Skip to contentNextcloud Server vulnerabilities
- nextcloud server, kiteworks security-advisories +1 morePreview generation used third-party library not suited for user-generated content in Nextcloud serverCVE-2021-328029.3 Critical
- nextcloud server, kiteworks security-advisories +1 moreExceptions may have logged Encryption-at-Rest key content in Nextcloud serverCVE-2021-328015.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreBypass of Two Factor Authentication in Nextcloud serverCVE-2021-328008.1 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Text app can disclose existence of folders in "File Drop" link shareCVE-2021-327665.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreLack of ratelimit on public share link mount endpointCVE-2021-327415.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreFile path disclosure of shared files in Nextcloud Text applicationCVE-2021-327343.1 Low
- nextcloud server, kiteworks security-advisories +1 moreXSS in Nextcloud Text applicationCVE-2021-327334.8 Medium
- nextcloud server, kiteworks security-advisories +1 moreWebauthn tokens not removed after user has been deletedCVE-2021-327267.1 High
- nextcloud server, kiteworks security-advisories +1 moreDefault share permissions not respected for federated resharesCVE-2021-327253.5 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on public DAV endpointCVE-2021-327055.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on shareinfo endpointCVE-2021-327035.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreApplication specific tokens can change their own scopeCVE-2021-326888.8 High
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreAudit log is not properly logging unsetting of share expiration dateCVE-2021-326803.3 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreFilenames not escaped by default in controllers using DownloadResponseCVE-2021-326793.5 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreRatelimit not applied on OCS API responsesCVE-2021-326783.7 Low
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an atta…CVE-2021-229159.8 Critical
- nextcloud server, kiteworks security-advisories +1 moreMalicious user could break user administration pageCVE-2021-326574.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreTrusted servers exchange can be triggered by attackerCVE-2021-326568.6 High
- nextcloud server, kiteworks security-advisories +1 moreFiles Drop public link can be added as federated shareCVE-2021-326553.5 Low
- nextcloud server, kiteworks security-advisories +1 moreAttacker can obtain write access to any federated share/public linkCVE-2021-326548.1 High
- nextcloud server, kiteworks security-advisories +1 moreDefault settings leak federated cloud ID to lookup server of all usersCVE-2021-326532.7 Low
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external...CVE-2020-82966.7 Medium
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to...CVE-2021-228784.8 Medium
- fedoraproject fedora, hackerone nextcloud server, nextcloud server +2 moreA missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own...CVE-2021-228776.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreA missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of...CVE-2020-82945.4 Medium
- hackerone nextcloud server, nextcloud server +1 moreA wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when...CVE-2020-82957.5 High
- hackerone nextcloud server, nextcloud server +1 moreA missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to...CVE-2020-82936.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...CVE-2020-82598.1 High
- hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...CVE-2020-81524.4 Medium
- hackerone nextcloud server, nextcloud server +1 moreA wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed...CVE-2020-81335.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreA cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption...CVE-2020-81504.1 Medium
- hackerone nextcloud server, nextcloud server +1 moreA too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed...CVE-2020-81732.2 Low
- hackerone nextcloud server, nextcloud server +1 moreA wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless...CVE-2020-82366.8 Medium
- hackerone nextcloud server, nextcloud server +1 moreA logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it...CVE-2020-81837.5 High
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreA logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users...CVE-2020-82236.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreAn outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross...CVE-2020-81555.4 Medium
- hackerone nextcloud server, nextcloud server +1 moreAn Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker...CVE-2020-81547.7 High
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreA missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide...CVE-2020-81396.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreA missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14...CVE-2020-81386.5 Medium
- hackerone nextcloud server, nextcloud server +1 moreA missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the...CVE-2020-81224.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreA bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by...CVE-2020-81218.1 High
- hackerone nextcloud server, nextcloud server +1 moreA reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the...CVE-2020-81206.1 Medium
- hackerone nextcloud server, nextcloud server +1 moreImproper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a...CVE-2020-81194.3 Medium
- hackerone nextcloud server, nextcloud server, novell suse linux enterprise server +1 more +3 moreAn authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local...CVE-2020-81185.0 Medium
- hackerone nextcloud server, nextcloud server +1 moreImproper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be...CVE-2020-81174.3 Medium
- hackerone nextcloud server, nextcloud server, opensuse backports +1 more +3 moreImproper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs...CVE-2019-156244.9 Medium
- hackerone nextcloud server, nextcloud server, opensuse backports sle +1 more +3 moreExposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...CVE-2019-156235.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreImproper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare...CVE-2019-156216.5 Medium
- hackerone nextcloud server, nextcloud deck, server +1 more +3 moreImproper neutralization of file names, conversation names and board names in Nextcloud Server 16...CVE-2019-156194.8 Medium
- hackerone nextcloud server, nextcloud server +1 moreMissing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting...CVE-2019-156184.8 Medium
- Show moreLoading…