Skip to contentNextcloud Server vulnerabilities
- nextcloud server, kiteworks security-advisories +1 moreText does not respect "Allow download" permissionsCVE-2023-399613.5 Low
- nextcloud server, kiteworks security-advisories +1 moreExistence of calendars and address books can be checked by unauthenticated usersCVE-2023-399593.5 Low
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token OAuth2 API controllerCVE-2023-399585.8 Medium
- nextcloud server, kiteworks security-advisories +1 moreAdvanced permissions not respected when copying entire group foldersCVE-2023-399526.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud user scoped external storage can be used to gather credentials of other usersCVE-2023-359288.5 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud system addressbooks can be modified by malicious trusted serverCVE-2023-359277.6 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server password reset endpoint is not brute force protectedCVE-2023-351728.7 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to open redirect on "Unsupported browser" warningCVE-2023-351714.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's brute force protection allows someone to send more requests than intendedCVE-2023-323208.7 High
- nextcloud server, kiteworks security-advisories +1 moreBasic auth header on WebDAV requests is not brute-force protected in NextcloudCVE-2023-323198.1 High
- nextcloud server, kiteworks security-advisories +1 moreUser session not correctly destroyed on logoutCVE-2023-323187.2 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server missing brute force protection for passwords of password protected share linksCVE-2023-288473.1 Low
- nextcloud files automated tagging, server, kiteworks security-advisories +2 moreUsers can set up workflows using restricted and invisible system tags in NextcloudCVE-2023-305396.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreFull path of data directory exposed to Nextcloud server usersCVE-2023-288343.5 Low
- nextcloud server, kiteworks security-advisories +1 moreUser without download rights can download older version of that file in nextcloud serverCVE-2023-288445.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreInsecure randomness for default password in nextcloudCVE-2023-288353.5 Low
- nextcloud server, kiteworks security-advisories +1 moreUnrestricted filenames for logo or favicon as admin in the theming settings in nextcloud serverCVE-2023-288332.4 Low
- nextcloud server, kiteworks security-advisories +1 moreReference fetch can saturate the server bandwidth for 10 seconds in nextcloud serverCVE-2023-286445.7 Medium
- nextcloud server, kiteworks security-advisories +1 morePotential share collision for recipients when caching is enabled in nextcloud serverCVE-2023-286435.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreScope of workflow operations is not validated in nextcloud serverCVE-2023-26482Public exploit9.1 Critical
- nextcloud server, kiteworks security-advisories +1 moreDelete permissions are not saved when creating public share in Nextcloud serverCVE-2023-258173.5 Low
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token in Nextcloud ServerCVE-2023-258185.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server and Enterprise Server missing brute force protection on password confirmation modalCVE-2023-258204.2 Medium
- kiteworks security-advisories, nextcloud server +1 moreNextcloud download permissions can be changed by resharerCVE-2023-258215.7 Medium
- kiteworks security-advisories, nextcloud server +1 morenextcloud vulnerable to Uncontrolled Resource ConsumptionCVE-2023-258164.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreDirectory traversal in Nextcloud serverCVE-2023-255796.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPsCVE-2023-251625.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsCVE-2023-251613.7 Low
- nextcloud server, richdocuments, kiteworks security-advisories +2 moreNextcloud Server previews are accessible without a watermarkCVE-2023-251592.3 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's disabled download shares still allow download through preview imagesCVE-2022-419702.6 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has no password length limit when creating a user as an administratorCVE-2022-419692.4 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's calendar name length not validated before writing to databaseCVE-2022-419683.5 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +1 more +3 moreMissing length validation of user displayname in nextcloud serverCVE-2022-393463.5 Low
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreException logging in Sharepoint app reveals clear-text connection detailsCVE-2022-393644.0 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreDatabase resource exhaustion for logged-in users via sharee recommendations with circlesCVE-2022-393304.8 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreProfile of disabled user stays accessibleCVE-2022-393293.5 Low
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreServer-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud ServerCVE-2022-392113.0 Low
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreAuthentication headers exposed on by Nextcloud ServerCVE-2022-360746.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreFederated share accepting/declining is not logged in audit log in Nextcloud ServerCVE-2022-311202.1 Low
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on cloud federation sharing in Nextcloud ServerCVE-2022-311186.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerCVE-2022-310145.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreImproper input-size validation on the user new session name in Nextcloud ServerCVE-2022-292434.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreBypass of password requirements when sharing a folder via the Circles app in Nextcloud ServerCVE-2022-291633.5 Low
- nextcloud server, kiteworks security-advisories +1 moreInsufficient Verification of Data Authenticity in Nextcloud ServerCVE-2022-248892.4 Low
- nextcloud server, kiteworks security-advisories +1 morePossible Injection in Nextcloud ServerCVE-2022-248884.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreMissing authorization in Nextcloud textCVE-2021-412336.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreHigh memory usage in Nextcloud serverCVE-2022-247413.5 Low
- nextcloud server, kiteworks security-advisories +1 moreAdvanced permissions is not respected for subfolders in Nextcloud serverCVE-2021-412414.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreUser enumeration setting not respected in Nextcloud serverCVE-2021-412395.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreRate-limits not working on instances without configured memory cache backendCVE-2021-411778.1 High
- Show moreLoading…