Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-37885Code injection in Nextcloud Desktop Client for macOS
- CVE-2024-37884Nextcloud Server's users can delete old versions of read-only shared files
- CVE-2024-37883Nextcloud Deck can access comments and attachments of deleted cards
- CVE-2024-37882Nextcloud Server can reshare read&share only folder with more permissions
- CVE-2024-37317Nextcloud Notes app can be tricked into using a received share created before the user logged in
- CVE-2024-37316Nextcloud Calendar's event create can create attachments that link to other websites
- CVE-2024-37315Nextcloud Server's read-only users can restore old versions
- CVE-2024-37314Nextcloud Photos' shared albums have no restriction on photo removal
- CVE-2024-37313Nextcloud server allows the by-pass the second factor
- CVE-2024-37312Nextcloud user_oidc app's ID4me feature is available even when disabled
- CVE-2024-30247Command Injection as root in NextCloudPi web panel
- CVE-2024-22402Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist
- CVE-2024-22401All users can reset the allowed apps list for Nextcloud Guest App users
- CVE-2024-22404Permissions bypass in Nextcloud with the files zip app
- CVE-2024-22403OAuth2 authorization codes are valid indefinetly in Nextcloud server
- CVE-2024-22400Open redirect in user_saml via RelayState parameter in Nextcloud User Saml
- CVE-2024-22213Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app
- CVE-2024-22212Nextcloud global site selector authentication bypass
- CVE-2023-49792Bruteforce protection can be bypassed with misconfigured proxy
- CVE-2023-49791Workflows do not require password confirmation on API level
- CVE-2023-49790App PIN code can be bypassed in Nextcloud Files iOS
- CVE-2023-48308Calendar app returns full stacktrace when an error happens while editing appointment
- CVE-2023-48307Nextcloud Mail app vulnerable to Server-Side Request Forgery
- CVE-2023-48306Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF
- CVE-2023-48305Nextcloud Server user_ldap app logs user passwords in the log file on level debug
- CVE-2023-48304Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user
- CVE-2023-48303Nextcloud Server admins can change authentication details of user configured external storage
- CVE-2023-48302Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
- CVE-2023-48301Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name
- CVE-2023-48239Nextcloud Server users can make external storage mount points inaccessible for other users