CVE-2024-37885

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0.

• CWE-94
• CWE-94

• https://github.com/nextcloud/desktop/pull/6378Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7Patch, Third Party Advisory
• https://hackerone.com/reports/2307625Issue Tracking
• https://github.com/nextcloud/desktop/pull/6378Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v63m-99p7Patch, Third Party Advisory
• https://hackerone.com/reports/2307625Issue Tracking

Published

Jun 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3788Vulnerability in WBSAirback 21.02.04, which involves imprope…6.6
• CVE-2024-37880The Kyber reference implementation before 9b8d306, when comp…7.5
• CVE-2024-37881SiteGuard WP Plugin provides a functionality to customize th…5.3
• CVE-2024-37882Nextcloud Server is a self hosted personal cloud system. A r…8.1
• CVE-2024-37883Nextcloud Deck is a kanban style organization tool aimed at …4.3
• CVE-2024-37884Nextcloud Server is a self hosted personal cloud system. A m…5.4
• CVE-2024-37886user_oidc app is an OpenID Connect user backend for Nextclou…4.7
• CVE-2024-37887Nextcloud Server is a self hosted personal cloud system. Pri…3.5
• CVE-2024-37888The Open Link is a CKEditor plugin, extending context menu w…6.1
• CVE-2024-37889MyFinances is a web application for managing finances. MyFin…6.5
• CVE-2024-3789Uncontrolled resource consumption vulnerability in White Bea…6.5
• CVE-2024-37890ws is an open source WebSocket client and server for Node.js…7.5