# nextcloud security-advisories. Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them](https://agentprime.io/advisories/CVE-2024-52516.md) `CVE-2024-52516` · CVE record: nextcloud security-advisories · CVSS 3.0 Low · Not analysed yet · Published 15 Nov 2024 · Tags: Privilege escalation - [Nextcloud Server's global credentials of external storages are sent back to the frontend](https://agentprime.io/advisories/CVE-2024-52517.md) `CVE-2024-52517` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Information disclosure - [Nextcloud Server is missing password confirmation when changing external storage options](https://agentprime.io/advisories/CVE-2024-52518.md) `CVE-2024-52518` · CVE record: nextcloud security-advisories · CVSS 4.4 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Authentication bypass - [Nextcloud Server's OAuth2 client secrets were stored in a recoverable way](https://agentprime.io/advisories/CVE-2024-52519.md) `CVE-2024-52519` · CVE record: nextcloud security-advisories · CVSS 2.7 Low · Not analysed yet · Published 15 Nov 2024 · Tags: Information disclosure - [Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended](https://agentprime.io/advisories/CVE-2024-52520.md) `CVE-2024-52520` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Cross-site scripting (XSS), Denial of service - [Nextcloud Server has a potential hash collision for background jobs could skip queuing them](https://agentprime.io/advisories/CVE-2024-52521.md) `CVE-2024-52521` · CVE record: nextcloud security-advisories · CVSS 2.6 Low · Not analysed yet · Published 15 Nov 2024 · Tags: Weak cryptography or TLS - [Nextcloud Server Custom defined credentials of external storages are sent back to the frontend](https://agentprime.io/advisories/CVE-2024-52523.md) `CVE-2024-52523` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: Memory corruption, Information disclosure - [Nextcloud Server User password is available in memory of the PHP process](https://agentprime.io/advisories/CVE-2024-52525.md) `CVE-2024-52525` · CVE record: nextcloud security-advisories · CVSS 1.8 Low · Not analysed yet · Published 15 Nov 2024 · Tags: Information disclosure - [Nextcloud Server's events information leaked with shared calendars on recurrence exceptions](https://agentprime.io/advisories/CVE-2024-37887.md) `CVE-2024-37887` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud user_oidc's ID4me does not validate signature or expiration](https://agentprime.io/advisories/CVE-2024-37886.md) `CVE-2024-37886` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Weak cryptography or TLS - [Code injection in Nextcloud Desktop Client for macOS](https://agentprime.io/advisories/CVE-2024-37885.md) `CVE-2024-37885` · CVE record: nextcloud security-advisories · CVSS 3.8 Low · Not analysed yet · Published 14 Jun 2024 · Tags: Code injection - [Nextcloud Server's users can delete old versions of read-only shared files](https://agentprime.io/advisories/CVE-2024-37884.md) `CVE-2024-37884` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud Deck can access comments and attachments of deleted cards](https://agentprime.io/advisories/CVE-2024-37883.md) `CVE-2024-37883` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud Server can reshare read&share only folder with more permissions](https://agentprime.io/advisories/CVE-2024-37882.md) `CVE-2024-37882` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud Notes app can be tricked into using a received share created before the user logged in](https://agentprime.io/advisories/CVE-2024-37317.md) `CVE-2024-37317` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud Calendar's event create can create attachments that link to other websites](https://agentprime.io/advisories/CVE-2024-37316.md) `CVE-2024-37316` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: CWE-241 - [Nextcloud Server's read-only users can restore old versions](https://agentprime.io/advisories/CVE-2024-37315.md) `CVE-2024-37315` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud Photos' shared albums have no restriction on photo removal](https://agentprime.io/advisories/CVE-2024-37314.md) `CVE-2024-37314` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Nextcloud server allows the by-pass the second factor](https://agentprime.io/advisories/CVE-2024-37313.md) `CVE-2024-37313` · CVE record: nextcloud security-advisories · CVSS 7.3 High · Not analysed yet · Published 14 Jun 2024 · Tags: Authentication bypass - [Nextcloud user_oidc app's ID4me feature is available even when disabled](https://agentprime.io/advisories/CVE-2024-37312.md) `CVE-2024-37312` · CVE record: nextcloud security-advisories · CVSS 6.3 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Broken access control - [Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist](https://agentprime.io/advisories/CVE-2024-22402.md) `CVE-2024-22402` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: