Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-30540Chat poll data can still be queried from API after purging history in Nextcloud talk
- CVE-2023-30539Users can set up workflows using restricted and invisible system tags in Nextcloud
- CVE-2023-29000Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption
- CVE-2023-28999Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
- CVE-2023-28998Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys
- CVE-2023-28997Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files
- CVE-2023-28848CSRF protection on user_oidc login returned the expected token in case of an error
- CVE-2023-28834Full path of data directory exposed to Nextcloud server users
- CVE-2023-28845Chat room membership disclosed via autocompletion in Nextcloud talk
- CVE-2023-28844User without download rights can download older version of that file in nextcloud server
- CVE-2023-28645Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
- CVE-2023-28835Insecure randomness for default password in nextcloud
- CVE-2023-28833Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server
- CVE-2023-28644Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server
- CVE-2023-28643Potential share collision for recipients when caching is enabled in nextcloud server
- CVE-2023-26482Scope of workflow operations is not validated in nextcloud server
- CVE-2023-28646App lockout in nextcloud Android app can be bypassed via thirdparty apps
- CVE-2023-28647App pin of the iOS app can be bypassed in Nextcloud iOS
- CVE-2023-25817Delete permissions are not saved when creating public share in Nextcloud server
- CVE-2023-25818Missing brute force protection on password reset token in Nextcloud Server
- CVE-2023-25820Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal
- CVE-2023-26041Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured
- CVE-2023-25821Nextcloud download permissions can be changed by resharer
- CVE-2023-25816nextcloud vulnerable to Uncontrolled Resource Consumption
- CVE-2023-25579Directory traversal in Nextcloud server
- CVE-2023-25162Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs
- CVE-2023-25161Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails
- CVE-2023-25160IDOR Vulnerability in Nextcloud Mail
- CVE-2023-25159Nextcloud Server previews are accessible without a watermark
- CVE-2023-25150Document content of files can be obtained through Collabora for files of other users