https://vulnerability.circl.lu/sightings/feed 2026-05-05T19:45:53.726024+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d7d41900-e43f-441b-a620-527c0b9ec9d7/export 2026-05-05T19:45:54.063835+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "d7d41900-e43f-441b-a620-527c0b9ec9d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37617", "type": "seen", "source": "https://t.me/cibsecurity/27561", "content": "\u203c CVE-2021-37617 \u203c\n\nThe Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the `Uninstall.exe` file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious `Uninstall.exe`, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the `C:\\` system folder and verify that there is no malicious `C:\\Uninstall.exe` file on the system.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-18T22:17:05.000000Z"} 2021-08-18T22:17:05+00:00