Nextcloud Server

Every one of the 58 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Look…CVE-2019-15623Nextcloud · 1.9% likely

   CWE-3591 bounty report

2. A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.CVE-2020-8183Nextcloud · 1.9% likely

   CWE-2561 bounty report

3. A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.CVE-2020-8295Nextcloud · 1.8% likely

   CWE-4001 bounty report

4. An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to…CVE-2020-8154Nextcloud · 1.8% likely

   CWE-6391 bounty report

5. Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentia…CVE-2021-22915Nextcloud · 1.7% likely

   CWE-3071 bounty report

6. A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet.CVE-2021-22877Nextcloud · 1.7% likely

   CWE-2841 bounty report

7. Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the O…CVE-2018-3761Nextcloud · 1.6% likely

   CWE-2871 bounty report

8. A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later inter…CVE-2020-8293Nextcloud · 1.6% likely

   CWE-4001 bounty report

9. Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially…CVE-2017-0888Nextcloud · 1.5% likely

   CWE-4511 bounty report

10. A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.CVE-2020-8139Nextcloud · 1.5% likely

    CWE-2841 bounty report

11. Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.CVE-2019-15624Nextcloud · 1.5% likely

    CWE-201 bounty report

12. A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.CVE-2020-8223Nextcloud · 1.5% likely

    CWE-2691 bounty report

13. A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a…CVE-2020-8138Nextcloud · 1.4% likely

    CWE-9181 bounty report

14. Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated user…CVE-2016-7419Nextcloud · 1.4% likely

    CWE-791 bounty report

15. An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.CVE-2020-8118Nextcloud · 1.3% likely

    CWE-9181 bounty report

16. Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recur…CVE-2017-0886Nextcloud · 1.2% likely

    CWE-6741 bounty report

17. Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publi…CVE-2017-0894Nextcloud · 1.2% likely

    CWE-2851 bounty report

18. An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.CVE-2020-8155Nextcloud · 1.1% likely

    CWE-791 bounty report

19. A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.CVE-2019-15613Nextcloud · 1.1% likely

    CWE-201 bounty report

20. A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.CVE-2018-16467Nextcloud · 1.1% likely

    CWE-2001 bounty report

21. Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.CVE-2021-22878Nextcloud · 1.1% likely

    CWE-791 bounty report

22. Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as…CVE-2019-15621Nextcloud · 1.1% likely

    CWE-2811 bounty report

23. A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.CVE-2020-8121Nextcloud · 1.0% likely

    CWE-2841 bounty report

24. Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.CVE-2017-0892Nextcloud · 1.0% likely

    CWE-2851 bounty report

25. Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.CVE-2018-16466Nextcloud · 1.0% likely

    CWE-2841 bounty report

26. A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in mar…CVE-2020-8294Nextcloud · 0.9% likely

    CWE-791 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.