Advisories · Technology

nextcloud security-advisories.

Every CVE that names nextcloud security-advisories among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-32320 CVE record

CVSS 8.7 High

Nextcloud Server's brute force protection allows someone to send more requests than intended
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 22 Jun 2023
CVE-2023-33183 CVE record

CVSS 2.6 Low

Error in calendar when booking an appointment reveals the full path of the website
- nextcloud security-advisories
- Broken access control
Not analysed yet 30 May 2023
CVE-2023-33182 CVE record

CVSS 0.0 None

Nextcloud Contacts photos only sanitized if mime type is all lower case
- nextcloud security-advisories
- CWE-20
Not analysed yet 30 May 2023
CVE-2023-33184 CVE record

CVSS 3.5 Low

Blind SSRF in the Nextcloud Mail app on avatar endpoint
- nextcloud security-advisories
- Server-side request forgery (SSRF)
Not analysed yet 27 May 2023
CVE-2023-32319 CVE record

CVSS 8.1 High

Basic auth header on WebDAV requests is not brute-force protected in Nextcloud
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 26 May 2023
CVE-2023-32318 CVE record

CVSS 7.2 High

User session not correctly destroyed on logout
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 26 May 2023
CVE-2023-32074 CVE record

CVSS 8.0 High

Nextcloud user_oidc app is missing brute force protection
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 25 May 2023
CVE-2023-28847 CVE record

CVSS 3.1 Low

Nextcloud Server missing brute force protection for passwords of password protected share links
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 25 Apr 2023
CVE-2023-30540 CVE record

CVSS 3.5 Low

Chat poll data can still be queried from API after purging history in Nextcloud talk
- nextcloud security-advisories
- Information disclosure
Not analysed yet 17 Apr 2023
CVE-2023-30539 CVE record

CVSS 6.5 Medium

Users can set up workflows using restricted and invisible system tags in Nextcloud
- nextcloud security-advisories
- Broken access control
Not analysed yet 17 Apr 2023
CVE-2023-29000 CVE record

CVSS 5.4 Medium

Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption
- nextcloud security-advisories
- Weak cryptography or TLS
Not analysed yet 4 Apr 2023
CVE-2023-28999 CVE record

CVSS 6.9 Medium

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
- nextcloud security-advisories
- CWE-325
Not analysed yet 4 Apr 2023
CVE-2023-28998 CVE record

CVSS 6.7 Medium

Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys
- nextcloud security-advisories
- CWE-325
Not analysed yet 4 Apr 2023
CVE-2023-28997 CVE record

CVSS 6.7 Medium

Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files
- nextcloud security-advisories
- CWE-323
Not analysed yet 4 Apr 2023
CVE-2023-28848 CVE record

CVSS 4.8 Medium

CSRF protection on user_oidc login returned the expected token in case of an error
- nextcloud security-advisories
- Cross-site request forgery (CSRF)
Not analysed yet 4 Apr 2023
CVE-2023-28834 CVE record

CVSS 3.5 Low

Full path of data directory exposed to Nextcloud server users
- nextcloud security-advisories
- CWE-212
Not analysed yet 3 Apr 2023
CVE-2023-28845 CVE record

CVSS 3.5 Low

Chat room membership disclosed via autocompletion in Nextcloud talk
- nextcloud security-advisories
- Broken access control
Not analysed yet 31 Mar 2023
CVE-2023-28844 CVE record

CVSS 5.7 Medium

User without download rights can download older version of that file in nextcloud server
- nextcloud security-advisories
- Broken access control
Not analysed yet 31 Mar 2023
CVE-2023-28645 CVE record

CVSS 5.7 Medium

Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
- nextcloud security-advisories
- Broken access control
Not analysed yet 31 Mar 2023
CVE-2023-28835 CVE record

CVSS 3.5 Low

Insecure randomness for default password in nextcloud
- nextcloud security-advisories
- Weak cryptography or TLS
Not analysed yet 30 Mar 2023
CVE-2023-28833 CVE record

CVSS 2.4 Low

Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server
- nextcloud security-advisories
- Path traversal
Not analysed yet 30 Mar 2023
CVE-2023-28644 CVE record