CWE-281 - [All users can reset the allowed apps list for Nextcloud Guest App users](https://agentprime.io/advisories/CVE-2024-22401.md) `CVE-2024-22401` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: CWE-281 - [Permissions bypass in Nextcloud with the files zip app](https://agentprime.io/advisories/CVE-2024-22404.md) `CVE-2024-22404` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 18 Jan 2024 · Tags: CWE-281 - [OAuth2 authorization codes are valid indefinetly in Nextcloud server](https://agentprime.io/advisories/CVE-2024-22403.md) `CVE-2024-22403` · CVE record: nextcloud security-advisories · CVSS 3.0 Low · Not analysed yet · Published 18 Jan 2024 · Tags: Authentication bypass - [Open redirect in user_saml via RelayState parameter in Nextcloud User Saml](https://agentprime.io/advisories/CVE-2024-22400.md) `CVE-2024-22400` · CVE record: nextcloud security-advisories · CVSS 3.1 Low · Not analysed yet · Published 18 Jan 2024 · Tags: Open redirect - [Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app](https://agentprime.io/advisories/CVE-2024-22213.md) `CVE-2024-22213` · CVE record: nextcloud security-advisories · CVSS 0.0 None · Not analysed yet · Published 18 Jan 2024 · Tags: Cross-site scripting (XSS) - [Nextcloud global site selector authentication bypass](https://agentprime.io/advisories/CVE-2024-22212.md) `CVE-2024-22212` · CVE record: nextcloud security-advisories · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jan 2024 · Tags: Authentication bypass - [Bruteforce protection can be bypassed with misconfigured proxy](https://agentprime.io/advisories/CVE-2023-49792.md) `CVE-2023-49792` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 22 Dec 2023 · Tags: Authentication bypass - [Workflows do not require password confirmation on API level](https://agentprime.io/advisories/CVE-2023-49791.md) `CVE-2023-49791` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 22 Dec 2023 · Tags: Broken access control, Authentication bypass - [App PIN code can be bypassed in Nextcloud Files iOS](https://agentprime.io/advisories/CVE-2023-49790.md) `CVE-2023-49790` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 22 Dec 2023 · Tags: Authentication bypass - [Calendar app returns full stacktrace when an error happens while editing appointment](https://agentprime.io/advisories/CVE-2023-48308.md) `CVE-2023-48308` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 21 Dec 2023 · Tags: CWE-1258 - [Nextcloud Mail app vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2023-48307.md) `CVE-2023-48307` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 21 Nov 2023 · Tags: Server-side request forgery (SSRF) - [Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF](https://agentprime.io/advisories/CVE-2023-48306.md) `CVE-2023-48306` · CVE record: nextcloud security-advisories · CVSS 5.0 Medium · Not analysed yet · Published 21 Nov 2023 · Tags: Server-side request forgery (SSRF) - [Nextcloud Server user_ldap app logs user passwords in the log file on level debug](https://agentprime.io/advisories/CVE-2023-48305.md) `CVE-2023-48305` · CVE record: nextcloud security-advisories · CVSS 4.2 Medium · Not analysed yet · Published 21 Nov 2023 · Tags: Information disclosure - [Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user](https://agentprime.io/advisories/CVE-2023-48304.md) `CVE-2023-48304` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 21 Nov 2023 · Tags: Broken access control - [Nextcloud Server admins can change authentication details of user configured external storage](https://agentprime.io/advisories/CVE-2023-48303.md) `CVE-2023-48303` · CVE record: nextcloud security-advisories · CVSS 2.4 Low · Not analysed yet · Published 21 Nov 2023 · Tags: Broken access control - [Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V](https://agentprime.io/advisories/CVE-2023-48302.md) `CVE-2023-48302` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 21 Nov 2023 · Tags: Cross-site scripting (XSS) - [Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name](https://agentprime.io/advisories/CVE-2023-48301.md) `CVE-2023-48301` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 21 Nov 2023 · Tags: Cross-site scripting (XSS) - [Nextcloud Server users can make external storage mount points inaccessible for other users](https://agentprime.io/advisories/CVE-2023-48239.md) `CVE-2023-48239` · CVE record: nextcloud security-advisories · CVSS 8.5 High · Not analysed yet · Published 21 Nov 2023 · Tags: Broken access control - [Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive](https://agentprime.io/advisories/CVE-2023-45150.md) `CVE-2023-45150` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Denial of service - [Password of talk conversations can be bruteforced in