Nextcloud Server vulnerabilities, page 4
189 vulnerabilities
Known vulnerabilities in Nextcloud Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-8120nextcloudnextcloud_server
EPSS score0.92%
A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.CVE-2020-8154nextcloudnextcloud_serverEPSS score1.77%
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.CVE-2020-8223fedoraprojectfedora+1EPSS score1.47%
A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.CVE-2020-8293nextcloudnextcloud_serverEPSS score1.56%
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.CVE-2020-8236nextcloudnextcloud_serverEPSS score0.59%
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.CVE-2020-8295nextcloudnextcloud_serverEPSS score1.81%
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.CVE-2020-8152nextcloudnextcloud_serverEPSS score0.32%
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.CVE-2020-8155nextcloudnextcloud_serverEPSS score1.14%
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.CVE-2020-8122nextcloudnextcloud_serverEPSS score0.68%
A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.CVE-2020-8138nextcloudnextcloud_serverEPSS score1.40%
A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.CVE-2020-8121nextcloudnextcloud_serverEPSS score1.04%
A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.CVE-2020-8118nextcloudnextcloud_server+2EPSS score1.29%
An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.CVE-2020-8119nextcloudnextcloud_serverEPSS score0.92%
Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.CVE-2020-8133nextcloudnextcloud_serverEPSS score0.73%
A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file.CVE-2020-8296fedoraprojectfedora+1EPSS score0.51%
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.CVE-2020-8150nextcloudnextcloud_serverEPSS score0.29%
A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.CVE-2020-8117nextcloudnextcloud_serverEPSS score0.71%
Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.CVE-2020-8259nextcloudnextcloud_serverEPSS score0.74%
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.CVE-2020-8139fedoraprojectfedora+1EPSS score1.54%
A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.CVE-2022-41968nextcloudnextcloud_server+1EPSS score0.92%
Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available.