CVSS 5.7 Medium

Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server
- nextcloud security-advisories
- Denial of service
Not analysed yet 30 Mar 2023
CVE-2023-28643 CVE record

CVSS 5.5 Medium

Potential share collision for recipients when caching is enabled in nextcloud server
- nextcloud security-advisories
- CWE-706
Not analysed yet 30 Mar 2023
CVE-2023-26482 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Scope of workflow operations is not validated in nextcloud server
- nextcloud security-advisories
- Command injection
Not analysed yet 30 Mar 2023
CVE-2023-28646 CVE record

CVSS 4.4 Medium

App lockout in nextcloud Android app can be bypassed via thirdparty apps
- nextcloud security-advisories
- Authentication bypass
- CWE-281
Not analysed yet 30 Mar 2023
CVE-2023-28647 CVE record

CVSS 4.4 Medium

App pin of the iOS app can be bypassed in Nextcloud iOS
- nextcloud security-advisories
- Authentication bypass
- CWE-281
Not analysed yet 30 Mar 2023
CVE-2023-25817 CVE record

CVSS 3.5 Low

Delete permissions are not saved when creating public share in Nextcloud server
- nextcloud security-advisories
- CWE-281
Not analysed yet 27 Mar 2023
CVE-2023-25818 CVE record

CVSS 5.3 Medium

Missing brute force protection on password reset token in Nextcloud Server
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 27 Mar 2023
CVE-2023-25820 CVE record

CVSS 4.2 Medium

Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal
- nextcloud security-advisories
- Authentication bypass
Not analysed yet 22 Mar 2023
CVE-2023-26041 CVE record

CVSS 2.6 Low

Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
- nextcloud security-advisories
- Information disclosure
Not analysed yet 27 Feb 2023
CVE-2023-25821 CVE record

CVSS 5.7 Medium

Nextcloud download permissions can be changed by resharer
- nextcloud security-advisories
- Broken access control
Not analysed yet 24 Feb 2023
CVE-2023-25816 CVE record

CVSS 4.3 Medium

nextcloud vulnerable to Uncontrolled Resource Consumption
- nextcloud security-advisories
- Denial of service
Not analysed yet 24 Feb 2023
CVE-2023-25579 CVE record

CVSS 6.0 Medium

Directory traversal in Nextcloud server
- nextcloud security-advisories
- Path traversal
Not analysed yet 22 Feb 2023
CVE-2023-25162 CVE record

CVSS 5.3 Medium

Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs
- nextcloud security-advisories
- Server-side request forgery (SSRF)
Not analysed yet 13 Feb 2023
CVE-2023-25161 CVE record

CVSS 3.7 Low

Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails
- nextcloud security-advisories
- Broken access control
Not analysed yet 13 Feb 2023
CVE-2023-25160 CVE record

CVSS 4.1 Medium

IDOR Vulnerability in Nextcloud Mail
- nextcloud security-advisories
- Broken access control
Not analysed yet 13 Feb 2023
CVE-2023-25159 CVE record

CVSS 2.3 Low

Nextcloud Server previews are accessible without a watermark
- nextcloud security-advisories
- Broken access control
Not analysed yet 13 Feb 2023
CVE-2023-25150 CVE record

CVSS 5.8 Medium

Document content of files can be obtained through Collabora for files of other users
- nextcloud security-advisories
- Broken access control
Not analysed yet 8 Feb 2023
CVE-2023-23942 CVE record

CVSS 5.4 Medium

Self reflected HTML injection in Desktop client
- nextcloud security-advisories
- Cross-site scripting (XSS)
Not analysed yet 6 Feb 2023
CVE-2023-23943 CVE record

CVSS 5.0 Medium

Blind SSRF via server URL input in the Nextcloud Mail app
- nextcloud security-advisories
- Server-side request forgery (SSRF)
Not analysed yet 6 Feb 2023
CVE-2023-23944 CVE record

CVSS 2.0 Low

Nexcloud Mail app temporarily stores cleartext password in database
- nextcloud security-advisories
- Information disclosure
Not analysed yet 6 Feb 2023
CVE-2023-22471 CVE record