Nextcloud](https://agentprime.io/advisories/CVE-2023-45149.md) `CVE-2023-45149` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Authentication bypass - [Rate limiter not working reliable when Memcached is installed in Nextcloud](https://agentprime.io/advisories/CVE-2023-45148.md) `CVE-2023-45148` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Authentication bypass - [OAuth2 client_secret stored in plain text in the Nextcloud database](https://agentprime.io/advisories/CVE-2023-45151.md) `CVE-2023-45151` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Information disclosure - [Require strict cookies for image proxy requests in Nextcloud Mail](https://agentprime.io/advisories/CVE-2023-45660.md) `CVE-2023-45660` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2023 · Tags: Server-side request forgery (SSRF) - [Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint](https://agentprime.io/advisories/CVE-2023-39960.md) `CVE-2023-39960` · CVE record: nextcloud security-advisories · CVSS 5.0 Medium · Not analysed yet · Published 13 Oct 2023 · Tags: Authentication bypass - [Missing password confirmation when creating app passwords](https://agentprime.io/advisories/CVE-2023-39963.md) `CVE-2023-39963` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 10 Aug 2023 · Tags: Broken access control - [Users can delete external storage mount points](https://agentprime.io/advisories/CVE-2023-39962.md) `CVE-2023-39962` · CVE record: nextcloud security-advisories · CVSS 7.7 High · Not analysed yet · Published 10 Aug 2023 · Tags: Broken access control - [Text does not respect "Allow download" permissions](https://agentprime.io/advisories/CVE-2023-39961.md) `CVE-2023-39961` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 10 Aug 2023 · Tags: Broken access control - [Existence of calendars and address books can be checked by unauthenticated users](https://agentprime.io/advisories/CVE-2023-39959.md) `CVE-2023-39959` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 10 Aug 2023 · Tags: Broken access control - [Missing brute force protection on password reset token OAuth2 API controller](https://agentprime.io/advisories/CVE-2023-39958.md) `CVE-2023-39958` · CVE record: nextcloud security-advisories · CVSS 5.8 Medium · Not analysed yet · Published 10 Aug 2023 · Tags: Authentication bypass - [Path traversal allows tricking the Talk Android app into writing files into it's root directory](https://agentprime.io/advisories/CVE-2023-39957.md) `CVE-2023-39957` · CVE record: nextcloud security-advisories · CVSS 7.2 High · Not analysed yet · Published 10 Aug 2023 · Tags: Path traversal - [Notes attachment render HTML in preview mode](https://agentprime.io/advisories/CVE-2023-39955.md) `CVE-2023-39955` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 10 Aug 2023 · Tags: Cross-site scripting (XSS) - [user_oidc app stores client secret unencrypted in database](https://agentprime.io/advisories/CVE-2023-39954.md) `CVE-2023-39954` · CVE record: nextcloud security-advisories · CVSS 3.8 Low · Not analysed yet · Published 10 Aug 2023 · Tags: Weak cryptography or TLS - [Issuer not verified from obtained token in user_oidc](https://agentprime.io/advisories/CVE-2023-39953.md) `CVE-2023-39953` · CVE record: nextcloud security-advisories · CVSS 4.8 Medium · Not analysed yet · Published 10 Aug 2023 · Tags: Authentication bypass - [Advanced permissions not respected when copying entire group folders](https://agentprime.io/advisories/CVE-2023-39952.md) `CVE-2023-39952` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 10 Aug 2023 · Tags: Broken access control - [Nextcloud user scoped external storage can be used to gather credentials of other users](https://agentprime.io/advisories/CVE-2023-35928.md) `CVE-2023-35928` · CVE record: nextcloud security-advisories · CVSS 8.5 High · Not analysed yet · Published 23 Jun 2023 · Tags: CWE-274 - [Nextcloud system addressbooks can be modified by malicious trusted server](https://agentprime.io/advisories/CVE-2023-35927.md) `CVE-2023-35927` · CVE record: nextcloud security-advisories · CVSS 7.6 High · Not analysed yet · Published 23 Jun 2023 · Tags: Broken access control - [End-to-End encrypted file-drops can be made inaccessible](https://agentprime.io/advisories/CVE-2023-35173.md) `CVE-2023-35173` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 23 Jun 2023 · Tags: Broken access control - [Nextcloud Server password reset endpoint is not brute force protected](https://agentprime.io/advisories/CVE-2023-35172.md) `CVE-2023-35172` · CVE record: nextcloud security-advisories · CVSS 8.7 High · Not analysed yet · Published 23 Jun 2023 · Tags: Authentication bypass - [Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning](https://agentprime.io/advisories/CVE-2023-35171.md) `CVE-2023-35171` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 23 Jun 2023 · Tags: Open redirect Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .