Advisories · Technology

nextcloud security-advisories.

Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-39330 CVE record

CVSS 4.8 Medium

Database resource exhaustion for logged-in users via sharee recommendations with circles
- nextcloud security-advisories
- Denial of service
Not analysed yet 27 Oct 2022
CVE-2022-39329 CVE record

CVSS 3.5 Low

Profile of disabled user stays accessible
- nextcloud security-advisories
- Broken access control
Not analysed yet 27 Oct 2022
CVE-2022-39212 CVE record

CVSS 4.3 Medium

Last video frame is still sent after video is disabled in a call in Nextcloud Talk
- nextcloud security-advisories
- Information disclosure
Not analysed yet 16 Sept 2022
CVE-2022-39210 CVE record

CVSS 3.2 Low

Access to internal files of the Nextcloud Android app
- nextcloud security-advisories
- Path traversal
- Information disclosure
Not analysed yet 16 Sept 2022
CVE-2022-39211 CVE record

CVSS 3.0 Low

Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
- nextcloud security-advisories
- Server-side request forgery (SSRF)
Not analysed yet 16 Sept 2022
CVE-2022-36074 CVE record

CVSS 6.4 Medium

Authentication headers exposed on by Nextcloud Server
- nextcloud security-advisories
- Information disclosure
Not analysed yet 15 Sept 2022
CVE-2022-36075 CVE record

CVSS 2.6 Low

File list exposure in Nextcloud Files Access Control
- nextcloud security-advisories
- Information disclosure
Not analysed yet 15 Sept 2022
CVE-2022-35931 CVE record

CVSS 2.7 Low

Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator
- nextcloud security-advisories
- CWE-261
Not analysed yet 6 Sept 2022
CVE-2022-35932 CVE record

CVSS 3.5 Low

Missing rate limit when trying to join a password protected Nextcloud Talk conversation
- nextcloud security-advisories
- Information disclosure
Not analysed yet 12 Aug 2022
CVE-2022-31119 CVE record

CVSS 3.1 Low

Password disclosure in log file in Nextcloud Mail App
- nextcloud security-advisories
- Information disclosure
Not analysed yet 4 Aug 2022
CVE-2022-31132 CVE record

CVSS 8.3 High

Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
- nextcloud security-advisories
- Server-side request forgery (SSRF)
Not analysed yet 4 Aug 2022
CVE-2022-31120 CVE record

CVSS 2.1 Low

Federated share accepting/declining is not logged in audit log in Nextcloud Server
- nextcloud security-advisories
- CWE-778
Not analysed yet 4 Aug 2022
CVE-2022-31118 CVE record

CVSS 6.5 Medium

Missing brute force protection on cloud federation sharing in Nextcloud Server
- nextcloud security-advisories
- Denial of service
Not analysed yet 4 Aug 2022
CVE-2022-31131 CVE record

CVSS 5.4 Medium

Ownership check missing when updating or deleting mail attachments in Nextcloud mail
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 6 Jul 2022
CVE-2022-31014 CVE record

CVSS 5.4 Medium

SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server
- nextcloud security-advisories
- Other injection
Not analysed yet 5 Jul 2022
CVE-2022-31024 CVE record

CVSS 6.5 Medium

Federated editing allows iframing remote servers by default in richdocuments
- nextcloud security-advisories
- Broken access control
- CWE-346
Not analysed yet 2 Jun 2022
CVE-2022-29243 CVE record

CVSS 4.3 Medium

Improper input-size validation on the user new session name in Nextcloud Server
- nextcloud security-advisories
- Denial of service
- CWE-20
Not analysed yet 31 May 2022
CVE-2022-29163 CVE record

CVSS 3.5 Low

Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server
- nextcloud security-advisories
- CWE-671
Not analysed yet 20 May 2022
CVE-2022-29160 CVE record

CVSS 2.8 Low

Sensitive files/data exist after deletion of user account in Nextcloud Android
- nextcloud security-advisories
- Broken access control
Not analysed yet 20 May 2022
CVE-2022-24906 CVE record

CVSS 3.5 Low

Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
- nextcloud security-advisories
- Information disclosure
Not analysed yet 20 May 2022
CVE-2022-29159 CVE record

