Username Enumeration #667613 Informative Information Disclosure – 2019-11-11 – – Directory Listing In Subdomain Of nextcloud.com #218199 Informative Information Disclosure – 2017-07-14 – 1 Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/ #403909 Duplicate Information Disclosure – 2019-01-07 – 1 Leaking sensitive information through JSON file path. #1211061 Informative Information Disclosure – 2022-02-07 – 1 Deny access to download.nextcloud.com + folders #146314 Informative Information Disclosure – 2016-06-21 – 2 Share tokens for public calendars disclosed (NC-SA-2017-011) #218876 Valid Information Disclosure – 2017-06-06 – 2 information disclose #223759 Informative Information Disclosure – 2017-04-25 – 2 External Storage - WebDAV - New user has access to storage from deleted user (same user-ID) #549831 Valid Information Disclosure – 2021-02-14 – 2 WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED) #696198 Informative Information Disclosure – 2019-11-11 – 2 https://newsletter.nextcloud.com Directory listening and Information Disclosure #145603 Valid Information Disclosure – 2016-06-18 – 3 Retrieval and alteration of exposed media on Android Oreo #462441 Informative Information Disclosure – 2019-06-26 – 3 Password authentication at newsletter.nextcloud.com discloses username list #476439 Valid Information Disclosure – 2020-03-01 – 3 Veracode and security audit record are publicly available #669365 Informative Information Disclosure – 2019-09-10 – 3 Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers #895730 Valid Information Disclosure – 2020-07-25 – 3 Nextcloud update checks leaks information #1173411 Informative Information Disclosure – 2021-05-01 – 3 Information Exposure Through Directory Listing vulnerability #1476709 Informative Information Disclosure – 2022-02-11 – 3 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4 nextcloud.com: Directory listening for 'wp-includes' forders #145495 Valid Information Disclosure – 2016-06-17 – 4 WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available #146093 Informative Information Disclosure – 2016-06-22 – 4 Information disclosure #152499 N/A Information Disclosure – 2017-04-20 – 4 Information Exposure Through Directory Listing #260221 Informative Information Disclosure – 2018-05-17 – 4 Banner Grabbing - Apache Server Version Disclosure #348801 Informative Information Disclosure – 2018-05-17 – 4 Disclosed Version of PORTS SSH|HTTP|SSL #358102 Duplicate Information Disclosure – 2018-06-14 – 4 Full path disclosure vulnerability via Upload .htaccess file #919429 Informative Information Disclosure – 2020-07-09 – 4 Brute force protections don't work #1596918 Valid Information Disclosure – 2022-09-03 – 4 Vulnerable Javascript library #145517 Informative Information Disclosure – 2016-06-17 – 5 Email ID Disclosure. #146106 Informative Information Disclosure – 2016-06-20 – 5 Information Disclosure of .htaccess file in Private Server/Subdomain #163106 Valid Information Disclosure – 2016-08-26 – 5 Shared file link - password protection bypass under certain conditions #231917 Valid Information Disclosure – 2018-09-25 $50 5 Unauthenticated 'display name' information leak on enumeration of login names #237232 Valid Information Disclosure – 2020-03-01 – 5 Banner Grabbing - Apache Server Version Disclousure #269449 Informative Information Disclosure – 2018-05-17 – 5 Anonymous file drop page ignores user profile visibility restrictions #752353 Valid Information Disclosure – 2020-08-03 – 5 the complete server installation path is visible in cloud/user endpoint #1690510 Valid Information Disclosure – 2023-03-30 – 5 Directory listening enabled in: 88.198.160.130 #156510 Valid Information Disclosure – 2016-09-04 – 6 Wordpress Version Disclosure Bug On Nextcloud #188132 Informative Information Disclosure – 2016-12-04 – 6 SQL exception in JSON format #225098 Valid Information Disclosure – 2020-01-31 – 6 Text app leaks file path of shared files #1246721 Valid Information Disclosure – 2021-08-11 – 6 Error in Deleting Deck cards attachment reveals the full path of the website #1354334 Valid Information Disclosure – 2022-05-20 – 6 Wordpress: Directory Traversal / Denial of Serivce #163421 Valid Information Disclosure – 2016-08-26 – 7 Calendar and addressbook names disclosed (NC-SA-2017-012) #203594 Valid Information Disclosure – 2017-05-08 $183 7 Android content provider exposes password-protected share password hashes #242727 Valid Information Disclosure – 2020-01-31 $75 7 Private/confidential setting of calendar events is ignored on activity stream #476615 Valid Information Disclosure – 2019-06-27 – 7 User Information Disclosure via REST API #197877 Valid Information Disclosure – 2017-02-11 – 8 Wordpress Users Disclosure #625199 Duplicate Information Disclosure – 2019-07-01 – 8 Directory listing is enabled that exposes non public data through multiple path #690796 Valid Information Disclosure – 2020-02-01 – 8 Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory #3159877 Valid Information Disclosure None 2026-01-04 – 8 help.nextcloud Email Address/Username enumeration #145734 Informative Information Disclosure – 2016-06-19 – 9 Files Drop: WebDAV endpoint is leaking existence of resources #187460 Valid Information Disclosure – 2017-01-01 – 9 User files is disclosed when someone called while the screen is locked #1338781 Valid Information Disclosure – 2022-03-14 – 9 Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic #1520685 Valid Information Disclosure – 2022-06-09 $100 9