Clear text storage of proxy parameters and passwords Analysed #685990 Valid Cryptography Low 2020-09-16 – 53 SSL certificate not validated when registering with a provider Analysed #903424 Valid Cryptography Medium 2021-06-02 $300 43 Invisible Salamanders Attack against end_to_end_encryption in Nextcloud #2497947 Informative Cryptography Medium 2024-12-03 – 38 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.com Analysed #2446531 Valid Cryptography Medium 2024-05-22 – 37 OAuth2 client_secret stored in plain text in the database Analysed #1994324 Valid Cryptography Medium 2023-11-15 $100 31 Passwords being stored as plain text in logging Analysed #469668 Valid Cryptography Low 2019-08-31 – 30 ID4ME does not validate signature or expiration Analysed #1878391 Valid Cryptography Medium 2024-07-14 $750 29 user_ldap app logs user passwords in the log file on level debug Analysed #2101165 Valid Cryptography Medium 2023-11-21 – 28 X-E2EE-SIGNATURE verification can be bypassed, leading to loss of confidentiality of end-to-end encrypted files Analysed #2597504 Valid Cryptography Medium 2024-12-15 – 27 Predictable proposal participant tokens enable unauthorized access and vote submission Analysed #3385434 Valid Cryptography Low 2026-01-04 $100 25 [user_oidc] Unencrypted Communications Analysed #1687005 Valid Cryptography Low 2022-12-18 – 20 OAuth2 Access Token and App Password Security Vulnerability Analysed #343111 Valid Cryptography Medium 2018-07-21 – 20 Password disclosure in initial setup of Mail App Analysed #1561471 Valid Cryptography Low 2022-09-03 – 17 Desktop client does not verify received singed certificate in end to end encryption #1679267 Valid Cryptography Medium 2023-04-27 $1,000 13 Predictable Random Number Generator #504731 Informative Cryptography Medium 2019-06-26 – 12 nextcloudcmd incorrectly trusts bad TLS certificates #1699740 Valid Cryptography Low 2022-12-25 – 10 Vulnerable moment-timezone version shipped #1708873 Valid Cryptography – 2023-02-08 – 9 Reduced purmations on encryption #852841 Valid Cryptography Low 2020-10-28 – 9 Mail does not verify IMAP/SMTP host connected via TLS #803734 Valid Cryptography Medium 2020-06-03 – 9 Update php-saml library to 2.10.5 #213789 Valid Cryptography Low 2017-04-27 – 8 Insecure randomness for default password in file sharing when password policy app is disabled #1745702 Valid Cryptography Low 2023-03-30 – 5 Downgrade encryption scheme and break integrity through known-plaintext attack #742588 Valid Cryptography Medium 2020-11-05 – 5 Missing DNSSEC #509390 Valid Cryptography Medium 2019-08-29 – 5 Exception logging in Sharepoint app reveals clear-text connection details #1652903 Valid Cryptography Medium 2022-11-26 – 4 Social App does not validate server certificates for outgoing connections #915585 Valid Cryptography Medium 2020-11-17 – 4 Accessing to download.nextcloud.com from original ip adreess | insecure Download #374053 Informative Cryptography – 2018-07-12 – 2 Nextcloud.com is vulnerable to SWEET32 attack #199445 Informative Cryptography – 2017-01-25 – 2 Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy) #145552 Informative Cryptography – 2016-06-17 – 2