CVSS 5.0 Medium

Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck
- nextcloud security-advisories
- Broken access control
Not analysed yet 20 May 2022
CVE-2022-24890 CVE record

CVSS 2.4 Low

Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk
- nextcloud security-advisories
- Information disclosure
Not analysed yet 17 May 2022
CVE-2022-24889 CVE record

CVSS 2.4 Low

Insufficient Verification of Data Authenticity in Nextcloud Server
- nextcloud security-advisories
- CWE-345
Not analysed yet 27 Apr 2022
CVE-2022-24888 CVE record

CVSS 4.3 Medium

Possible Injection in Nextcloud Server
- nextcloud security-advisories
- Other injection
Not analysed yet 27 Apr 2022
CVE-2022-24887 CVE record

CVSS 4.3 Medium

Open Redirect in Nextcloud Talk
- nextcloud security-advisories
- Open redirect
Not analysed yet 27 Apr 2022
CVE-2022-24886 CVE record

CVSS 2.2 Low

Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
- nextcloud security-advisories
- Information disclosure
Not analysed yet 27 Apr 2022
CVE-2022-24885 CVE record

CVSS 2.0 Low

Improper Authentication in Nextcloud Android Files
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 27 Apr 2022
CVE-2022-24838 CVE record

CVSS 5.3 Medium

Command Injection in Appointment Emails for Nextcloud Calendar
- nextcloud security-advisories
- Other injection
Not analysed yet 11 Apr 2022
CVE-2021-41233 CVE record

CVSS 6.5 Medium

Missing authorization in Nextcloud text
- nextcloud security-advisories
- Broken access control
Not analysed yet 10 Mar 2022
CVE-2022-24741 CVE record

CVSS 3.5 Low

High memory usage in Nextcloud server
- nextcloud security-advisories
- Denial of service
Not analysed yet 9 Mar 2022
CVE-2021-41241 CVE record

CVSS 4.3 Medium

Advanced permissions is not respected for subfolders in Nextcloud server
- nextcloud security-advisories
- Broken access control
Not analysed yet 8 Mar 2022
CVE-2021-41239 CVE record

CVSS 5.3 Medium

User enumeration setting not respected in Nextcloud server
- nextcloud security-advisories
- Information disclosure
Not analysed yet 8 Mar 2022
CVE-2021-41181 CVE record

CVSS 2.4 Low

Nextcloud Talk app exposes chat messages on lockscreen
- nextcloud security-advisories
- Information disclosure
Not analysed yet 8 Mar 2022
CVE-2021-41180 CVE record

CVSS 4.7 Medium

Geolocation preview links can be set to arbitrary links in nextcloud talk
- nextcloud security-advisories
- Open redirect
Not analysed yet 8 Mar 2022
CVE-2021-41166 CVE record

CVSS 4.3 Medium

Permission bypass in Nextcloud Android App
- nextcloud security-advisories
- Broken access control
Not analysed yet 26 Jan 2022
CVE-2021-39222 CVE record

CVSS 6.4 Medium

XSS in Talk
- nextcloud security-advisories
- Cross-site scripting (XSS)
- Unrestricted file upload
Not analysed yet 15 Nov 2021
CVE-2021-41179 CVE record

CVSS 6.5 Medium

Two-Factor Authentication not enforced for pages marked as public
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 25 Oct 2021
CVE-2021-41178 CVE record

CVSS 8.8 High

File Traversal affecting SVG files on Nextcloud Server
- nextcloud security-advisories
- Path traversal
- Unrestricted file upload
Not analysed yet 25 Oct 2021
CVE-2021-41177 CVE record

CVSS 8.1 High

Rate-limits not working on instances without configured memory cache backend
- nextcloud security-advisories
- CWE-799
Not analysed yet 25 Oct 2021
CVE-2021-39224 CVE record

CVSS 3.5 Low

File path disclosure of shared files in OfficeOnline application
- nextcloud security-advisories
- Information disclosure
Not analysed yet 25 Oct 2021
CVE-2021-39225 CVE record

CVSS 8.1 High

Missing permission check on Deck API
- nextcloud security-advisories
- Broken access control
Not analysed yet 25 Oct 2021
CVE-2021-39223 CVE record

