Advisories · Technology

nextcloud security-advisories.

Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-32726 CVE record

CVSS 7.1 High

Webauthn tokens not removed after user has been deleted
- nextcloud security-advisories
- CWE-708
Not analysed yet 12 Jul 2021
CVE-2021-32725 CVE record

CVSS 3.5 Low

Default share permissions not respected for federated reshares
- nextcloud security-advisories
- CWE-277
Not analysed yet 12 Jul 2021
CVE-2021-32707 CVE record

CVSS 4.3 Medium

Bypass of image blocking in Nextcloud Mail
- nextcloud security-advisories
- Information disclosure
- CWE-20
Not analysed yet 12 Jul 2021
CVE-2021-32689 CVE record

CVSS 8.1 High

Nextcloud Talk not properly disassociating users from chats after account deletion
- nextcloud security-advisories
- Information disclosure
- CWE-708
Not analysed yet 12 Jul 2021
CVE-2021-32705 CVE record

CVSS 5.3 Medium

Lack of ratelimit on public DAV endpoint
- nextcloud security-advisories
- CWE-799
Not analysed yet 12 Jul 2021
CVE-2021-32703 CVE record

CVSS 5.3 Medium

Lack of ratelimit on shareinfo endpoint
- nextcloud security-advisories
- CWE-799
Not analysed yet 12 Jul 2021
CVE-2021-32688 CVE record

CVSS 8.8 High

Application specific tokens can change their own scope
- nextcloud security-advisories
- Broken access control
Not analysed yet 12 Jul 2021
CVE-2021-32680 CVE record

CVSS 3.3 Low

Audit log is not properly logging unsetting of share expiration date
- nextcloud security-advisories
- CWE-778
Not analysed yet 12 Jul 2021
CVE-2021-32679 CVE record

CVSS 3.5 Low

Filenames not escaped by default in controllers using DownloadResponse
- nextcloud security-advisories
- CWE-116
Not analysed yet 12 Jul 2021
CVE-2021-32678 CVE record

CVSS 3.7 Low

Ratelimit not applied on OCS API responses
- nextcloud security-advisories
- CWE-799
Not analysed yet 12 Jul 2021
CVE-2021-32694 CVE record

CVSS 4.1 Medium

Malicious Android application can crash the Nextcloud Android Client
- nextcloud security-advisories
- CWE-248
Not analysed yet 17 Jun 2021
CVE-2021-32695 CVE record

CVSS 3.9 Low

Malicious Android app could access Shared Preferences of the Nextcloud Android client
- nextcloud security-advisories
- Information disclosure
Not analysed yet 17 Jun 2021
CVE-2021-32676 CVE record

CVSS 6.5 Medium

Session Fixation in Nextcloud Talk
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 16 Jun 2021
CVE-2021-32658 CVE record

CVSS 4.7 Medium

Sensitive data may not be removed from storage on account removal
- nextcloud security-advisories
- Information disclosure
Not analysed yet 8 Jun 2021
CVE-2021-32657 CVE record

CVSS 4.3 Medium

Malicious user could break user administration page
- nextcloud security-advisories
- Denial of service
Not analysed yet 1 Jun 2021
CVE-2021-32656 CVE record

CVSS 8.6 High

Trusted servers exchange can be triggered by attacker
- nextcloud security-advisories
- Broken access control
Not analysed yet 1 Jun 2021
CVE-2021-32655 CVE record

CVSS 3.5 Low

Files Drop public link can be added as federated share
- nextcloud security-advisories
- CWE-241
Not analysed yet 1 Jun 2021
CVE-2021-32654 CVE record

CVSS 8.1 High

Attacker can obtain write access to any federated share/public link
- nextcloud security-advisories
- Broken access control
Not analysed yet 1 Jun 2021
CVE-2021-32653 CVE record

CVSS 2.7 Low

Default settings leak federated cloud ID to lookup server of all users
- nextcloud security-advisories
- Information disclosure
Not analysed yet 1 Jun 2021
CVE-2021-32652 CVE record

CVSS 8.8 High

Missing permission check on email metadata retrieval
- nextcloud security-advisories
- Broken access control
Not analysed yet 1 Jun 2021