# nextcloud security-advisories.

Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Nextcloud Server's brute force protection allows someone to send more requests than intended](https://agentprime.io/advisories/CVE-2023-32320.md)
  `CVE-2023-32320` · CVE record: nextcloud security-advisories · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2023 · Tags: Authentication bypass
- [Error in calendar when booking an appointment reveals the full path of the website](https://agentprime.io/advisories/CVE-2023-33183.md)
  `CVE-2023-33183` · CVE record: nextcloud security-advisories · CVSS 2.6 Low · Not analysed yet · Published 30 May 2023 · Tags: Broken access control
- [Nextcloud Contacts photos only sanitized if mime type is all lower case](https://agentprime.io/advisories/CVE-2023-33182.md)
  `CVE-2023-33182` · CVE record: nextcloud security-advisories · CVSS 0.0 None · Not analysed yet · Published 30 May 2023 · Tags: CWE-20
- [Blind SSRF in the Nextcloud Mail app on avatar endpoint](https://agentprime.io/advisories/CVE-2023-33184.md)
  `CVE-2023-33184` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 27 May 2023 · Tags: Server-side request forgery (SSRF)
- [Basic auth header on WebDAV requests is not brute-force protected in Nextcloud](https://agentprime.io/advisories/CVE-2023-32319.md)
  `CVE-2023-32319` · CVE record: nextcloud security-advisories · CVSS 8.1 High · Not analysed yet · Published 26 May 2023 · Tags: Authentication bypass
- [User session not correctly destroyed on logout](https://agentprime.io/advisories/CVE-2023-32318.md)
  `CVE-2023-32318` · CVE record: nextcloud security-advisories · CVSS 7.2 High · Not analysed yet · Published 26 May 2023 · Tags: Authentication bypass
- [Nextcloud user_oidc app is missing brute force protection](https://agentprime.io/advisories/CVE-2023-32074.md)
  `CVE-2023-32074` · CVE record: nextcloud security-advisories · CVSS 8.0 High · Not analysed yet · Published 25 May 2023 · Tags: Authentication bypass
- [Nextcloud Server missing brute force protection for passwords of password protected share links](https://agentprime.io/advisories/CVE-2023-28847.md)
  `CVE-2023-28847` · CVE record: nextcloud security-advisories · CVSS 3.1 Low · Not analysed yet · Published 25 Apr 2023 · Tags: Authentication bypass
- [Chat poll data can still be queried from API after purging history in Nextcloud talk](https://agentprime.io/advisories/CVE-2023-30540.md)
  `CVE-2023-30540` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 17 Apr 2023 · Tags: Information disclosure
- [Users can set up workflows using restricted and invisible system tags in Nextcloud](https://agentprime.io/advisories/CVE-2023-30539.md)
  `CVE-2023-30539` · CVE record: nextcloud security-advisories · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2023 · Tags: Broken access control
- [Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption](https://agentprime.io/advisories/CVE-2023-29000.md)
  `CVE-2023-29000` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 4 Apr 2023 · Tags: Weak cryptography or TLS
- [Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders](https://agentprime.io/advisories/CVE-2023-28999.md)
  `CVE-2023-28999` · CVE record: nextcloud security-advisories · CVSS 6.9 Medium · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-325
- [Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys](https://agentprime.io/advisories/CVE-2023-28998.md)
  `CVE-2023-28998` · CVE record: nextcloud security-advisories · CVSS 6.7 Medium · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-325
- [Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files](https://agentprime.io/advisories/CVE-2023-28997.md)
  `CVE-2023-28997` · CVE record: nextcloud security-advisories · CVSS 6.7 Medium · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-323
- [CSRF protection on user_oidc login returned the expected token in case of an error](https://agentprime.io/advisories/CVE-2023-28848.md)
  `CVE-2023-28848` · CVE record: nextcloud security-advisories · CVSS 4.8 Medium · Not analysed yet · Published 4 Apr 2023 · Tags: Cross-site request forgery (CSRF)
