Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2021-32688Application specific tokens can change their own scope
- CVE-2021-32680Audit log is not properly logging unsetting of share expiration date
- CVE-2021-32679Filenames not escaped by default in controllers using DownloadResponse
- CVE-2021-32678Ratelimit not applied on OCS API responses
- CVE-2021-32694Malicious Android application can crash the Nextcloud Android Client
- CVE-2021-32695Malicious Android app could access Shared Preferences of the Nextcloud Android client
- CVE-2021-32676Session Fixation in Nextcloud Talk
- CVE-2021-32658Sensitive data may not be removed from storage on account removal
- CVE-2021-32657Malicious user could break user administration page
- CVE-2021-32656Trusted servers exchange can be triggered by attacker
- CVE-2021-32655Files Drop public link can be added as federated share
- CVE-2021-32654Attacker can obtain write access to any federated share/public link
- CVE-2021-32653Default settings leak federated cloud ID to lookup server of all users
- CVE-2021-32652Missing permission check on email metadata retrieval
- CVE-2021-29438Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
- CVE-2019-5453Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protecti
- CVE-2019-5455Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.
- CVE-2018-3781A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-intera
- CVE-2018-3780A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-int
- CVE-2018-3764In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring
- CVE-2018-3763In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS
- CVE-2018-3762Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still r
- CVE-2018-3761Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint.
- CVE-2017-0936Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability.
- CVE-2017-0895Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users.
- CVE-2017-0894Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error.
- CVE-2017-0893Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which
- CVE-2017-0892Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to
- CVE-2017-0891Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabiliti
- CVE-2017-0890Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module.