nextcloud security-advisories.

Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them

• nextcloud security-advisories
• Privilege escalation

Nextcloud Server's global credentials of external storages are sent back to the frontend

• nextcloud security-advisories
• Information disclosure

Nextcloud Server is missing password confirmation when changing external storage options

• nextcloud security-advisories
• Authentication bypass

Nextcloud Server's OAuth2 client secrets were stored in a recoverable way

• nextcloud security-advisories
• Information disclosure

Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended

• nextcloud security-advisories
• Cross-site scripting (XSS)
• Denial of service

Nextcloud Server has a potential hash collision for background jobs could skip queuing them

• nextcloud security-advisories
• Weak cryptography or TLS

Nextcloud Server Custom defined credentials of external storages are sent back to the frontend

• nextcloud security-advisories
• Memory corruption
• Information disclosure

Nextcloud Server User password is available in memory of the PHP process

• nextcloud security-advisories
• Information disclosure

Nextcloud Server's events information leaked with shared calendars on recurrence exceptions

• nextcloud security-advisories
• Broken access control

Nextcloud user_oidc's ID4me does not validate signature or expiration

• nextcloud security-advisories
• Weak cryptography or TLS

Code injection in Nextcloud Desktop Client for macOS

• nextcloud security-advisories
• Code injection

Nextcloud Server's users can delete old versions of read-only shared files

• nextcloud security-advisories
• Broken access control

Nextcloud Deck can access comments and attachments of deleted cards

• nextcloud security-advisories
• Broken access control

Nextcloud Server can reshare read&share only folder with more permissions

• nextcloud security-advisories
• Broken access control

Nextcloud Notes app can be tricked into using a received share created before the user logged in

• nextcloud security-advisories
• Broken access control

Nextcloud Calendar's event create can create attachments that link to other websites

• nextcloud security-advisories
• CWE-241

Nextcloud Server's read-only users can restore old versions

• nextcloud security-advisories
• Broken access control

Nextcloud Photos' shared albums have no restriction on photo removal

• nextcloud security-advisories
• Broken access control

Nextcloud server allows the by-pass the second factor

• nextcloud security-advisories
• Authentication bypass

Nextcloud user_oidc app's ID4me feature is available even when disabled

• nextcloud security-advisories
• Broken access control

Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

• nextcloud security-advisories
• CWE-281

All users can reset the allowed apps list for Nextcloud Guest App users

• nextcloud security-advisories
• CWE-281

Permissions bypass in Nextcloud with the files zip app

• nextcloud security-advisories
• CWE-281

OAuth2 authorization codes are valid indefinetly in Nextcloud server

• nextcloud security-advisories
• Authentication bypass

Open redirect in user_saml via RelayState parameter in Nextcloud User Saml

• nextcloud security-advisories
• Open redirect

Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app

• nextcloud security-advisories
• Cross-site scripting (XSS)

Nextcloud global site selector authentication bypass

• nextcloud security-advisories
• Authentication bypass

Bruteforce protection can be bypassed with misconfigured proxy

• nextcloud security-advisories
• Authentication bypass

Workflows do not require password confirmation on API level

• nextcloud security-advisories
• Broken access control
• Authentication bypass

App PIN code can be bypassed in Nextcloud Files iOS

• nextcloud security-advisories
• Authentication bypass

Calendar app returns full stacktrace when an error happens while editing appointment

• nextcloud security-advisories
• CWE-1258

Nextcloud Mail app vulnerable to Server-Side Request Forgery

• nextcloud security-advisories
• Server-side request forgery (SSRF)

Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

• nextcloud security-advisories
• Server-side request forgery (SSRF)

Nextcloud Server user_ldap app logs user passwords in the log file on level debug

• nextcloud security-advisories
• Information disclosure

Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user

• nextcloud security-advisories
• Broken access control

Nextcloud Server admins can change authentication details of user configured external storage

• nextcloud security-advisories
• Broken access control

Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V

• nextcloud security-advisories
• Cross-site scripting (XSS)

Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

• nextcloud security-advisories
• Cross-site scripting (XSS)

Nextcloud Server users can make external storage mount points inaccessible for other users

• nextcloud security-advisories
• Broken access control

Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive

• nextcloud security-advisories
• Denial of service

Password of talk conversations can be bruteforced in Nextcloud

• nextcloud security-advisories
• Authentication bypass

Rate limiter not working reliable when Memcached is installed in Nextcloud

• nextcloud security-advisories
• Authentication bypass

OAuth2 client_secret stored in plain text in the Nextcloud database

• nextcloud security-advisories
• Information disclosure

Require strict cookies for image proxy requests in Nextcloud Mail

• nextcloud security-advisories
• Server-side request forgery (SSRF)

Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint

• nextcloud security-advisories
• Authentication bypass

Missing password confirmation when creating app passwords

• nextcloud security-advisories
• Broken access control

Users can delete external storage mount points

• nextcloud security-advisories
• Broken access control

Text does not respect "Allow download" permissions

• nextcloud security-advisories
• Broken access control

Existence of calendars and address books can be checked by unauthenticated users

• nextcloud security-advisories
• Broken access control

Missing brute force protection on password reset token OAuth2 API controller

• nextcloud security-advisories
• Authentication bypass

Path traversal allows tricking the Talk Android app into writing files into it's root directory

• nextcloud security-advisories
• Path traversal

Notes attachment render HTML in preview mode

• nextcloud security-advisories
• Cross-site scripting (XSS)

user_oidc app stores client secret unencrypted in database

• nextcloud security-advisories
• Weak cryptography or TLS

Issuer not verified from obtained token in user_oidc

• nextcloud security-advisories
• Authentication bypass

Advanced permissions not respected when copying entire group folders

• nextcloud security-advisories
• Broken access control

Nextcloud user scoped external storage can be used to gather credentials of other users

• nextcloud security-advisories
• CWE-274

Nextcloud system addressbooks can be modified by malicious trusted server

• nextcloud security-advisories
• Broken access control

End-to-End encrypted file-drops can be made inaccessible

• nextcloud security-advisories
• Broken access control

Nextcloud Server password reset endpoint is not brute force protected

• nextcloud security-advisories
• Authentication bypass

Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning

• nextcloud security-advisories
• Open redirect