- [Full path of data directory exposed to Nextcloud server users](https://agentprime.io/advisories/CVE-2023-28834.md)
  `CVE-2023-28834` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 3 Apr 2023 · Tags: CWE-212
- [Chat room membership disclosed via autocompletion in Nextcloud talk](https://agentprime.io/advisories/CVE-2023-28845.md)
  `CVE-2023-28845` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 31 Mar 2023 · Tags: Broken access control
- [User without download rights can download older version of that file in nextcloud server](https://agentprime.io/advisories/CVE-2023-28844.md)
  `CVE-2023-28844` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 31 Mar 2023 · Tags: Broken access control
- [Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments](https://agentprime.io/advisories/CVE-2023-28645.md)
  `CVE-2023-28645` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 31 Mar 2023 · Tags: Broken access control
- [Insecure randomness for default password in nextcloud](https://agentprime.io/advisories/CVE-2023-28835.md)
  `CVE-2023-28835` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 30 Mar 2023 · Tags: Weak cryptography or TLS
- [Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server](https://agentprime.io/advisories/CVE-2023-28833.md)
  `CVE-2023-28833` · CVE record: nextcloud security-advisories · CVSS 2.4 Low · Not analysed yet · Published 30 Mar 2023 · Tags: Path traversal
- [Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server](https://agentprime.io/advisories/CVE-2023-28644.md)
  `CVE-2023-28644` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: Denial of service
- [Potential share collision for recipients when caching is enabled in nextcloud server](https://agentprime.io/advisories/CVE-2023-28643.md)
  `CVE-2023-28643` · CVE record: nextcloud security-advisories · CVSS 5.5 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-706
- [Scope of workflow operations is not validated in nextcloud server](https://agentprime.io/advisories/CVE-2023-26482.md)
  `CVE-2023-26482` · CVE record: nextcloud security-advisories · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2023 · Tags: Command injection
- [App lockout in nextcloud Android app can be bypassed via thirdparty apps](https://agentprime.io/advisories/CVE-2023-28646.md)
  `CVE-2023-28646` · CVE record: nextcloud security-advisories · CVSS 4.4 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: Authentication bypass, CWE-281
- [App pin of the iOS app can be bypassed in Nextcloud iOS](https://agentprime.io/advisories/CVE-2023-28647.md)
  `CVE-2023-28647` · CVE record: nextcloud security-advisories · CVSS 4.4 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: Authentication bypass, CWE-281
- [Delete permissions are not saved when creating public share in Nextcloud server](https://agentprime.io/advisories/CVE-2023-25817.md)
  `CVE-2023-25817` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 27 Mar 2023 · Tags: CWE-281
- [Missing brute force protection on password reset token in Nextcloud Server](https://agentprime.io/advisories/CVE-2023-25818.md)
  `CVE-2023-25818` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2023 · Tags: Authentication bypass
- [Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal](https://agentprime.io/advisories/CVE-2023-25820.md)
  `CVE-2023-25820` · CVE record: nextcloud security-advisories · CVSS 4.2 Medium · Not analysed yet · Published 22 Mar 2023 · Tags: Authentication bypass
- [Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured](https://agentprime.io/advisories/CVE-2023-26041.md)
  `CVE-2023-26041` · CVE record: nextcloud security-advisories · CVSS 2.6 Low · Not analysed yet · Published 27 Feb 2023 · Tags: Information disclosure
- [Nextcloud download permissions can be changed by resharer](https://agentprime.io/advisories/CVE-2023-25821.md)
  `CVE-2023-25821` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 24 Feb 2023 · Tags: Broken access control
