Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Vendors
Nextcloud

Nextcloud vulnerabilities

Products

Security-advisories260
Server189
Nextcloud30
Desktop27
Talk20
Deck18
Mail16
Server15
Server11
Calendar10
Tables10
Flow9
Richdocuments9
User Oidc9
Contacts7
Com.nextcloud.client6
Enterprise Server6
Approval4
Circles3
Group Folders3
Collectives2
End-to-end Encryption2
Guests2
News2
Mail2
Talk2
Notes2
Openid Connect User Backend2
Preferred Providers2
Social2

Newest

Known exploitedIn KEVPublic exploitFix available

hackerone nextcloud server, nextcloud server, opensuse backports sle +1 more +3 moreExposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...CVE-2019-156235.3 MediumFebruary 4, 2020
nextcloudNot strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get...CVE-2019-156222.4 LowFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreImproper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare...CVE-2019-156216.5 MediumFebruary 4, 2020
nextcloud talkImproper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private...CVE-2019-156202.7 LowFebruary 4, 2020
hackerone nextcloud server, nextcloud deck, server +1 more +3 moreImproper neutralization of file names, conversation names and board names in Nextcloud Server 16...CVE-2019-156194.8 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreMissing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting...CVE-2019-156184.8 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreA missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when...CVE-2019-156175.4 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreDangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.CVE-2019-156164.3 MediumFebruary 4, 2020
nextcloudA wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection...CVE-2019-156156.1 MediumFebruary 4, 2020
nextcloudMissing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.CVE-2019-156145.4 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server, opensuse backports +2 moreA bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file...CVE-2019-15613Fix available8.0 HighFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreA bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the...CVE-2019-156125.9 MediumFebruary 4, 2020
nextcloudViolation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and...CVE-2019-156114.9 MediumFebruary 4, 2020
nextcloud circlesImproper authorization in the Circles app 0.17.7 causes retaining access when an email address...CVE-2019-156104.3 MediumFebruary 4, 2020
nextcloud lookup-serverAn SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com...CVE-2019-54769.8 CriticalAugust 7, 2019
hackerone nextcloud server, nextcloud server +1 moreA missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event...CVE-2019-54494.3 MediumJuly 30, 2019
nextcloud, nextcloud com.nextcloud.client +1 moreImproper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3...CVE-2019-54506.8 MediumJuly 30, 2019
nextcloud com.nextcloud.client, server +1 moreBypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the...CVE-2019-54514.6 MediumJuly 30, 2019
nextcloud, nextcloud com.nextcloud.client +1 moreBypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of...CVE-2019-54522.4 LowJuly 30, 2019
nextcloud, nextcloud com.nextcloud.client +1 moreBypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to...CVE-2019-54536.1 MediumJuly 30, 2019
nextcloud, nextcloud com.nextcloud.client +1 moreSQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache...CVE-2019-5454Public exploit9.8 CriticalJuly 30, 2019
nextcloud, nextcloud com.nextcloud.client +1 moreBypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and...CVE-2019-54556.8 MediumJuly 30, 2019
nextcloud extractlib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows...CVE-2019-127399.0 CriticalJune 5, 2019
hackerone nextcloud server, nextcloud server +1 moreA missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the...CVE-2018-164675.3 MediumOctober 30, 2018
hackerone nextcloud server, nextcloud server +1 moreImproper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead...CVE-2018-164668.1 HighOctober 30, 2018
hackerone nextcloud server, nextcloud server +1 moreMissing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at...CVE-2018-164655.3 MediumOctober 30, 2018
hackerone nextcloud server, nextcloud server +1 moreA missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to...CVE-2018-164645.7 MediumOctober 30, 2018
hackerone nextcloud server, nextcloud server +1 moreA bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could...CVE-2018-164633.1 LowOctober 30, 2018
nextcloud talk, nextcloud/talk +1 moreA missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could...CVE-2018-37815.4 MediumAugust 13, 2018
nextcloud server, nextcloud/server +1 moreA missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5...CVE-2018-3780Fix available5.4 MediumAugust 13, 2018
hackerone nextcloud server, nextcloud server +1 moreImproper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker...CVE-2018-37765.3 MediumAugust 12, 2018
hackerone nextcloud server, nextcloud server +1 moreImproper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that...CVE-2018-37758.8 HighAugust 12, 2018
nextcloud contacts, contacts application +1 moreIn Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete...CVE-2018-37644.8 MediumJuly 5, 2018
nextcloud calendar, calendar application +1 moreIn Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an...CVE-2018-37634.8 MediumJuly 5, 2018
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for...CVE-2018-37624.3 MediumJuly 5, 2018
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token...CVE-2018-37618.1 HighJuly 5, 2018
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User...CVE-2017-09365.7 MediumMarch 28, 2018
nextcloud, opensuse leap +1 morenextcloud package security issues with /srv/www/htdocsCVE-2017-92867.8 HighMarch 1, 2018
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and...CVE-2017-08953.5 LowMay 8, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public...CVE-2017-08944.3 MediumMay 8, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library...CVE-2017-08935.4 MediumMay 8, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an...CVE-2017-08923.5 LowMay 8, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of...CVE-2017-08915.4 MediumMay 8, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS...CVE-2017-08905.4 MediumMay 8, 2017
hackerone nextcloud server, nextcloud, nextcloud server +2 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the ...CVE-2017-08884.3 MediumApril 5, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to...CVE-2017-08874.3 MediumApril 5, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an...CVE-2017-08866.5 MediumApril 5, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of...CVE-2017-08854.3 MediumApril 5, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders...CVE-2017-08844.3 MediumApril 5, 2017
hackerone nextcloud server, nextcloud server +1 moreNextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via...CVE-2017-08836.4 MediumApril 5, 2017
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open