib/Lib/Storage/StreamWrapper.php:63 20%
160. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /apps/files_external/lib/Lib/Storage/Swift.php:575 20%
161. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /core/Controller/AvatarController.php:203 20%
162. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /core/Controller/SetupController.php:118 20%
163. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Archive/TAR.php:116 20%
164. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Archive/TAR.php:293 20%
165. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Archive/TAR.php:333 20%
166. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Files/ObjectStore/ObjectStoreStorage.php:372 20%
167. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/Profiler/FileProfilerStorage.php:103 20%
168. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /lib/private/TempManager.php:190 20%
169. low Dependency checker package.json has a 'postinstall' script that runs automatically on npm install — worth a manual look: build/demi.sh ci package.json 95%
170. low Dependency checker Loose version constraint: '@nextcloud/logger^3.0.3' — attacker could push malicious update package.json 8%
171. low Dependency checker Loose version constraint: '@nextcloud/e2e-test-server^0.6.0' — attacker could push malicious update package.json 7%
172. low Dependency checker Loose version constraint: '@nextcloud/files^4.1.0' — attacker could push malicious update package.json 4%
173. low Dependency checker Loose version constraint: '@nextcloud/password-confirmation^6.1.0' — attacker could push malicious update package.json 3%
174. low Dependency checker Loose version constraint: '@testing-library/jest-dom^7.0.1' — attacker could push malicious update package.json 2%
175. low Dependency checker Loose version constraint: '@testing-library/vue^8.1.0' — attacker could push malicious update package.json 2%
176. low Dependency checker Loose version constraint: '@nextcloud/l10n^3.4.1' — attacker could push malicious update package.json 2%
177. low Dependency checker Loose version constraint: 'marked^18.0.13' — attacker could push malicious update package.json 2%
178. low Dependency checker Loose version constraint: 'debounce^3.0.0' — attacker could push malicious update package.json 2%
179. low Dependency checker Loose version constraint: 'color^5.0.3' — attacker could push malicious update package.json 2%
180. low Dependency checker Loose version constraint: '@vueuse/integrations^14.1.0' — attacker could push malicious update package.json 2%
181. low Dependency checker Loose version constraint: '@vueuse/core^14.1.0' — attacker could push malicious update package.json 2%
182. low Dependency checker Loose version constraint: '@nextcloud/vue^9.10.0' — attacker could push malicious update package.json 2%
183. low Dependency checker Loose version constraint: '@nextcloud/sharing^1.0.0-beta.4' — attacker could push malicious update package.json 2%
184. low Dependency checker Loose version constraint: '@nextcloud/router^3.1.0' — attacker could push malicious update package.json 2%
185. low Dependency checker Loose version constraint: '@nextcloud/paths^3.1.0' — attacker could push malicious update package.json 2%
186. low Dependency checker Loose version constraint: 'msw^2.15.0' — attacker could push malicious update package.json 2%
187. low Dependency checker Loose version constraint: '@nextcloud/initial-state^3.0.0' — attacker could push malicious update package.json 2%
188. low Dependency checker Loose version constraint: '@nextcloud/event-bus^3.3.3' — attacker could push malicious update package.json 2%
189. low Dependency checker Loose version constraint: '@nextcloud/dialogs^7.5.0' — attacker could push malicious update package.json 2%
190. low Dependency checker Loose version constraint: '@nextcloud/capabilities^1.2.1' — attacker could push malicious update package.json 2%
191. low Dependency checker Loose version constraint: '@nextcloud/calendar-availability-vue^3.0.0' — attacker could push malicious update package.json 2%
192. low Dependency checker Loose version constraint: '@nextcloud/axios^2.5.2' — attacker could push malicious update package.json 2%
193. low Dependency checker Loose version constraint: '@nextcloud/auth^2.6.0' — attacker could push malicious update package.json 2%
194. low Dependency checker Loose version constraint: '@mdi/svg^7.4.47' — attacker could push malicious update package.json 2%
