# nextcloud security-advisories.

Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Database resource exhaustion for logged-in users via sharee recommendations with circles](https://agentprime.io/advisories/CVE-2022-39330.md)
  `CVE-2022-39330` · CVE record: nextcloud security-advisories · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2022 · Tags: Denial of service
- [Profile of disabled user stays accessible](https://agentprime.io/advisories/CVE-2022-39329.md)
  `CVE-2022-39329` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 27 Oct 2022 · Tags: Broken access control
- [Last video frame is still sent after video is disabled in a call in Nextcloud Talk](https://agentprime.io/advisories/CVE-2022-39212.md)
  `CVE-2022-39212` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2022 · Tags: Information disclosure
- [Access to internal files of the Nextcloud Android app](https://agentprime.io/advisories/CVE-2022-39210.md)
  `CVE-2022-39210` · CVE record: nextcloud security-advisories · CVSS 3.2 Low · Not analysed yet · Published 16 Sept 2022 · Tags: Path traversal, Information disclosure
- [Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-39211.md)
  `CVE-2022-39211` · CVE record: nextcloud security-advisories · CVSS 3.0 Low · Not analysed yet · Published 16 Sept 2022 · Tags: Server-side request forgery (SSRF)
- [Authentication headers exposed on by Nextcloud Server](https://agentprime.io/advisories/CVE-2022-36074.md)
  `CVE-2022-36074` · CVE record: nextcloud security-advisories · CVSS 6.4 Medium · Not analysed yet · Published 15 Sept 2022 · Tags: Information disclosure
- [File list exposure in Nextcloud Files Access Control](https://agentprime.io/advisories/CVE-2022-36075.md)
  `CVE-2022-36075` · CVE record: nextcloud security-advisories · CVSS 2.6 Low · Not analysed yet · Published 15 Sept 2022 · Tags: Information disclosure
- [Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator](https://agentprime.io/advisories/CVE-2022-35931.md)
  `CVE-2022-35931` · CVE record: nextcloud security-advisories · CVSS 2.7 Low · Not analysed yet · Published 6 Sept 2022 · Tags: CWE-261
- [Missing rate limit when trying to join a password protected Nextcloud Talk conversation](https://agentprime.io/advisories/CVE-2022-35932.md)
  `CVE-2022-35932` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 12 Aug 2022 · Tags: Information disclosure
- [Password disclosure in log file in Nextcloud Mail App](https://agentprime.io/advisories/CVE-2022-31119.md)
  `CVE-2022-31119` · CVE record: nextcloud security-advisories · CVSS 3.1 Low · Not analysed yet · Published 4 Aug 2022 · Tags: Information disclosure
- [Unauthenticated SSRF in 3rd party module "cerdic/csstidy"](https://agentprime.io/advisories/CVE-2022-31132.md)
  `CVE-2022-31132` · CVE record: nextcloud security-advisories · CVSS 8.3 High · Not analysed yet · Published 4 Aug 2022 · Tags: Server-side request forgery (SSRF)
- [Federated share accepting/declining is not logged in audit log in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-31120.md)
  `CVE-2022-31120` · CVE record: nextcloud security-advisories · CVSS 2.1 Low · Not analysed yet · Published 4 Aug 2022 · Tags: CWE-778
- [Missing brute force protection on cloud federation sharing in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-31118.md)
  `CVE-2022-31118` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 4 Aug 2022 · Tags: Denial of service
- [Ownership check missing when updating or deleting mail attachments in Nextcloud mail](https://agentprime.io/advisories/CVE-2022-31131.md)
  `CVE-2022-31131` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 6 Jul 2022 · Tags: Authentication bypass
- [SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-31014.md)
  `CVE-2022-31014` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 5 Jul 2022 · Tags: Other injection
- [Federated editing allows iframing remote servers by default in richdocuments](https://agentprime.io/advisories/CVE-2022-31024.md)
  `CVE-2022-31024` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2022 · Tags: Broken access control, CWE-346
- [Improper input-size validation on the user new session name in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-29243.md)
  `CVE-2022-29243` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 31 May 2022 · Tags: Denial of service, CWE-20
- [Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-29163.md)
  `CVE-2022-29163` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 20 May 2022 · Tags: CWE-671
- [Sensitive files/data exist after deletion of user account in Nextcloud Android](https://agentprime.io/advisories/CVE-2022-29160.md)
  `CVE-2022-29160` · CVE record: nextcloud security-advisories · CVSS 2.8 Low · Not analysed yet · Published 20 May 2022 · Tags: Broken access control
- [Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck](https://agentprime.io/advisories/CVE-2022-24906.md)
  `CVE-2022-24906` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 20 May 2022 · Tags: Information disclosure