CVSS 3.5 Low

Nextcloud Deck vulnerable to authorization bypass
- nextcloud security-advisories
- Broken access control
Not analysed yet 14 Jan 2023
CVE-2023-22470 CVE record

CVSS 3.5 Low

Nextcloud Deck vulnerable to uncontrolled resource consumption
- nextcloud security-advisories
- Denial of service
Not analysed yet 14 Jan 2023
CVE-2023-22469 CVE record

CVSS 5.8 Medium

Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache
- nextcloud security-advisories
- Information disclosure
Not analysed yet 10 Jan 2023
CVE-2023-22473 CVE record

CVSS 2.1 Low

Passcode bypass on Talk-Android app
- nextcloud security-advisories
- Broken access control
Not analysed yet 9 Jan 2023
CVE-2023-22472 CVE record

CVSS 5.3 Medium

Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link
- nextcloud security-advisories
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jan 2023
CVE-2022-41971 CVE record

CVSS 4.8 Medium

Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation
- nextcloud security-advisories
- Information disclosure
Not analysed yet 1 Dec 2022
CVE-2022-41970 CVE record

CVSS 2.6 Low

Nextcloud Server's disabled download shares still allow download through preview images
- nextcloud security-advisories
- Broken access control
Not analysed yet 1 Dec 2022
CVE-2022-41969 CVE record

CVSS 2.4 Low

Nextcloud Server has no password length limit when creating a user as an administrator
- nextcloud security-advisories
- Denial of service
Not analysed yet 1 Dec 2022
CVE-2022-41968 CVE record

CVSS 3.5 Low

Nextcloud Server's calendar name length not validated before writing to database
- nextcloud security-advisories
- Denial of service
Not analysed yet 1 Dec 2022
CVE-2022-41926 CVE record

CVSS 3.3 Low

Nextcloud Talk Android broadcast incorrect permission handling
- nextcloud security-advisories
- Information disclosure
- Broken access control
Not analysed yet 25 Nov 2022
CVE-2022-39346 CVE record

CVSS 3.5 Low

Missing length validation of user displayname in nextcloud server
- nextcloud security-advisories
- Denial of service
- CWE-20
Not analysed yet 25 Nov 2022
CVE-2022-39339 CVE record

CVSS 4.3 Medium

Cleartext Transmission of Sensitive Information in user_oidc
- nextcloud security-advisories
- Weak cryptography or TLS
Not analysed yet 25 Nov 2022
CVE-2022-39338 CVE record

CVSS 3.5 Low

Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc
- nextcloud security-advisories
- Cross-site scripting (XSS)
- CWE-20
Not analysed yet 25 Nov 2022
CVE-2022-39334 CVE record

CVSS 3.9 Low

nextcloudcmd incorrectly trusts bad TLS certificates
- nextcloud security-advisories
- Weak cryptography or TLS
Not analysed yet 25 Nov 2022
CVE-2022-39333 CVE record

CVSS 4.6 Medium

Cross-site scripting (XSS) in Nextcloud Desktop Client
- nextcloud security-advisories
- Cross-site scripting (XSS)
Not analysed yet 25 Nov 2022
CVE-2022-39332 CVE record

CVSS 4.6 Medium

Cross-site scripting (XSS) in Nextcloud Desktop Client
- nextcloud security-advisories
- Cross-site scripting (XSS)
Not analysed yet 25 Nov 2022
CVE-2022-39331 CVE record

CVSS 4.6 Medium

Cross-site Scripting (XSS) in Nexcloud Desktop Client
- nextcloud security-advisories
- Cross-site scripting (XSS)
Not analysed yet 25 Nov 2022
CVE-2022-41882 CVE record

CVSS 6.6 Medium

Nextcloud Desktop vulnerable to code injection via malicious link
- nextcloud security-advisories
- Code injection
Not analysed yet 11 Nov 2022
CVE-2022-39364 CVE record

CVSS 4.0 Medium

Exception logging in Sharepoint app reveals clear-text connection details
- nextcloud security-advisories
- Information disclosure
Not analysed yet 27 Oct 2022