Skip to contentKiteworks Security-advisories vulnerabilities
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server admin_audit does not log all actions on files in groupfoldersCVE-2025-66552Fix available4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server users can modify tags on files that do not belong to themCVE-2025-66547Fix available4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to XSS in SVG images when opened outside of NextcloudCVE-2025-665125.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact listCVE-2025-66510Fix available4.5 Medium
- accellion kiteworks, kiteworks security-advisories +1 moreKiteworks Core is vulnerable to Improper Input ValidationCVE-2025-539396.3 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 moreKiteworks MFT has a Privilege Defined With Unsafe ActionsCVE-2025-539006.5 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 moreKiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication ChannelCVE-2025-538997.2 High
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 moreKiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-538976.8 Medium
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 moreKiteworks MFT is vulnerable to Insufficient Session ExpirationCVE-2025-538967.1 High
- kiteworks security-advisoriesNextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a tableCVE-2025-580516.5 Medium
- dracoon security-advisoriesDRACOON Branding Service vulnerable to Cross-site ScriptingCVE-2025-538394.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to insecure temporary file creation, race with write access and permissionCVE-2025-477942.6 Low
- nextcloud server, kiteworks security-advisories, nextcloud group folders +2 moreNextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text fileCVE-2025-477934.3 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop 3rdparty applications can create share links via socket APICVE-2025-47792Fix available5.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's test remote endpoint is not rate limitedCVE-2025-477914.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server doesn't request second factor after session timeoutCVE-2025-477906.4 Medium
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail app does not respect download permissions in sharesCVE-2024-525093.5 Low
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail auto configurator can be tricked into sending account information to wrong serversCVE-2024-525088.2 High
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is emptyCVE-2024-52510Public exploitFix available4.2 Medium
- nextcloud tables, kiteworks security-advisories +1 moreShare information of the Nextcloud Tables app is not limited to affected usersCVE-2024-525073.5 Low
- nextcloud tables, kiteworks security-advisories +1 moreNextcloud Tables has an Authorization Bypass Through User-Controlled Key in TablesCVE-2024-525116.3 Medium
- nextcloud user oidc, kiteworks security-advisories +1 moreNextcloud User OIDC has an open redirection when logging in with User OIDCCVE-2024-525123.3 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" sharesCVE-2024-525132.6 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server allows users to copy folder that contain files that are blocked by the files access controlCVE-2024-525144.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has incomplete sanitization of SVG files allows to embed other images into previewsCVE-2024-525155.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of themCVE-2024-525163.0 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's global credentials of external storages are sent back to the frontendCVE-2024-525174.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server is missing password confirmation when changing external storage optionsCVE-2024-525184.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's OAuth2 client secrets were stored in a recoverable wayCVE-2024-525192.7 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's link reference provider can be tricked into downloading bigger files than intendedCVE-2024-525205.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has a potential hash collision for background jobs could skip queuing themCVE-2024-525212.6 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server Custom defined credentials of external storages are sent back to the frontendCVE-2024-525234.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server User password is available in memory of the PHP processCVE-2024-525251.8 Low
- steeltoeoss discovery, kiteworks security-advisories +1 moreBasic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer AwarenessCVE-2024-40636Fix available5.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's events information leaked with shared calendars on recurrence exceptionsCVE-2024-378873.5 Low
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc's ID4me does not validate signature or expirationCVE-2024-378865.4 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreCode injection in Nextcloud Desktop Client for macOSCVE-2024-378853.8 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's users can delete old versions of read-only shared filesCVE-2024-378843.5 Low
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck can access comments and attachments of deleted cardsCVE-2024-378834.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server can reshare read&share only folder with more permissionsCVE-2024-378828.1 High
- nextcloud notes, kiteworks security-advisories +1 moreNextcloud Notes app can be tricked into using a received share created before the user logged inCVE-2024-373174.6 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreNextcloud Calendar's event create can create attachments that link to other websitesCVE-2024-373164.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's read-only users can restore old versionsCVE-2024-373153.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Photos' shared albums have no restriction on photo removalCVE-2024-373143.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud server allows the by-pass the second factorCVE-2024-373137.3 High
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc app's ID4me feature is available even when disabledCVE-2024-373126.3 Medium
- nextcloud guests, kiteworks security-advisories +1 moreImproper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlistCVE-2024-224025.4 Medium
- nextcloud guests, kiteworks security-advisories +1 moreAll users can reset the allowed apps list for Nextcloud Guest App usersCVE-2024-224014.1 Medium
- kiteworks security-advisories, nextcloud zipper +1 morePermissions bypass in Nextcloud with the files zip appCVE-2024-224044.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreOAuth2 authorization codes are valid indefinetly in Nextcloud serverCVE-2024-224033.0 Low
- Show moreLoading…