Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-23942Self reflected HTML injection in Desktop client
- CVE-2023-23943Blind SSRF via server URL input in the Nextcloud Mail app
- CVE-2023-23944Nexcloud Mail app temporarily stores cleartext password in database
- CVE-2023-22471Nextcloud Deck vulnerable to authorization bypass
- CVE-2023-22470Nextcloud Deck vulnerable to uncontrolled resource consumption
- CVE-2023-22469Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache
- CVE-2023-22473Passcode bypass on Talk-Android app
- CVE-2023-22472Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link
- CVE-2022-41971Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation
- CVE-2022-41970Nextcloud Server's disabled download shares still allow download through preview images
- CVE-2022-41969Nextcloud Server has no password length limit when creating a user as an administrator
- CVE-2022-41968Nextcloud Server's calendar name length not validated before writing to database
- CVE-2022-41926Nextcloud Talk Android broadcast incorrect permission handling
- CVE-2022-39346Missing length validation of user displayname in nextcloud server
- CVE-2022-39339Cleartext Transmission of Sensitive Information in user_oidc
- CVE-2022-39338Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc
- CVE-2022-39334nextcloudcmd incorrectly trusts bad TLS certificates
- CVE-2022-39333Cross-site scripting (XSS) in Nextcloud Desktop Client
- CVE-2022-39332Cross-site scripting (XSS) in Nextcloud Desktop Client
- CVE-2022-39331Cross-site Scripting (XSS) in Nexcloud Desktop Client
- CVE-2022-41882Nextcloud Desktop vulnerable to code injection via malicious link
- CVE-2022-39364Exception logging in Sharepoint app reveals clear-text connection details
- CVE-2022-39330Database resource exhaustion for logged-in users via sharee recommendations with circles
- CVE-2022-39329Profile of disabled user stays accessible
- CVE-2022-39212Last video frame is still sent after video is disabled in a call in Nextcloud Talk
- CVE-2022-39210Access to internal files of the Nextcloud Android app
- CVE-2022-39211Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
- CVE-2022-36074Authentication headers exposed on by Nextcloud Server
- CVE-2022-36075File list exposure in Nextcloud Files Access Control
- CVE-2022-35931Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator