Nextcloud vulnerabilities
393 vulnerabilities
Known vulnerabilities in Nextcloud products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 51 products.
Products
50 of 51- Security Advisories260 vulnerabilities
- Nextcloud Server189 vulnerabilities
- Nextcloud29 vulnerabilities
- Desktop27 vulnerabilities
- Talk20 vulnerabilities
- Deck18 vulnerabilities
- Mail15 vulnerabilities
- Calendar10 vulnerabilities
- User Oidc9 vulnerabilities
- Richdocuments8 vulnerabilities
- Tables8 vulnerabilities
- Contacts7 vulnerabilities
- Nextcloud Enterprise Server6 vulnerabilities
- Server6 vulnerabilities
- Approval4 vulnerabilities
- Circles3 vulnerabilities
- Group Folders3 vulnerabilities
- Com.Nextcloud.Client2 vulnerabilities
- End To End Encryption2 vulnerabilities
- Guests2 vulnerabilities
- News2 vulnerabilities
- Nextcloud Talk2 vulnerabilities
- Notes2 vulnerabilities
- Openid Connect User Backend2 vulnerabilities
- Preferred Providers2 vulnerabilities
- Social2 vulnerabilities
- Android1 vulnerabilities
- Collectives1 vulnerabilities
- Cookbook1 vulnerabilities
- Extract1 vulnerabilities
- Files Access Control1 vulnerabilities
- Files Lock1 vulnerabilities
- Flow1 vulnerabilities
- Forms1 vulnerabilities
- Global Site Selector1 vulnerabilities
- Lookup Server1 vulnerabilities
- News Android1 vulnerabilities
- Nextcloud Calendar Application1 vulnerabilities
- Nextcloud Contacts Application1 vulnerabilities
- Nextcloud Files Automated Tagging1 vulnerabilities
- Nextcloud Mail1 vulnerabilities
- Nextcloud Dialogs1 vulnerabilities
- Nextcloudpi1 vulnerabilities
- Nextcloud/Server1 vulnerabilities
- Nextcloud/Talk1 vulnerabilities
- Officeonline1 vulnerabilities
- Password Policy1 vulnerabilities
- Sso \& Saml Authentication1 vulnerabilities
- Team Folders1 vulnerabilities
- Two Factor Webauthn1 vulnerabilities
CVE-2018-16464nextcloudnextcloud_server
EPSS score0.89%
A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.CVE-2018-16466nextcloudnextcloud_serverEPSS score0.96%
Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.CVE-2018-16463nextcloudnextcloud_serverEPSS score0.55%
A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.CVE-2018-16465nextcloudnextcloud_serverEPSS score0.81%
Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.CVE-2018-16467nextcloudnextcloud_serverEPSS score1.07%
A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.CVE-2018-3762nextcloudnextcloud_serverEPSS score0.89%
Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.CVE-2018-3775hackeronenextcloud server+1EPSS score1.23%
Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.CVE-2018-3776hackeronenextcloud server+1EPSS score1.26%
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.CVE-2018-3761nextcloudnextcloud_serverEPSS score1.66%
Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.CVE-2018-3781nextcloudnextcloud/talk+1EPSS score0.74%
A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.CVE-2018-3763nextcloudcalendar+1EPSS score0.61%
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.CVE-2018-3764nextcloudcontacts+1EPSS score0.64%
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.CVE-2018-3780mageianextcloud+2EPSS score0.89%
A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.CVE-2021-41180nextcloudsecurity-advisories+1EPSS score1.04%
Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client. It is recommended that the Nextcloud Talk App is upgraded to 12.1.2. There are no known workarounds.CVE-2021-41179nextcloudsecurity-advisories+1EPSS score1.20%
Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.CVE-2021-41181nextcloudsecurity-advisories+1EPSS score0.31%
Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker could gain access to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds.CVE-2021-41233nextcloudnextcloud_server+1EPSS score0.79%
Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the application settings.CVE-2021-41239nextcloudnextcloud_server+1EPSS score1.13%
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.CVE-2021-41178nextcloudsecurity-advisories+1EPSS score1.78%
Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This could also be leveraged into a XSS/phishing attack, an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.CVE-2021-41241nextcloudnextcloud_server+1EPSS score0.85%
Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the "groupfolders" application in the admin settings.