- [nextcloud vulnerable to Uncontrolled Resource Consumption](https://agentprime.io/advisories/CVE-2023-25816.md)
  `CVE-2023-25816` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 24 Feb 2023 · Tags: Denial of service
- [Directory traversal in Nextcloud server](https://agentprime.io/advisories/CVE-2023-25579.md)
  `CVE-2023-25579` · CVE record: nextcloud security-advisories · CVSS 6.0 Medium · Not analysed yet · Published 22 Feb 2023 · Tags: Path traversal
- [Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs](https://agentprime.io/advisories/CVE-2023-25162.md)
  `CVE-2023-25162` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 13 Feb 2023 · Tags: Server-side request forgery (SSRF)
- [Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails](https://agentprime.io/advisories/CVE-2023-25161.md)
  `CVE-2023-25161` · CVE record: nextcloud security-advisories · CVSS 3.7 Low · Not analysed yet · Published 13 Feb 2023 · Tags: Broken access control
- [IDOR Vulnerability in Nextcloud Mail](https://agentprime.io/advisories/CVE-2023-25160.md)
  `CVE-2023-25160` · CVE record: nextcloud security-advisories · CVSS 4.1 Medium · Not analysed yet · Published 13 Feb 2023 · Tags: Broken access control
- [Nextcloud Server previews are accessible without a watermark](https://agentprime.io/advisories/CVE-2023-25159.md)
  `CVE-2023-25159` · CVE record: nextcloud security-advisories · CVSS 2.3 Low · Not analysed yet · Published 13 Feb 2023 · Tags: Broken access control
- [Document content of files can be obtained through Collabora for files of other users](https://agentprime.io/advisories/CVE-2023-25150.md)
  `CVE-2023-25150` · CVE record: nextcloud security-advisories · CVSS 5.8 Medium · Not analysed yet · Published 8 Feb 2023 · Tags: Broken access control
- [Self reflected HTML injection in Desktop client](https://agentprime.io/advisories/CVE-2023-23942.md)
  `CVE-2023-23942` · CVE record: nextcloud security-advisories · CVSS 5.4 Medium · Not analysed yet · Published 6 Feb 2023 · Tags: Cross-site scripting (XSS)
- [Blind SSRF via server URL input in the Nextcloud Mail app](https://agentprime.io/advisories/CVE-2023-23943.md)
  `CVE-2023-23943` · CVE record: nextcloud security-advisories · CVSS 5.0 Medium · Not analysed yet · Published 6 Feb 2023 · Tags: Server-side request forgery (SSRF)
- [Nexcloud Mail app temporarily stores cleartext password in database](https://agentprime.io/advisories/CVE-2023-23944.md)
  `CVE-2023-23944` · CVE record: nextcloud security-advisories · CVSS 2.0 Low · Not analysed yet · Published 6 Feb 2023 · Tags: Information disclosure
- [Nextcloud Deck vulnerable to authorization bypass](https://agentprime.io/advisories/CVE-2023-22471.md)
  `CVE-2023-22471` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 14 Jan 2023 · Tags: Broken access control
- [Nextcloud Deck vulnerable to uncontrolled resource consumption](https://agentprime.io/advisories/CVE-2023-22470.md)
  `CVE-2023-22470` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 14 Jan 2023 · Tags: Denial of service
- [Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache](https://agentprime.io/advisories/CVE-2023-22469.md)
  `CVE-2023-22469` · CVE record: nextcloud security-advisories · CVSS 5.8 Medium · Not analysed yet · Published 10 Jan 2023 · Tags: Information disclosure
- [Passcode bypass on Talk-Android app](https://agentprime.io/advisories/CVE-2023-22473.md)
  `CVE-2023-22473` · CVE record: nextcloud security-advisories · CVSS 2.1 Low · Not analysed yet · Published 9 Jan 2023 · Tags: Broken access control
- [Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link](https://agentprime.io/advisories/CVE-2023-22472.md)
  `CVE-2023-22472` · CVE record: nextcloud security-advisories · CVSS 5.3 Medium · Not analysed yet · Published 9 Jan 2023 · Tags: Cross-site request forgery (CSRF)
- [Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation](https://agentprime.io/advisories/CVE-2022-41971.md)
  `CVE-2022-41971` · CVE record: nextcloud security-advisories · CVSS 4.8 Medium · Not analysed yet · Published 1 Dec 2022 · Tags: Information disclosure
