Nextcloud
Page 3 of 4 — Nextcloud CVEs from a corpus of 394, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39210 | Low | 3.2 | 2022-09-17 | Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly pro… |
CVE-2022-39211 | Low | 3.0 | 2022-09-16 | Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erron… |
CVE-2022-36075 | Low | 2.6 | 2022-09-15 | Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they… |
CVE-2022-36074 | Medium | 6.4 | 2022-09-15 | Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Au… |
CVE-2022-35931 | Low | 2.7 | 2022-09-06 | Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3… |
CVE-2022-35932 | Low | 3.5 | 2022-08-12 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are suscepti… |
CVE-2022-31119 | Low | 3.1 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the ev… |
CVE-2022-31132 | High | 8.3 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css… |
CVE-2022-31120 | Low | 2.1 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-31131 | Medium | 5.4 | 2022-07-06 | Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership… |
CVE-2022-31014 | Medium | 5.4 | 2022-07-05 | Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on w… |
CVE-2022-31024 | Medium | 6.5 | 2022-06-02 | richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be… |
CVE-2022-29243 | Medium | 4.3 | 2022-05-31 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size valida… |
CVE-2022-29163 | Low | 3.5 | 2022-05-20 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link… |
CVE-2022-29160 | Low | 2.8 | 2022-05-20 | Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related… |
CVE-2022-29159 | Medium | 5.0 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |
CVE-2022-24889 | Low | 2.4 | 2022-04-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible t… |
CVE-2022-24888 | Medium | 4.3 | 2022-04-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is… |
CVE-2022-24887 | Medium | 4.3 | 2022-04-27 | Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sha… |
CVE-2022-24886 | Low | 2.2 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification… |
CVE-2022-24885 | Low | 2.0 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextclo… |
CVE-2022-24838 | Medium | 5.3 | 2022-04-11 | Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special ch… |
CVE-2021-41233 | Medium | 6.5 | 2022-03-10 | Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2021-41241 | Medium | 4.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a gr… |
CVE-2021-41239 | Medium | 5.3 | 2022-03-08 | Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumerati… |
CVE-2021-41181 | Low | 2.4 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen s… |
CVE-2021-41180 | Medium | 4.7 | 2022-03-08 | Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud… |
CVE-2021-41166 | Medium | 4.3 | 2022-01-26 | The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive… |
CVE-2021-43863 | High | 7.5 | 2022-01-25 | The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage… |
CVE-2021-41256 | Medium | 5.8 | 2021-11-30 | nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issu… |
CVE-2021-39222 | Medium | 6.4 | 2021-11-15 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerabil… |
CVE-2021-41179 | Medium | 6.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication w… |
CVE-2021-41178 | High | 8.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker… |
CVE-2021-41177 | High | 8.1 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database ba… |
CVE-2021-39225 | High | 8.1 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authe… |
CVE-2021-39224 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messa… |
CVE-2021-39223 | Medium | 4.8 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exc… |
CVE-2021-39221 | Medium | 6.4 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site… |
CVE-2021-39220 | Low | 3.5 | 2021-10-25 | Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render im… |
CVE-2021-32802 | Critical | 9.3 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image type… |
CVE-2021-32801 | Medium | 5.5 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive k… |
CVE-2021-32800 | High | 8.1 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions an attacker is able to bypass Two Factor Authentication in Nextcloud. Thus… |
CVE-2021-37629 | Medium | 5.3 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the Richdocuments OCS endpoint… |
CVE-2021-37628 | High | 7.5 | 2021-09-07 | Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public link shares in Nextclou… |
CVE-2021-32766 | Medium | 5.3 | 2021-09-07 | Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Text application retur… |
CVE-2021-37631 | Medium | 6.5 | 2021-09-07 | Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected vers… |
CVE-2021-37630 | Medium | 6.5 | 2021-09-07 | Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application allowed any user t… |