- [Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck](https://agentprime.io/advisories/CVE-2022-29159.md)
  `CVE-2022-29159` · CVE record: nextcloud security-advisories · CVSS 5.0 Medium · Not analysed yet · Published 20 May 2022 · Tags: Broken access control
- [Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk](https://agentprime.io/advisories/CVE-2022-24890.md)
  `CVE-2022-24890` · CVE record: nextcloud security-advisories · CVSS 2.4 Low · Not analysed yet · Published 17 May 2022 · Tags: Information disclosure
- [Insufficient Verification of Data Authenticity in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-24889.md)
  `CVE-2022-24889` · CVE record: nextcloud security-advisories · CVSS 2.4 Low · Not analysed yet · Published 27 Apr 2022 · Tags: CWE-345
- [Possible Injection in Nextcloud Server](https://agentprime.io/advisories/CVE-2022-24888.md)
  `CVE-2022-24888` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 27 Apr 2022 · Tags: Other injection
- [Open Redirect in Nextcloud Talk](https://agentprime.io/advisories/CVE-2022-24887.md)
  `CVE-2022-24887` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 27 Apr 2022 · Tags: Open redirect
- [Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client](https://agentprime.io/advisories/CVE-2022-24886.md)
  `CVE-2022-24886` · CVE record: nextcloud security-advisories · CVSS 2.2 Low · Not analysed yet · Published 27 Apr 2022 · Tags: Information disclosure
- [Improper Authentication in Nextcloud Android Files](https://agentprime.io/advisories/CVE-2022-24885.md)
  `CVE-2022-24885` · CVE record: nextcloud security-advisories · CVSS 2.0 Low · Not analysed yet · Published 27 Apr 2022 · Tags: Authentication bypass
- [Command Injection in Appointment Emails for Nextcloud Calendar](https://agentprime.io/advisories/CVE-2022-24838.md)
  `CVE-2022-24838` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · EPSS 0.33 · Not analysed yet · Published 11 Apr 2022 · Tags: Other injection
- [Missing authorization in Nextcloud text](https://agentprime.io/advisories/CVE-2021-41233.md)
  `CVE-2021-41233` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 10 Mar 2022 · Tags: Broken access control
- [High memory usage in Nextcloud server](https://agentprime.io/advisories/CVE-2022-24741.md)
  `CVE-2022-24741` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 9 Mar 2022 · Tags: Denial of service
- [Advanced permissions is not respected for subfolders in Nextcloud server](https://agentprime.io/advisories/CVE-2021-41241.md)
  `CVE-2021-41241` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 8 Mar 2022 · Tags: Broken access control
- [User enumeration setting not respected in Nextcloud server](https://agentprime.io/advisories/CVE-2021-41239.md)
  `CVE-2021-41239` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2022 · Tags: Information disclosure
- [Nextcloud Talk app exposes chat messages on lockscreen](https://agentprime.io/advisories/CVE-2021-41181.md)
  `CVE-2021-41181` · CVE record: nextcloud security-advisories · CVSS 2.4 Low · Not analysed yet · Published 8 Mar 2022 · Tags: Information disclosure
- [Geolocation preview links can be set to arbitrary links in nextcloud talk](https://agentprime.io/advisories/CVE-2021-41180.md)
  `CVE-2021-41180` · CVE record: nextcloud security-advisories · CVSS 4.7 Medium · Not analysed yet · Published 8 Mar 2022 · Tags: Open redirect
- [Permission bypass in Nextcloud Android App](https://agentprime.io/advisories/CVE-2021-41166.md)
  `CVE-2021-41166` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 26 Jan 2022 · Tags: Broken access control
- [XSS in Talk](https://agentprime.io/advisories/CVE-2021-39222.md)
  `CVE-2021-39222` · CVE record: nextcloud security-advisories · CVSS 6.4 Medium · Not analysed yet · Published 15 Nov 2021 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Two-Factor Authentication not enforced for pages marked as public](https://agentprime.io/advisories/CVE-2021-41179.md)
  `CVE-2021-41179` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 25 Oct 2021 · Tags: Authentication bypass
- [File Traversal affecting SVG files on Nextcloud Server](https://agentprime.io/advisories/CVE-2021-41178.md)
  `CVE-2021-41178` · CVE record: nextcloud security-advisories · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2021 · Tags: Path traversal, Unrestricted file upload
- [Rate-limits not working on instances without configured memory cache backend](https://agentprime.io/advisories/CVE-2021-41177.md)
  `CVE-2021-41177` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 25 Oct 2021 · Tags: CWE-799
- [File path disclosure of shared files in OfficeOnline application](https://agentprime.io/advisories/CVE-2021-39224.md)
  `CVE-2021-39224` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 25 Oct 2021 · Tags: Information disclosure
- [Missing permission check on Deck API](https://agentprime.io/advisories/CVE-2021-39225.md)
  `CVE-2021-39225` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 25 Oct 2021 · Tags: Broken access control
- [File path disclosure of shared files in Richdocuments application](https://agentprime.io/advisories/CVE-2021-39223.md)
