Cross-site Scripting

Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception…CVE-2016-9466Nextcloud · 1.7% likely

   CWE-791 bounty report

2. A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.CVE-2020-8189Nextcloud · 1.4% likely

   CWE-791 bounty report

3. Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated user…CVE-2016-7419Nextcloud · 1.4% likely

   CWE-791 bounty report

4. An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.CVE-2020-8155Nextcloud · 1.1% likely

   CWE-791 bounty report

5. Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Ne…CVE-2016-9465Nextcloud · 1.1% likely

   CWE-791 bounty report

6. XSS in Nextcloud Text applicationCVE-2021-32733nextcloud · CVSS 4.8 · 1.1% likely

   CWE-791 bounty report

7. Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.CVE-2021-22878Nextcloud · 1.1% likely

   CWE-791 bounty report

8. Cross-site scripting (XSS) in Nextcloud Desktop ClientCVE-2022-39332nextcloud · CVSS 4.6 · 1.0% likely

   CWE-791 bounty report

9. Cross-site scripting (XSS) in Nextcloud Desktop ClientCVE-2022-39333nextcloud · CVSS 4.6 · 1.0% likely

   CWE-791 bounty report

10. Cross-site Scripting (XSS) in Nexcloud Desktop ClientCVE-2022-39331nextcloud · CVSS 4.6 · 0.9% likely

    CWE-791 bounty report

11. A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in mar…CVE-2020-8294Nextcloud · 0.9% likely

    CWE-791 bounty report

12. A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.CVE-2020-8120Nextcloud · 0.9% likely

    CWE-791 bounty report

13. A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only…CVE-2018-3780NextCloud · 0.9% likely

    CWE-791 bounty report

14. Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them…CVE-2019-15619Nextcloud · 0.8% likely

    CWE-791 bounty report

15. Cross-Site Scripting in Nextcloud CirclesCVE-2021-32782nextcloud · CVSS 5.8 · 0.8% likely

    CWE-79

16. Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.CVE-2019-15614Nextcloud · 0.8% likely

    CWE-791 bounty report

17. A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only af…CVE-2018-3781NextCloud · 0.7% likely

    CWE-791 bounty report

18. Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste maliciou…CVE-2017-0890Nextcloud · 0.7% likely

    CWE-791 bounty report

19. Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.CVE-2019-15618Nextcloud · 0.7% likely

    CWE-791 bounty report

20. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogsCVE-2021-29438nextcloud · CVSS 4.6 · 0.7% likely

    CWE-80

21. Self reflected HTML injection in Desktop clientCVE-2023-23942nextcloud · CVSS 5.4 · 0.7% likely

    CWE-79

22. Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidcCVE-2022-39338nextcloud · CVSS 3.5 · 0.7% likely

    CWE-791 bounty report

23. Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability cause…CVE-2017-0893Nextcloud · 0.6% likely

    CWE-791 bounty report

24. Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.CVE-2017-0891Nextcloud · 0.6% likely

    CWE-791 bounty report

25. A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks.CVE-2020-8280Nextcloud · 0.6% likely

    CWE-791 bounty report

26. In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitizat…CVE-2018-3764Nextcloud · 0.6% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.