#nextcloud
-
CISA Adds Actively Exploited Flaws in Collabora Online and Arista VeloCloud to KEV
The U.S. cybersecurity agency CISA has added two critical vulnerabilities, both already seen in real-world attacks, to its Known Exploited Vulnerabilities catalog.
-
Critical flaw in Collabora's Built-in CODE plants web shells on Nextcloud servers
Attackers used an optional Nextcloud app, Collabora Online — Built-in CODE Server, to drop web shells. Disabling the app does not help — it must be updated or removed.