- [Nextcloud Server's disabled download shares still allow download through preview images](https://agentprime.io/advisories/CVE-2022-41970.md)
  `CVE-2022-41970` · CVE record: nextcloud security-advisories · CVSS 2.6 Low · Not analysed yet · Published 1 Dec 2022 · Tags: Broken access control
- [Nextcloud Server has no password length limit when creating a user as an administrator](https://agentprime.io/advisories/CVE-2022-41969.md)
  `CVE-2022-41969` · CVE record: nextcloud security-advisories · CVSS 2.4 Low · Not analysed yet · Published 1 Dec 2022 · Tags: Denial of service
- [Nextcloud Server's calendar name length not validated before writing to database](https://agentprime.io/advisories/CVE-2022-41968.md)
  `CVE-2022-41968` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 1 Dec 2022 · Tags: Denial of service
- [Nextcloud Talk Android broadcast incorrect permission handling](https://agentprime.io/advisories/CVE-2022-41926.md)
  `CVE-2022-41926` · CVE record: nextcloud security-advisories · CVSS 3.3 Low · Not analysed yet · Published 25 Nov 2022 · Tags: Information disclosure, Broken access control
- [Missing length validation of user displayname in nextcloud server](https://agentprime.io/advisories/CVE-2022-39346.md)
  `CVE-2022-39346` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 25 Nov 2022 · Tags: Denial of service, CWE-20
- [Cleartext Transmission of Sensitive Information in user_oidc](https://agentprime.io/advisories/CVE-2022-39339.md)
  `CVE-2022-39339` · CVE record: nextcloud security-advisories · CVSS 4.3 Medium · Not analysed yet · Published 25 Nov 2022 · Tags: Weak cryptography or TLS
- [Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc](https://agentprime.io/advisories/CVE-2022-39338.md)
  `CVE-2022-39338` · CVE record: nextcloud security-advisories · CVSS 3.5 Low · Not analysed yet · Published 25 Nov 2022 · Tags: Cross-site scripting (XSS), CWE-20
- [nextcloudcmd incorrectly trusts bad TLS certificates](https://agentprime.io/advisories/CVE-2022-39334.md)
  `CVE-2022-39334` · CVE record: nextcloud security-advisories · CVSS 3.9 Low · Not analysed yet · Published 25 Nov 2022 · Tags: Weak cryptography or TLS
- [Cross-site scripting (XSS) in Nextcloud Desktop Client](https://agentprime.io/advisories/CVE-2022-39333.md)
  `CVE-2022-39333` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 25 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting (XSS) in Nextcloud Desktop Client](https://agentprime.io/advisories/CVE-2022-39332.md)
  `CVE-2022-39332` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 25 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting (XSS) in Nexcloud Desktop Client](https://agentprime.io/advisories/CVE-2022-39331.md)
  `CVE-2022-39331` · CVE record: nextcloud security-advisories · CVSS 4.6 Medium · Not analysed yet · Published 25 Nov 2022 · Tags: Cross-site scripting (XSS)
- [Nextcloud Desktop vulnerable to code injection via malicious link](https://agentprime.io/advisories/CVE-2022-41882.md)
  `CVE-2022-41882` · CVE record: nextcloud security-advisories · CVSS 6.6 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: Code injection
- [Exception logging in Sharepoint app reveals clear-text connection details](https://agentprime.io/advisories/CVE-2022-39364.md)
  `CVE-2022-39364` · CVE record: nextcloud security-advisories · CVSS 4.0 Medium · Not analysed yet · Published 27 Oct 2022 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/technology/nextcloud-security-advisories.md>
Older: <https://agentprime.io/advisories/technology/nextcloud-security-advisories.md?cursor=WyIyMDIyLTEwLTI3VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0zOTM2NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nextcloud-security-advisories&cursor=WyIyMDIzLTA2LTIzVDIwOjQ0OjM0LjI3MjAwMFoiLCJDVkUtMjAyMy0zNTE3MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nextcloud-security-advisories/?cursor=WyIyMDIzLTA2LTIzVDIwOjQ0OjM0LjI3MjAwMFoiLCJDVkUtMjAyMy0zNTE3MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.