Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-35932Missing rate limit when trying to join a password protected Nextcloud Talk conversation
- CVE-2022-31119Password disclosure in log file in Nextcloud Mail App
- CVE-2022-31132Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
- CVE-2022-31120Federated share accepting/declining is not logged in audit log in Nextcloud Server
- CVE-2022-31118Missing brute force protection on cloud federation sharing in Nextcloud Server
- CVE-2022-31131Ownership check missing when updating or deleting mail attachments in Nextcloud mail
- CVE-2022-31014SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server
- CVE-2022-31024Federated editing allows iframing remote servers by default in richdocuments
- CVE-2022-29243Improper input-size validation on the user new session name in Nextcloud Server
- CVE-2022-29163Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server
- CVE-2022-29160Sensitive files/data exist after deletion of user account in Nextcloud Android
- CVE-2022-24906Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
- CVE-2022-29159Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck
- CVE-2022-24890Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk
- CVE-2022-24889Insufficient Verification of Data Authenticity in Nextcloud Server
- CVE-2022-24888Possible Injection in Nextcloud Server
- CVE-2022-24887Open Redirect in Nextcloud Talk
- CVE-2022-24886Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
- CVE-2022-24885Improper Authentication in Nextcloud Android Files
- CVE-2022-24838Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2021-41233Missing authorization in Nextcloud text
- CVE-2022-24741High memory usage in Nextcloud server
- CVE-2021-41241Advanced permissions is not respected for subfolders in Nextcloud server
- CVE-2021-41239User enumeration setting not respected in Nextcloud server
- CVE-2021-41181Nextcloud Talk app exposes chat messages on lockscreen
- CVE-2021-41180Geolocation preview links can be set to arbitrary links in nextcloud talk
- CVE-2021-41166Permission bypass in Nextcloud Android App
- CVE-2021-43863SQL Injection in FileContentProvider (GHSL-2021-1007)
- CVE-2021-41256Intent URI permissions manipulation in nextcloud news-android
- CVE-2021-39222XSS in Talk