CVE-2021-32782 | Medium | 5.8 | 2021-09-07 | Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a… |
CVE-2021-37617 | High | 7.3 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script… |
CVE-2021-32728 | Medium | 6.5 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end encryption feature do… |
CVE-2021-32748 | Medium | 4.3 | 2021-07-27 | Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") protocol to communicat… |
CVE-2021-32741 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the pu… |
CVE-2021-32734 | Low | 3.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped wit… |
CVE-2021-32733 | Medium | 4.8 | 2021-07-12 | Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13… |
CVE-2021-32727 | Medium | 5.7 | 2021-07-12 | Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via… |
CVE-2021-32726 | High | 7.1 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a u… |
CVE-2021-32725 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being r… |
CVE-2021-32707 | Medium | 4.3 | 2021-07-12 | Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not lea… |
CVE-2021-32689 | High | 8.1 | 2021-07-12 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used user… |
CVE-2021-32705 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the pu… |
CVE-2021-32703 | Medium | 5.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the sh… |
CVE-2021-32688 | High | 8.8 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tok… |
CVE-2021-32680 | Low | 3.3 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions priot to 19.0.13, 20.0.11, and 21.0.3, Nextcloud Server audit logging functional… |
CVE-2021-32679 | Low | 3.5 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in… |
CVE-2021-32678 | Low | 3.7 | 2021-07-12 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API res… |
CVE-2021-32694 | Medium | 4.1 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nex… |
CVE-2021-32695 | Low | 3.9 | 2021-06-17 | Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shar… |
CVE-2021-32676 | Medium | 6.5 | 2021-06-16 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11… |
CVE-2021-22915 | Critical | 9.8 | 2021-06-11 | Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations… |
CVE-2021-22913 | Medium | 6.5 | 2021-06-11 | Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead… |
CVE-2021-22912 | Medium | 6.5 | 2021-06-11 | Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only… |
CVE-2021-22906 | Medium | 6.5 | 2021-06-11 | Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock… |
CVE-2021-22905 | Medium | 6.5 | 2021-06-11 | Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on t… |
CVE-2021-22896 | Medium | 4.3 | 2021-06-11 | Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases fo… |
CVE-2021-22895 | Medium | 5.9 | 2021-06-11 | Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register wit… |
CVE-2021-32658 | Medium | 4.7 | 2021-06-08 | Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all s… |
CVE-2021-32657 | Medium | 4.3 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may… |
CVE-2021-32656 | High | 8.6 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2… |
CVE-2021-32655 | Low | 3.5 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Dr… |
CVE-2021-32654 | High | 8.1 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read… |
CVE-2021-32653 | Low | 2.7 | 2021-06-01 | Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup s… |
CVE-2021-32652 | High | 8.8 | 2021-06-01 | Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another authenticated users… |
CVE-2021-22879 | High | 8.8 | 2021-04-14 | Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote… |
CVE-2021-29438 | Medium | 4.6 | 2021-04-13 | The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays t… |
CVE-2021-22878 | Medium | 4.8 | 2021-03-03 | Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`. |
CVE-2021-22877 | Medium | 6.5 | 2021-03-03 | A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not alre… |
CVE-2020-8296 | Medium | 6.7 | 2021-03-03 | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. |
CVE-2020-8297 | Medium | 4.3 | 2021-02-23 | Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access… |
CVE-2020-8294 | Medium | 5.4 | 2021-02-03 | A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'jav… |
CVE-2020-8295 | High | 7.5 | 2021-01-26 | A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user. |
CVE-2020-8293 | Medium | 6.5 | 2021-01-26 | A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential… |
CVE-2020-8281 | Medium | 5.4 | 2021-01-06 | A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks. |
CVE-2020-8280 | Medium | 5.4 | 2021-01-06 | A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks. |
CVE-2020-8279 | High | 7.4 | 2020-11-19 | Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack. |
CVE-2020-8278 | Medium | 5.3 | 2020-11-19 | Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user. |
CVE-2020-8259 | High | 8.1 | 2020-11-16 | Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys. |