Nextcloud vulnerabilities
306 CVEs and advisories name Nextcloud as an affected vendor, newest first. Follow it as a feed.
- CVE-2021-41179Two-Factor Authentication not enforced for pages marked as public
- CVE-2021-41178File Traversal affecting SVG files on Nextcloud Server
- CVE-2021-41177Rate-limits not working on instances without configured memory cache backend
- CVE-2021-39224File path disclosure of shared files in OfficeOnline application
- CVE-2021-39225Missing permission check on Deck API
- CVE-2021-39223File path disclosure of shared files in Richdocuments application
- CVE-2021-39221XSS in Contacts
- CVE-2021-39220Bypass of image blocking in Nextcloud Mail
- CVE-2021-32802Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2021-32801Exceptions may have logged Encryption-at-Rest key content in Nextcloud server
- CVE-2021-32800Bypass of Two Factor Authentication in Nextcloud server
- CVE-2021-32766Nextcloud Text app can disclose existence of folders in "File Drop" link share
- CVE-2021-37629Lack of ratelimit on Richdocuments OCS endpoint in nextcloud
- CVE-2021-37628File Drop can be bypassed using Richdocuments app in nextcloud
- CVE-2021-32782Cross-Site Scripting in Nextcloud Circles
- CVE-2021-37630Secret Circle can be joined without approval in Nextcloud Circles
- CVE-2021-37631Circle can be accessed by non-Circle members in Nextcloud Deck
- CVE-2021-37617Untrusted Search Path in Nextcloud Desktop Client
- CVE-2021-32728End-to-end encryption device setup did not verify public key
- CVE-2021-32748WOPI API not protected by credentials/IP check
- CVE-2021-32741Lack of ratelimit on public share link mount endpoint
- CVE-2021-32734File path disclosure of shared files in Nextcloud Text application
- CVE-2021-32733XSS in Nextcloud Text application
- CVE-2021-32727End-to-end encryption device setup did not verify public key
- CVE-2021-32726Webauthn tokens not removed after user has been deleted
- CVE-2021-32725Default share permissions not respected for federated reshares
- CVE-2021-32707Bypass of image blocking in Nextcloud Mail
- CVE-2021-32689Nextcloud Talk not properly disassociating users from chats after account deletion
- CVE-2021-32705Lack of ratelimit on public DAV endpoint
- CVE-2021-32703Lack of ratelimit on shareinfo endpoint