Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Vendors
Nextcloud

Nextcloud vulnerabilities

Products

Security-advisories260
Server189
Nextcloud30
Desktop27
Talk20
Deck18
Mail16
Server15
Server11
Calendar10
Tables10
Flow9
Richdocuments9
User Oidc9
Contacts7
Com.nextcloud.client6
Enterprise Server6
Approval4
Circles3
Group Folders3
Collectives2
End-to-end Encryption2
Guests2
News2
Mail2
Talk2
Notes2
Openid Connect User Backend2
Preferred Providers2
Social2

Newest

Known exploitedIn KEVPublic exploitFix available

nextcloud server, kiteworks security-advisories +1 moreDefault settings leak federated cloud ID to lookup server of all usersCVE-2021-326532.7 LowJune 1, 2021
nextcloud mail, kiteworks security-advisories +1 moreMissing permission check on email metadata retrievalCVE-2021-326528.8 HighJune 1, 2021
nextcloud desktop, fedoraproject fedora +1 moreNextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing...CVE-2021-22879Fix available8.8 HighApril 14, 2021
nextcloud nextcloud-dialogs, nextcloud\/dialogs project nextcloud\/dialogs +1 moreImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogsCVE-2021-29438Fix available4.6 MediumApril 13, 2021
hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external...CVE-2020-82966.7 MediumMarch 3, 2021
hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to...CVE-2021-228784.8 MediumMarch 3, 2021
fedoraproject fedora, hackerone nextcloud server, nextcloud server +2 moreA missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own...CVE-2021-228776.5 MediumMarch 3, 2021
nextcloud deckNextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability...CVE-2020-82974.3 MediumFebruary 23, 2021
hackerone nextcloud server, nextcloud server +1 moreA missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of...CVE-2020-82945.4 MediumFebruary 3, 2021
hackerone nextcloud server, nextcloud server +1 moreA wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when...CVE-2020-82957.5 HighJanuary 26, 2021
hackerone nextcloud server, nextcloud server +1 moreA missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to...CVE-2020-82936.5 MediumJanuary 26, 2021
nextcloud contactsA missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files...CVE-2020-82805.4 MediumJanuary 6, 2021
nextcloud contactsA missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious...CVE-2020-82815.4 MediumJanuary 6, 2021
nextcloud socialImproper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.CVE-2020-82785.3 MediumNovember 19, 2020
nextcloud socialMissing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0...CVE-2020-82797.4 HighNovember 19, 2020
hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...CVE-2020-82598.1 HighNovember 16, 2020
hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...CVE-2020-81524.4 MediumNovember 16, 2020
hackerone nextcloud server, nextcloud server +1 moreA wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed...CVE-2020-81335.3 MediumNovember 9, 2020
hackerone nextcloud server, nextcloud server +1 moreA cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption...CVE-2020-81504.1 MediumNovember 9, 2020
hackerone nextcloud server, nextcloud server +1 moreA too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed...CVE-2020-81732.2 LowOctober 30, 2020
hackerone nextcloud server, nextcloud server +1 moreA wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless...CVE-2020-82366.8 MediumOctober 30, 2020
hackerone nextcloud server, nextcloud server +1 moreA logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it...CVE-2020-81837.5 HighOctober 10, 2020
nextcloud deckImproper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with...CVE-2020-81828.0 HighOctober 5, 2020
hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreA logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users...CVE-2020-82236.5 MediumOctober 5, 2020
nextcloud deckMissing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference...CVE-2020-82354.3 MediumOctober 5, 2020
nextcloud preferred providers, opensuse backports sle, leap +2 moreA missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password...CVE-2020-82285.3 MediumOctober 5, 2020
nextcloud desktopA cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away...CVE-2020-8225Fix available7.5 HighSeptember 18, 2020
nextcloud desktopA cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html ...CVE-2020-8189Fix available5.4 MediumAugust 21, 2020
nextcloud desktopMissing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a...CVE-2020-8227Fix availableEPSS 25.8%6.8 MediumAugust 21, 2020
nextcloud desktopA memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR...CVE-2020-82305.5 MediumAugust 17, 2020
nextcloud desktopA code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a...CVE-2020-82247.8 HighAugust 10, 2020
nextcloud desktopA memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS...CVE-2020-82295.5 MediumAugust 10, 2020
nextcloud preferred providersImproper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial...CVE-2020-82025.3 MediumJuly 30, 2020
nextcloud contactsA missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file...CVE-2020-81814.3 MediumJuly 10, 2020
nextcloud deckImproper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other...CVE-2020-81794.1 MediumJuly 2, 2020
nextcloud talkA too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not...CVE-2020-81809.9 CriticalJune 8, 2020
fedoraproject fedora, nextcloud group folders +1 moreImproper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when...CVE-2020-81538.1 HighMay 12, 2020
hackerone nextcloud server, nextcloud server +1 moreAn outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross...CVE-2020-81555.4 MediumMay 12, 2020
hackerone nextcloud server, nextcloud server +1 moreAn Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker...CVE-2020-81547.7 HighMay 12, 2020
nextcloud mail, fedoraproject fedora +1 moreA missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.CVE-2020-81567.0 HighMay 12, 2020
nextcloud desktopA code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when...CVE-2020-81406.7 MediumMarch 20, 2020
hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreA missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide...CVE-2020-81396.5 MediumMarch 20, 2020
hackerone nextcloud server, nextcloud server +1 moreA missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14...CVE-2020-81386.5 MediumMarch 20, 2020
hackerone nextcloud server, nextcloud server +1 moreA missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the...CVE-2020-81224.3 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreA bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by...CVE-2020-81218.1 HighFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreA reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the...CVE-2020-81206.1 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreImproper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a...CVE-2020-81194.3 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server, novell suse linux enterprise server +1 more +3 moreAn authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local...CVE-2020-81185.0 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server +1 moreImproper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be...CVE-2020-81174.3 MediumFebruary 4, 2020
hackerone nextcloud server, nextcloud server, opensuse backports +1 more +3 moreImproper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs...CVE-2019-156244.9 MediumFebruary 4, 2020
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open