195. low Dependency checker Loose version constraint: '@mdi/js^7.4.47' — attacker could push malicious update package.json 2%
196. low Dependency checker Loose version constraint: 'pinia^4.0.3' — attacker could push malicious update package.json 2%
197. low Dependency checker Loose version constraint: 'vitest^5.0.0' — attacker could push malicious update package.json 2%
198. low Dependency checker Loose version constraint: 'vite^7.3.6' — attacker could push malicious update package.json 2%
199. low Dependency checker Loose version constraint: 'stylelint^17.15.0' — attacker could push malicious update package.json 2%
200. low Dependency checker Loose version constraint: 'sass^1.104.1' — attacker could push malicious update package.json 2%
201. low Dependency checker Loose version constraint: 'jsdom-testing-mocks^1.16.0' — attacker could push malicious update package.json 2%
202. low Dependency checker Loose version constraint: 'jsdom^30.0.1' — attacker could push malicious update package.json 2%
203. low Dependency checker Loose version constraint: 'is-svg^6.1.0' — attacker could push malicious update package.json 2%
204. low Dependency checker Loose version constraint: 'eslint-plugin-no-only-tests^3.4.0' — attacker could push malicious update package.json 2%
205. low Dependency checker Loose version constraint: 'eslint^10.10.0' — attacker could push malicious update package.json 2%
206. low Dependency checker Loose version constraint: 'concurrently^10.0.5' — attacker could push malicious update package.json 2%
207. low Dependency checker Loose version constraint: 'axe-core^4.13.0' — attacker could push malicious update package.json 2%
208. low Dependency checker Loose version constraint: '@zip.js/zip.js^2.15.0' — attacker could push malicious update package.json 2%
209. low Dependency checker Loose version constraint: '@vue/tsconfig^0.9.0' — attacker could push malicious update package.json 2%
210. low Dependency checker Loose version constraint: '@vue/test-utils^2.4.6' — attacker could push malicious update package.json 2%
211. low Dependency checker Loose version constraint: '@types/dockerode^4.0.1' — attacker could push malicious update package.json 2%
212. low Dependency checker Loose version constraint: 'p-queue^9.3.3' — attacker could push malicious update package.json 2%
213. low Dependency checker Loose version constraint: 'sortablejs^1.15.7' — attacker could push malicious update package.json 2%
214. low Dependency checker Loose version constraint: 'vue^3.5.42' — attacker could push malicious update package.json 2%
215. low Dependency checker Loose version constraint: 'vue-router^5.0.6' — attacker could push malicious update package.json 2%
216. low Dependency checker Loose version constraint: 'vuex^4.1.0' — attacker could push malicious update package.json 2%
217. low Dependency checker Loose version constraint: 'webdav^5.10.0' — attacker could push malicious update package.json 2%
218. low Dependency checker Loose version constraint: '@nextcloud/browserslist-config^3.1.2' — attacker could push malicious update package.json 2%
219. low Dependency checker Loose version constraint: '@nextcloud/eslint-config^9.0.1' — attacker could push malicious update package.json 2%
220. low Dependency checker Loose version constraint: '@nextcloud/stylelint-config^3.2.2' — attacker could push malicious update package.json 2%
221. low Dependency checker Loose version constraint: '@nextcloud/typings^1.10.0' — attacker could push malicious update package.json 2%
222. low Dependency checker Loose version constraint: '@nextcloud/vite-config^2.5.2' — attacker could push malicious update package.json 2%
223. low Dependency checker Loose version constraint: '@playwright/test^1.63.0' — attacker could push malicious update package.json 2%
224. low Dependency checker Loose version constraint: '@vitest/coverage-v8^5.0.0' — attacker could push malicious update package.json 2%
225. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /build/phpDocumentor.sh 0%
226. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /build/merge-font-noto.sh 0%
227. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /dist/5862-5862.js.map 0%
228. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /dist/5862-5862.js 0%
229. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /dist/index-HmgsQy8-.chunk.mjs 0%
230. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.devcontainer/Dockerfile 0%
231. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /dist/index-HmgsQy8-.chunk.mjs.map 0%

No findings match these filters. Clear filters