Skip to contentNextcloud vulnerabilities
Newest
- nextcloud talk, kiteworks security-advisories +1 moreXSS in TalkCVE-2021-392226.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreTwo-Factor Authentication not enforced for pages marked as publicCVE-2021-411796.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreFile Traversal affecting SVG files on Nextcloud ServerCVE-2021-411788.8 High
- nextcloud server, kiteworks security-advisories +1 moreRate-limits not working on instances without configured memory cache backendCVE-2021-411778.1 High
- nextcloud officeonline, kiteworks security-advisories +1 moreFile path disclosure of shared files in OfficeOnline applicationCVE-2021-392243.5 Low
- nextcloud deck, kiteworks security-advisories +1 moreMissing permission check on Deck APICVE-2021-392258.1 High
- nextcloud richdocuments, kiteworks security-advisories +1 moreFile path disclosure of shared files in Richdocuments applicationCVE-2021-392234.8 Medium
- nextcloud contacts, kiteworks security-advisories +1 moreXSS in ContactsCVE-2021-392216.4 Medium
- nextcloud mail, kiteworks security-advisories +1 moreBypass of image blocking in Nextcloud MailCVE-2021-392203.5 Low
- nextcloud server, kiteworks security-advisories +1 morePreview generation used third-party library not suited for user-generated content in Nextcloud serverCVE-2021-328029.3 Critical
- nextcloud server, kiteworks security-advisories +1 moreExceptions may have logged Encryption-at-Rest key content in Nextcloud serverCVE-2021-328015.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreBypass of Two Factor Authentication in Nextcloud serverCVE-2021-328008.1 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Text app can disclose existence of folders in "File Drop" link shareCVE-2021-327665.3 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 moreLack of ratelimit on Richdocuments OCS endpoint in nextcloudCVE-2021-376295.3 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 moreFile Drop can be bypassed using Richdocuments app in nextcloudCVE-2021-376287.5 High
- nextcloud circles, kiteworks security-advisories +1 moreCross-Site Scripting in Nextcloud CirclesCVE-2021-327825.8 Medium
- nextcloud circles, kiteworks security-advisories +1 moreSecret Circle can be joined without approval in Nextcloud CirclesCVE-2021-376306.5 Medium
- nextcloud deck, kiteworks security-advisories +1 moreCircle can be accessed by non-Circle members in Nextcloud DeckCVE-2021-376316.5 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreUntrusted Search Path in Nextcloud Desktop ClientCVE-2021-376177.3 High
- nextcloud desktop, debian linux, kiteworks security-advisories +2 moreEnd-to-end encryption device setup did not verify public keyCVE-2021-32728Fix available6.5 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 moreWOPI API not protected by credentials/IP checkCVE-2021-327484.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreLack of ratelimit on public share link mount endpointCVE-2021-327415.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreFile path disclosure of shared files in Nextcloud Text applicationCVE-2021-327343.1 Low
- nextcloud server, kiteworks security-advisories +1 moreXSS in Nextcloud Text applicationCVE-2021-327334.8 Medium
- nextcloud, kiteworks security-advisories +1 moreEnd-to-end encryption device setup did not verify public keyCVE-2021-32727Fix available5.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreWebauthn tokens not removed after user has been deletedCVE-2021-327267.1 High
- nextcloud server, kiteworks security-advisories +1 moreDefault share permissions not respected for federated resharesCVE-2021-327253.5 Low
- nextcloud mail, kiteworks security-advisories +1 moreBypass of image blocking in Nextcloud MailCVE-2021-327074.3 Medium
- nextcloud talk, kiteworks security-advisories +1 moreNextcloud Talk not properly disassociating users from chats after account deletionCVE-2021-326898.1 High
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on public DAV endpointCVE-2021-327055.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreLack of ratelimit on shareinfo endpointCVE-2021-327035.3 Medium
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreApplication specific tokens can change their own scopeCVE-2021-326888.8 High
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreAudit log is not properly logging unsetting of share expiration dateCVE-2021-326803.3 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreFilenames not escaped by default in controllers using DownloadResponseCVE-2021-326793.5 Low
- nextcloud server, fedoraproject fedora, kiteworks security-advisories +2 moreRatelimit not applied on OCS API responsesCVE-2021-326783.7 Low
- nextcloud, kiteworks security-advisories +1 moreMalicious Android application can crash the Nextcloud Android ClientCVE-2021-32694Fix available4.1 Medium
- nextcloud, kiteworks security-advisories +1 moreMalicious Android app could access Shared Preferences of the Nextcloud Android clientCVE-2021-32695Fix available3.9 Low
- nextcloud talk, kiteworks security-advisories +1 moreSession Fixation in Nextcloud TalkCVE-2021-326766.5 Medium
- nextcloud end-to-end encryptionNextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authenticated users to lock files of other users.CVE-2021-229066.5 Medium
- nextcloudNextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using th…CVE-2021-22905Fix available6.5 Medium
- hackerone nextcloud server, nextcloud server, fedoraproject fedora +2 moreNextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an atta…CVE-2021-229159.8 Critical
- nextcloudNextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.CVE-2021-22896Fix available4.3 Medium
- nextcloud desktop, debian linux +1 morenextcloud-desktop - security updateCVE-2021-22895Fix available5.9 Medium
- nextcloud deckNextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless…CVE-2021-229136.5 Medium
- nextcloudNextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a gl…CVE-2021-22912Fix available6.5 Medium
- nextcloud, kiteworks security-advisories +1 moreSensitive data may not be removed from storage on account removalCVE-2021-32658Fix available4.7 Medium
- nextcloud server, kiteworks security-advisories +1 moreMalicious user could break user administration pageCVE-2021-326574.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreTrusted servers exchange can be triggered by attackerCVE-2021-326568.6 High
- nextcloud server, kiteworks security-advisories +1 moreFiles Drop public link can be added as federated shareCVE-2021-326553.5 Low
- nextcloud server, kiteworks security-advisories +1 moreAttacker can obtain write access to any federated share/public linkCVE-2021-326548.1 High
- Show moreLoading…