Product:

Nextcloud_server

(Nextcloud)
Repositories • https://github.com/nextcloud/server
• https://github.com/nextcloud/gallery
• https://github.com/nextcloud/apps
#Vulnerabilities 159
Date Id Summary Products Score Patch Annotated
2020-02-04 CVE-2020-8118 An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application. Nextcloud_server, Suse_linux_enterprise_server, Backports_sle 5.0
2019-07-30 CVE-2019-5451 Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time. Nextcloud_server 4.6
2020-02-04 CVE-2019-15623 Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. Nextcloud_server, Backports_sle, Package_hub 5.3
2021-07-12 CVE-2021-32733 Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13,... Nextcloud_server 6.1
2021-07-12 CVE-2021-32741 Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. Nextcloud_server 5.3
2021-02-03 CVE-2020-8294 A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format. Nextcloud_server 5.4
2021-01-26 CVE-2020-8295 A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user. Nextcloud_server 7.5
2019-07-30 CVE-2019-5449 A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. Nextcloud_server 4.3
2020-03-20 CVE-2020-8138 A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL. Nextcloud_server N/A
2020-02-04 CVE-2019-15612 A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. Nextcloud_server N/A