Nextcloud
Page 4 of 4 — Nextcloud CVEs from a corpus of 303, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8182 | High | 8.0 | 2020-10-05 | Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves. |
CVE-2020-8225 | High | 7.5 | 2020-09-18 | A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials. |
CVE-2020-8227 | Medium | 6.8 | 2020-08-21 | Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedica… |
CVE-2020-8189 | Medium | 5.4 | 2020-08-21 | A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the log… |
CVE-2020-8230 | Medium | 5.5 | 2020-08-17 | A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory. |
CVE-2020-8229 | Medium | 5.5 | 2020-08-10 | A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system. |
CVE-2020-8224 | High | 7.8 | 2020-08-10 | A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory. |
CVE-2020-8202 | Medium | 5.3 | 2020-07-30 | Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password. |
CVE-2020-8181 | Medium | 4.3 | 2020-07-10 | A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars. |
CVE-2020-8179 | Medium | 4.1 | 2020-07-02 | Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. |
CVE-2020-8180 | Critical | 9.9 | 2020-06-08 | A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator. |
CVE-2020-8156 | High | 7.0 | 2020-05-12 | A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. |
CVE-2020-8155 | Medium | 5.4 | 2020-05-12 | An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF. |
CVE-2020-8154 | High | 7.7 | 2020-05-12 | An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious… |
CVE-2020-8153 | High | 8.1 | 2020-05-12 | Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name. |
CVE-2020-8140 | Medium | 6.7 | 2020-03-20 | A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the envi… |
CVE-2020-8139 | Medium | 6.5 | 2020-03-20 | A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to… |
CVE-2020-8138 | Medium | 6.5 | 2020-03-20 | A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability wh… |
CVE-2020-8122 | Medium | 4.3 | 2020-02-04 | A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received. |
CVE-2020-8121 | High | 8.1 | 2020-02-04 | A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. |
CVE-2020-8120 | Medium | 6.1 | 2020-02-04 | A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation. |
CVE-2020-8119 | Medium | 4.3 | 2020-02-04 | Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app. |
CVE-2020-8118 | Medium | 5.0 | 2020-02-04 | An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calen… |
CVE-2020-8117 | Medium | 4.3 | 2020-02-04 | Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. |
CVE-2019-15624 | Medium | 4.9 | 2020-02-04 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. |
CVE-2019-15623 | Medium | 5.3 | 2020-02-04 | Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any furthe… |
CVE-2019-15622 | Low | 2.4 | 2020-02-04 | Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom quer… |
CVE-2019-15621 | Medium | 6.5 | 2020-02-04 | Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a shar… |
CVE-2019-15620 | Low | 2.7 | 2020-02-04 | Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the proje… |
CVE-2019-15619 | Medium | 4.8 | 2020-02-04 | Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an X… |
CVE-2019-15618 | Medium | 4.8 | 2020-02-04 | Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location. |
CVE-2019-15617 | Medium | 5.4 | 2020-02-04 | A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. |
CVE-2019-15616 | Medium | 4.3 | 2020-02-04 | Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. |
CVE-2019-15615 | Medium | 6.1 | 2020-02-04 | A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past. |
CVE-2019-15614 | Medium | 5.4 | 2020-02-04 | Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files. |
CVE-2019-15613 | High | 8.0 | 2020-02-04 | A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. |
CVE-2019-15612 | Medium | 5.9 | 2020-02-04 | A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. |
CVE-2019-15611 | Medium | 4.9 | 2020-02-04 | Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federat… |
CVE-2019-15610 | Medium | 4.3 | 2020-02-04 | Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle. |
CVE-2019-5476 | Critical | 9.8 | 2019-08-07 | An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary… |
CVE-2019-5455 | Medium | 6.8 | 2019-07-30 | Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. |
CVE-2019-5454 | Critical | 9.8 | 2019-07-30 | SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the acc… |
CVE-2019-5453 | Medium | 6.1 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to… |
CVE-2019-5452 | Low | 2.4 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although t… |
CVE-2019-5451 | Medium | 4.6 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very sho… |
CVE-2019-5450 | Medium | 6.8 | 2019-07-30 | Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when… |
CVE-2019-5449 | Medium | 4.3 | 2019-07-30 | A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. |
CVE-2019-12739 | Critical | 9.0 | 2019-06-05 | lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filenam… |
CVE-2018-16467 | Medium | 5.3 | 2018-10-30 | A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares. |
CVE-2018-16466 | High | 8.1 | 2018-10-30 | Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens. |
CVE-2018-16465 | Medium | 5.3 | 2018-10-30 | Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load. |
CVE-2018-16464 | Medium | 5.7 | 2018-10-30 | A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the pass… |
CVE-2018-16463 | Low | 3.1 | 2018-10-30 | A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protecte… |
CVE-2018-3781 | Medium | 5.4 | 2018-08-13 | A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing… |
CVE-2018-3780 | Medium | 5.4 | 2018-08-13 | A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missi… |
CVE-2018-3776 | Medium | 5.3 | 2018-08-12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. |
CVE-2018-3775 | High | 8.8 | 2018-08-12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authenticatio… |
CVE-2018-3764 | Medium | 4.8 | 2018-07-05 | In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. T… |
CVE-2018-3763 | Medium | 4.8 | 2018-07-05 | In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-inte… |
CVE-2018-3762 | Medium | 4.3 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for… |
CVE-2018-3761 | High | 8.1 | 2018-07-05 | Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new… |
CVE-2017-0936 | Medium | 5.7 | 2018-03-28 | Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed log… |
CVE-2017-0895 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content… |
CVE-2017-0894 | Medium | 4.3 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potenti… |
CVE-2017-0893 | Medium | 5.4 | 2017-05-08 | Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS… |
CVE-2017-0892 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to… |
CVE-2017-0891 | Medium | 5.4 | 2017-05-08 | Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple comp… |
CVE-2017-0890 | Medium | 5.4 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to wri… |
CVE-2017-0888 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list… |
CVE-2017-0887 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length… |
CVE-2017-0886 | Medium | 6.5 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trig… |
CVE-2017-0885 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application log… |
CVE-2017-0884 | Medium | 4.3 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in… |
CVE-2017-0883 | Medium | 6.4 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing… |
CVE-2016-9468 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed… |
CVE-2016-9467 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files… |
CVE-2016-9466 | Medium | 6.1 | 2017-03-28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly… |
CVE-2016-9465 | Medium | 5.4 | 2017-03-28 | Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality… |
CVE-2016-9464 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does… |
CVE-2016-9463 | High | 8.1 | 2017-03-28 | Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud inclu… |
CVE-2016-9462 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Ne… |
CVE-2016-9461 | Medium | 4.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was… |
CVE-2016-9460 | Medium | 5.3 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app w… |
CVE-2016-9459 | Medium | 6.1 | 2017-03-28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download… |
CVE-2016-7419 | Medium | 5.4 | 2016-09-17 | Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remot… |