Skip to contentKiteworks Security-advisories vulnerabilities
- kiteworks security-advisories, nextcloud sso \& saml authentication +1 moreOpen redirect in user_saml via RelayState parameter in Nextcloud User SamlCVE-2024-224003.1 Low
- nextcloud deck, kiteworks security-advisories +1 moreCross-site Scripting when sending HTML as a comment in the Nextcloud Deck appCVE-2024-222130.0 None
- nextcloud global site selector, kiteworks security-advisories +1 moreNextcloud global site selector authentication bypassCVE-2024-222129.7 Critical
- nextcloud server, kiteworks security-advisories +1 moreBruteforce protection can be bypassed with misconfigured proxyCVE-2023-49792Public exploit5.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreWorkflows do not require password confirmation on API levelCVE-2023-497915.4 Medium
- nextcloud, kiteworks security-advisories +1 moreApp PIN code can be bypassed in Nextcloud Files iOSCVE-2023-49790Fix available4.3 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreCalendar app returns full stacktrace when an error happens while editing appointmentCVE-2023-483083.5 Low
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail app vulnerable to Server-Side Request ForgeryCVE-2023-483073.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRFCVE-2023-483065.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server user_ldap app logs user passwords in the log file on level debugCVE-2023-483054.2 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any userCVE-2023-483044.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server admins can change authentication details of user configured external storageCVE-2023-483032.4 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+VCVE-2023-483023.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server HTML injection in search UI when selecting a circle with HTML in the display nameCVE-2023-483013.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server users can make external storage mount points inaccessible for other usersCVE-2023-482398.5 High
- nextcloud calendar, kiteworks security-advisories +1 moreInviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsiveCVE-2023-451504.3 Medium
- nextcloud talk, kiteworks security-advisories +1 morePassword of talk conversations can be bruteforced in NextcloudCVE-2023-451494.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreRate limiter not working reliable when Memcached is installed in NextcloudCVE-2023-451484.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreOAuth2 client_secret stored in plain text in the Nextcloud databaseCVE-2023-451516.5 Medium
- nextcloud mail, kiteworks security-advisories +1 moreRequire strict cookies for image proxy requests in Nextcloud MailCVE-2023-456604.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpointCVE-2023-399605.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreMissing password confirmation when creating app passwordsCVE-2023-399638.1 High
- nextcloud server, kiteworks security-advisories +1 moreUsers can delete external storage mount pointsCVE-2023-399627.7 High
- nextcloud server, kiteworks security-advisories +1 moreText does not respect "Allow download" permissionsCVE-2023-399613.5 Low
- nextcloud server, kiteworks security-advisories +1 moreExistence of calendars and address books can be checked by unauthenticated usersCVE-2023-399593.5 Low
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token OAuth2 API controllerCVE-2023-399585.8 Medium
- nextcloud talk, kiteworks security-advisories +1 morePath traversal allows tricking the Talk Android app into writing files into it's root directoryCVE-2023-399577.2 High
- nextcloud notes, kiteworks security-advisories +1 moreNotes attachment render HTML in preview modeCVE-2023-399553.5 Low
- kiteworks security-advisories, nextcloud user oidc +1 moreuser_oidc app stores client secret unencrypted in databaseCVE-2023-399543.8 Low
- kiteworks security-advisories, nextcloud user oidc +1 moreIssuer not verified from obtained token in user_oidcCVE-2023-399534.8 Medium
- nextcloud server, kiteworks security-advisories +1 moreAdvanced permissions not respected when copying entire group foldersCVE-2023-399526.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud user scoped external storage can be used to gather credentials of other usersCVE-2023-359288.5 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud system addressbooks can be modified by malicious trusted serverCVE-2023-359277.6 High
- nextcloud end-to-end encryption, kiteworks security-advisories +1 moreEnd-to-End encrypted file-drops can be made inaccessibleCVE-2023-351735.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server password reset endpoint is not brute force protectedCVE-2023-351728.7 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to open redirect on "Unsupported browser" warningCVE-2023-351714.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's brute force protection allows someone to send more requests than intendedCVE-2023-323208.7 High
- nextcloud calendar, kiteworks security-advisories +1 moreError in calendar when booking an appointment reveals the full path of the websiteCVE-2023-331832.6 Low
- nextcloud contacts, kiteworks security-advisories +1 moreNextcloud Contacts photos only sanitized if mime type is all lower caseCVE-2023-331820.0 None
- nextcloud mail, kiteworks security-advisories +1 moreBlind SSRF in the Nextcloud Mail app on avatar endpointCVE-2023-331843.5 Low
- nextcloud server, kiteworks security-advisories +1 moreBasic auth header on WebDAV requests is not brute-force protected in NextcloudCVE-2023-323198.1 High
- nextcloud server, kiteworks security-advisories +1 moreUser session not correctly destroyed on logoutCVE-2023-323187.2 High
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc app is missing brute force protectionCVE-2023-320748.0 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server missing brute force protection for passwords of password protected share linksCVE-2023-288473.1 Low
- nextcloud talk, kiteworks security-advisories +1 moreChat poll data can still be queried from API after purging history in Nextcloud talkCVE-2023-305403.5 Low
- nextcloud files automated tagging, server, kiteworks security-advisories +2 moreUsers can set up workflows using restricted and invisible system tags in NextcloudCVE-2023-305396.5 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client does not verify received singed certificate in end-to-end encryptionCVE-2023-29000Fix available5.4 Medium
- nextcloud desktop, nextcloud, kiteworks security-advisories +2 moreNextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE foldersCVE-2023-28999Fix available6.9 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keysCVE-2023-28998Fix available6.7 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access filesCVE-2023-28997Fix available6.7 Medium
- Show moreLoading…