CVSS 4.8 Medium

File path disclosure of shared files in Richdocuments application
- nextcloud security-advisories
- Information disclosure
Not analysed yet 25 Oct 2021
CVE-2021-39221 CVE record

CVSS 6.4 Medium

XSS in Contacts
- nextcloud security-advisories
- Cross-site scripting (XSS)
- Unrestricted file upload
Not analysed yet 25 Oct 2021
CVE-2021-39220 CVE record

CVSS 3.5 Low

Bypass of image blocking in Nextcloud Mail
- nextcloud security-advisories
- Information disclosure
- CWE-20
Not analysed yet 25 Oct 2021
CVE-2021-32802 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Preview generation used third-party library not suited for user-generated content in Nextcloud server
- nextcloud security-advisories
- CWE-829
Not analysed yet 7 Sept 2021
CVE-2021-32801 CVE record

CVSS 5.5 Medium

Exceptions may have logged Encryption-at-Rest key content in Nextcloud server
- nextcloud security-advisories
- Information disclosure
Not analysed yet 7 Sept 2021
CVE-2021-32800 CVE record

CVSS 8.1 High

Bypass of Two Factor Authentication in Nextcloud server
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 7 Sept 2021
CVE-2021-32766 CVE record

CVSS 5.3 Medium

Nextcloud Text app can disclose existence of folders in "File Drop" link share
- nextcloud security-advisories
- Information disclosure
Not analysed yet 7 Sept 2021
CVE-2021-37629 CVE record

CVSS 5.3 Medium

Lack of ratelimit on Richdocuments OCS endpoint in nextcloud
- nextcloud security-advisories
- Information disclosure
Not analysed yet 7 Sept 2021
CVE-2021-37628 CVE record

CVSS 7.5 High

File Drop can be bypassed using Richdocuments app in nextcloud
- nextcloud security-advisories
- Broken access control
Not analysed yet 7 Sept 2021
CVE-2021-32782 CVE record

CVSS 5.8 Medium

Cross-Site Scripting in Nextcloud Circles
- nextcloud security-advisories
- Cross-site scripting (XSS)
Not analysed yet 7 Sept 2021
CVE-2021-37630 CVE record

CVSS 6.5 Medium

Secret Circle can be joined without approval in Nextcloud Circles
- nextcloud security-advisories
- Broken access control
Not analysed yet 7 Sept 2021
CVE-2021-37631 CVE record

CVSS 6.5 Medium

Circle can be accessed by non-Circle members in Nextcloud Deck
- nextcloud security-advisories
- Broken access control
Not analysed yet 7 Sept 2021
CVE-2021-37617 CVE record

CVSS 7.3 High

Untrusted Search Path in Nextcloud Desktop Client
- nextcloud security-advisories
- CWE-426
Not analysed yet 18 Aug 2021
CVE-2021-32728 CVE record

CVSS 6.5 Medium

End-to-end encryption device setup did not verify public key
- nextcloud security-advisories
- Weak cryptography or TLS
Not analysed yet 18 Aug 2021
CVE-2021-32748 CVE record

CVSS 4.3 Medium

WOPI API not protected by credentials/IP check
- nextcloud security-advisories
- Broken access control
Not analysed yet 27 Jul 2021
CVE-2021-32741 CVE record

CVSS 5.3 Medium

Lack of ratelimit on public share link mount endpoint
- nextcloud security-advisories
- CWE-799
Not analysed yet 12 Jul 2021
CVE-2021-32734 CVE record

CVSS 3.1 Low

File path disclosure of shared files in Nextcloud Text application
- nextcloud security-advisories
- Information disclosure
Not analysed yet 12 Jul 2021
CVE-2021-32733 CVE record

CVSS 4.8 Medium

XSS in Nextcloud Text application
- nextcloud security-advisories
- Cross-site scripting (XSS)
Not analysed yet 12 Jul 2021
CVE-2021-32727 CVE record

CVSS 5.7 Medium

End-to-end encryption device setup did not verify public key
- nextcloud security-advisories
- Weak cryptography or TLS
Not analysed yet 12 Jul 2021