Skip to contentKiteworks Security-advisories vulnerabilities
- kiteworks security-advisories, nextcloud user oidc +1 moreCSRF protection on user_oidc login returned the expected token in case of an errorCVE-2023-288484.8 Medium
- nextcloud server, kiteworks security-advisories +1 moreFull path of data directory exposed to Nextcloud server usersCVE-2023-288343.5 Low
- nextcloud talk, kiteworks security-advisories +1 moreChat room membership disclosed via autocompletion in Nextcloud talkCVE-2023-288453.5 Low
- nextcloud server, kiteworks security-advisories +1 moreUser without download rights can download older version of that file in nextcloud serverCVE-2023-288445.7 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 moreSecure view can be bypassed by using internal API endpoint in Nextcloud richdocumentsCVE-2023-286455.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreInsecure randomness for default password in nextcloudCVE-2023-288353.5 Low
- nextcloud server, kiteworks security-advisories +1 moreUnrestricted filenames for logo or favicon as admin in the theming settings in nextcloud serverCVE-2023-288332.4 Low
- nextcloud server, kiteworks security-advisories +1 moreReference fetch can saturate the server bandwidth for 10 seconds in nextcloud serverCVE-2023-286445.7 Medium
- nextcloud server, kiteworks security-advisories +1 morePotential share collision for recipients when caching is enabled in nextcloud serverCVE-2023-286435.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreScope of workflow operations is not validated in nextcloud serverCVE-2023-26482Public exploit9.1 Critical
- nextcloud, kiteworks security-advisories +1 moreApp lockout in nextcloud Android app can be bypassed via thirdparty appsCVE-2023-28646Fix available4.4 Medium
- nextcloud, kiteworks security-advisories +1 moreApp pin of the iOS app can be bypassed in Nextcloud iOSCVE-2023-28647Fix available4.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreDelete permissions are not saved when creating public share in Nextcloud serverCVE-2023-258173.5 Low
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token in Nextcloud ServerCVE-2023-258185.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server and Enterprise Server missing brute force protection on password confirmation modalCVE-2023-258204.2 Medium
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk messages can still be seen on conversation after expiring when cron is misconfiguredCVE-2023-260412.6 Low
- kiteworks security-advisories, nextcloud server +1 moreNextcloud download permissions can be changed by resharerCVE-2023-258215.7 Medium
- kiteworks security-advisories, nextcloud server +1 morenextcloud vulnerable to Uncontrolled Resource ConsumptionCVE-2023-258164.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreDirectory traversal in Nextcloud serverCVE-2023-255796.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPsCVE-2023-251625.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsCVE-2023-251613.7 Low
- nextcloud mail, kiteworks security-advisories +1 moreIDOR Vulnerability in Nextcloud MailCVE-2023-251604.1 Medium
- nextcloud server, richdocuments, kiteworks security-advisories +2 moreNextcloud Server previews are accessible without a watermarkCVE-2023-251592.3 Low
- nextcloud richdocuments, kiteworks security-advisories +1 moreDocument content of files can be obtained through Collabora for files of other usersCVE-2023-251505.8 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreSelf reflected HTML injection in Desktop clientCVE-2023-23942Fix available5.4 Medium
- nextcloud mail, kiteworks security-advisories +1 moreBlind SSRF via server URL input in the Nextcloud Mail appCVE-2023-239435.0 Medium
- nextcloud mail, kiteworks security-advisories +1 moreNexcloud Mail app temporarily stores cleartext password in databaseCVE-2023-239442.0 Low
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck vulnerable to authorization bypassCVE-2023-224713.5 Low
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck vulnerable to uncontrolled resource consumptionCVE-2023-224703.5 Low
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cacheCVE-2023-224695.8 Medium
- nextcloud talk, kiteworks security-advisories +1 morePasscode bypass on Talk-Android appCVE-2023-224732.1 Low
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious linkCVE-2023-22472Fix available5.3 Medium
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk guests can continue to receive video streams from call after being removed from a conversationCVE-2022-419714.8 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's disabled download shares still allow download through preview imagesCVE-2022-419702.6 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has no password length limit when creating a user as an administratorCVE-2022-419692.4 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's calendar name length not validated before writing to databaseCVE-2022-419683.5 Low
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk Android broadcast incorrect permission handlingCVE-2022-419263.3 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +1 more +3 moreMissing length validation of user displayname in nextcloud serverCVE-2022-393463.5 Low
- nextcloud openid connect user backend, kiteworks security-advisories +1 moreCleartext Transmission of Sensitive Information in user_oidcCVE-2022-393394.3 Medium
- nextcloud openid connect user backend, kiteworks security-advisories +1 moreStored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidcCVE-2022-393383.5 Low
- nextcloud desktop, kiteworks security-advisories +1 morenextcloudcmd incorrectly trusts bad TLS certificatesCVE-2022-39334Fix available3.9 Low
- nextcloud desktop, kiteworks security-advisories +1 moreCross-site scripting (XSS) in Nextcloud Desktop ClientCVE-2022-39333Fix available4.6 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreCross-site scripting (XSS) in Nextcloud Desktop ClientCVE-2022-39332Fix available4.6 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreCross-site Scripting (XSS) in Nexcloud Desktop ClientCVE-2022-39331Fix available4.6 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop vulnerable to code injection via malicious linkCVE-2022-41882Fix available6.6 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreException logging in Sharepoint app reveals clear-text connection detailsCVE-2022-393644.0 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreDatabase resource exhaustion for logged-in users via sharee recommendations with circlesCVE-2022-393304.8 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreProfile of disabled user stays accessibleCVE-2022-393293.5 Low
- nextcloud talk, kiteworks security-advisories +1 moreLast video frame is still sent after video is disabled in a call in Nextcloud TalkCVE-2022-392124.3 Medium
- nextcloud, kiteworks security-advisories +1 moreAccess to internal files of the Nextcloud Android appCVE-2022-39210Fix available3.2 Low
- Show moreLoading…