  `CVE-2021-39223` · CVE record: nextcloud security-advisories · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2021 · Tags: Information disclosure
- [XSS in Contacts](https://agentprime.io/advisories/CVE-2021-39221.md)
  `CVE-2021-39221` · CVE record: nextcloud security-advisories · CVSS 6.4 Medium · Not analysed yet · Published 25 Oct 2021 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Bypass of image blocking in Nextcloud Mail](https://agentprime.io/advisories/CVE-2021-39220.md)
  `CVE-2021-39220` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 25 Oct 2021 · Tags: Information disclosure, CWE-20
- [Preview generation used third-party library not suited for user-generated content in Nextcloud server](https://agentprime.io/advisories/CVE-2021-32802.md)
  `CVE-2021-32802` · CVE record: nextcloud security-advisories · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2021 · Tags: CWE-829
- [Exceptions may have logged Encryption-at-Rest key content in Nextcloud server](https://agentprime.io/advisories/CVE-2021-32801.md)
  `CVE-2021-32801` · CVE record: nextcloud security-advisories · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Information disclosure
- [Bypass of Two Factor Authentication in Nextcloud server](https://agentprime.io/advisories/CVE-2021-32800.md)
  `CVE-2021-32800` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 7 Sept 2021 · Tags: Authentication bypass
- [Nextcloud Text app can disclose existence of folders in "File Drop" link share](https://agentprime.io/advisories/CVE-2021-32766.md)
  `CVE-2021-32766` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Information disclosure
- [Lack of ratelimit on Richdocuments OCS endpoint in nextcloud](https://agentprime.io/advisories/CVE-2021-37629.md)
  `CVE-2021-37629` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Information disclosure
- [File Drop can be bypassed using Richdocuments app in nextcloud](https://agentprime.io/advisories/CVE-2021-37628.md)
  `CVE-2021-37628` · CVE record: nextcloud security-advisories · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2021 · Tags: Broken access control
- [Cross-Site Scripting in Nextcloud Circles](https://agentprime.io/advisories/CVE-2021-32782.md)
  `CVE-2021-32782` · CVE record: nextcloud security-advisories · CVSS 5.8 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Cross-site scripting (XSS)
- [Secret Circle can be joined without approval in Nextcloud Circles](https://agentprime.io/advisories/CVE-2021-37630.md)
  `CVE-2021-37630` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Broken access control
- [Circle can be accessed by non-Circle members in Nextcloud Deck](https://agentprime.io/advisories/CVE-2021-37631.md)
  `CVE-2021-37631` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Broken access control
- [Untrusted Search Path in Nextcloud Desktop Client](https://agentprime.io/advisories/CVE-2021-37617.md)
  `CVE-2021-37617` · CVE record: nextcloud security-advisories · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2021 · Tags: CWE-426
- [End-to-end encryption device setup did not verify public key](https://agentprime.io/advisories/CVE-2021-32728.md)
  `CVE-2021-32728` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2021 · Tags: Weak cryptography or TLS
- [WOPI API not protected by credentials/IP check](https://agentprime.io/advisories/CVE-2021-32748.md)
  `CVE-2021-32748` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 27 Jul 2021 · Tags: Broken access control
- [Lack of ratelimit on public share link mount endpoint](https://agentprime.io/advisories/CVE-2021-32741.md)
  `CVE-2021-32741` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: CWE-799
- [File path disclosure of shared files in Nextcloud Text application](https://agentprime.io/advisories/CVE-2021-32734.md)
  `CVE-2021-32734` · CVE record: nextcloud security-advisories · CVSS 3.1 Low · Not analysed yet · Published 12 Jul 2021 · Tags: Information disclosure
- [XSS in Nextcloud Text application](https://agentprime.io/advisories/CVE-2021-32733.md)
  `CVE-2021-32733` · CVE record: nextcloud security-advisories · CVSS 4.8 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: Cross-site scripting (XSS)
- [End-to-end encryption device setup did not verify public key](https://agentprime.io/advisories/CVE-2021-32727.md)
  `CVE-2021-32727` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 12 Jul 2021 · Tags: Weak cryptography or TLS

Newest: <https://agentprime.io/advisories/technology/nextcloud-security-advisories.md>
Older: <https://agentprime.io/advisories/technology/nextcloud-security-advisories.md?cursor=WyIyMDIxLTA3LTEyVDIwOjQwOjEzLjAwMDAwMFoiLCJDVkUtMjAyMS0zMjcyNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nextcloud-security-advisories&cursor=WyIyMDIyLTEwLTI3VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0zOTM2NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nextcloud-security-advisories/?cursor=WyIyMDIyLTEwLTI3VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0zOTM2NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.