Hackerone vulnerabilities

Products

• Nextcloud Server 57
• Ruby 7
• Hapi Node Module 4
• Rubygems 4
• Sequelize Node Module 4
• Coffeescript Node Module 3
• Private Address Check Ruby Gem 3
• Aedes 2
• Crud-file-server Node Module 2
• Defaults-deep 2
• Express-cart 2
• Html-janitor Node Module 2
• I18next Node Module 2
• Marked Node Module 2
• Mpath 2
• M-server 2
• Remarkable Node Module 2
• Sanitize-html Node Module 2
• Serve Node Module 2
• Simplehttpserver 2
• Statics-server 2
• Url-parse 2
• Ws Node Module 2

Newest

• hackerone aedes Aedes has Uncaught Exception and Uncontrolled Resource Consumption CVE-2026-63341 7.5 HighOctober 30, 2026
• hackerone defaults-deep @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging CVE-2026-54737 Fix available 7.3 HighJuly 31, 2026
• hackerone ruby An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in... CVE-2026-46727 Fix available 8.1 HighMay 21, 2026
• hackerone mpath Prototype Pollution CVE-2021-23438 Fix available 5.6 MediumSeptember 1, 2021
• hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 more Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an atta… CVE-2021-22915 9.8 CriticalJune 11, 2021
• hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 more Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external... CVE-2020-8296 6.7 MediumMarch 3, 2021
• hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 more Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to... CVE-2021-22878 4.8 MediumMarch 3, 2021
• fedoraproject fedora, hackerone nextcloud server, nextcloud server +2 more A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own... CVE-2021-22877 6.5 MediumMarch 3, 2021
• hackerone nextcloud server, nextcloud server +1 more A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of... CVE-2020-8294 Fix available 5.4 MediumFebruary 3, 2021
• hackerone nextcloud server, nextcloud server +1 more A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when... CVE-2020-8295 Fix available 7.5 HighJanuary 26, 2021
• hackerone nextcloud server, nextcloud server +1 more A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to... CVE-2020-8293 Fix available 6.5 MediumJanuary 26, 2021
• hackerone nextcloud server, nextcloud server +1 more Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an... CVE-2020-8259 8.1 HighNovember 16, 2020
• hackerone nextcloud server, nextcloud server +1 more Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an... CVE-2020-8152 4.4 MediumNovember 16, 2020
• hackerone nextcloud server, nextcloud server +1 more A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed... CVE-2020-8133 5.3 MediumNovember 9, 2020
• hackerone nextcloud server, nextcloud server +1 more A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption... CVE-2020-8150 4.1 MediumNovember 9, 2020
• hackerone nextcloud server, nextcloud server +1 more A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed... CVE-2020-8173 2.2 LowOctober 30, 2020
• hackerone nextcloud server, nextcloud server +1 more A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless... CVE-2020-8236 6.8 MediumOctober 30, 2020
• hackerone nextcloud server, nextcloud server +1 more A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it... CVE-2020-8183 Fix available 7.5 HighOctober 10, 2020
• hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 more A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users... CVE-2020-8223 6.5 MediumOctober 5, 2020
• hackerone nextcloud server, nextcloud server +1 more An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross... CVE-2020-8155 Fix available 5.4 MediumMay 12, 2020
• hackerone nextcloud server, nextcloud server +1 more An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker... CVE-2020-8154 Fix available 7.7 HighMay 12, 2020
• hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 more A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide... CVE-2020-8139 6.5 MediumMarch 20, 2020
• hackerone nextcloud server, nextcloud server +1 more A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14... CVE-2020-8138 6.5 MediumMarch 20, 2020
• hackerone nextcloud server, nextcloud server +1 more A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the... CVE-2020-8122 4.3 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by... CVE-2020-8121 8.1 HighFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the... CVE-2020-8120 6.1 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a... CVE-2020-8119 Fix available 4.3 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server, novell suse linux enterprise server +1 more +3 more An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local... CVE-2020-8118 Fix available 5.0 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be... CVE-2020-8117 4.3 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server, opensuse backports +1 more +3 more Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs... CVE-2019-15624 Fix available 4.9 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server, opensuse backports sle +1 more +3 more Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain... CVE-2019-15623 Fix available 5.3 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare... CVE-2019-15621 Fix available 6.5 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud deck, server +1 more +3 more Improper neutralization of file names, conversation names and board names in Nextcloud Server 16... CVE-2019-15619 4.8 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting... CVE-2019-15618 4.8 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when... CVE-2019-15617 5.4 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. CVE-2019-15616 4.3 MediumFebruary 4, 2020
• hackerone nextcloud server, nextcloud server, opensuse backports +2 more A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file... CVE-2019-15613 Fix available 8.0 HighFebruary 4, 2020
• hackerone nextcloud server, nextcloud server +1 more A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the... CVE-2019-15612 5.9 MediumFebruary 4, 2020
• hackerone url-parse Improper Validation and Sanitization in url-parse CVE-2020-8124 Fix available 5.3 MediumFebruary 4, 2020
• hackerone statics-server Path Traversal in statics-server CVE-2019-15596 7.5 HighDecember 18, 2019
• hackerone ruby Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X... CVE-2011-3624 5.3 MediumNovember 26, 2019
• hackerone nextcloud server, nextcloud server +1 more A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event... CVE-2019-5449 4.3 MediumJuly 30, 2019
• hackerone airmax, edgemax, ui airos, edgemax firmware +2 more Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers... CVE-2017-0938 EPSS 21.0% 7.5 HighFebruary 12, 2019
• hackerone static-resource-server Path Traversal in simplehttpserver CVE-2018-16493 7.5 HighFebruary 1, 2019
• extend project extend Prototype Pollution in extend CVE-2018-16492 Public exploitFix available 9.8 CriticalFebruary 1, 2019
• dreamerslab node.extend Prototype Pollution in node.extend CVE-2018-16491 Fix available 9.8 CriticalFebruary 1, 2019
• hackerone mpath Prototype Pollution in mpath CVE-2018-16490 Fix available 7.5 HighFebruary 1, 2019
• hackerone just-extend Prototype Pollution in just-extend CVE-2018-16489 Fix available 9.8 CriticalFebruary 1, 2019
• hackerone lodash Prototype Pollution in lodash CVE-2018-16487 Fix available 5.6 MediumFebruary 1, 2019
• defaults-deep project defaults-deep Prototype Pollution in defaults-deep CVE-2018-16486 9.8 CriticalFebruary 1, 2019
• Show olderLoading…