Password reset link remains valid after email change #145896 Valid Authentication – 2016-12-13 – 7 Read-only share recipient can restore old versions of file #146067 Valid Authentication – 2016-07-19 $300 7 XSS on IOS app via HTML rendering #157434 Valid Cross-site Scripting Low 2017-04-20 – 7 Expired SSL certificate #163342 Valid Misconfiguration and Insecure Design – 2016-08-25 – 7 Wordpress: Directory Traversal / Denial of Serivce #163421 Valid Information Disclosure – 2016-08-26 – 7 Reflected XSS in Gallery App #165686 Valid Cross-site Scripting Medium 2016-12-03 – 7 Bad content-type in response header when getting document can lead to html injection #173721 Valid Cross-site Scripting Medium 2017-01-12 – 7 Calendar and addressbook names disclosed (NC-SA-2017-012) #203594 Valid Information Disclosure Low 2017-05-08 $183 7 (Authenticated) RCE by bypassing of the .htaccess blacklist #228825 Valid Command and Code Injection Critical 2020-03-01 – 7 Android content provider exposes password-protected share password hashes #242727 Valid Information Disclosure Low 2020-01-31 $75 7 Disabled user can reset their password #261297 Valid Misconfiguration and Insecure Design None 2020-03-01 – 7 WordPress < 4.8.2 vulnerable to multiple attacks #269705 Valid Misconfiguration and Insecure Design Low 2017-09-27 – 7 NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files Only #271253 Duplicate Authentication – 2019-04-11 – 7 Email Notification should be get while changing password on apps.nextcloud.com #308156 Informative No weakness recorded – 2018-02-28 – 7 Improper protection of FileContentProvider #331302 Valid Access Control Low 2020-03-01 – 7 Click Jacking Nextcloud #347782 Informative Misconfiguration and Insecure Design Low 2019-07-01 – 7 File access control rules not enforced on image files #358339 Valid Access Control Low 2018-06-15 – 7 Private/confidential setting of calendar events is ignored on activity stream #476615 Valid Information Disclosure Low 2019-06-27 – 7 SSRF on local storage of iOS mobile #746541 Valid Server-Side Request Forgery Medium 2020-03-01 – 7 The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18) #888261 Valid Access Control Low 2021-03-04 – 7 Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki #906322 Valid Access Control – 2021-01-15 – 7 Unexpected federated shares added via public link #1167767 Informative Access Control Medium 2021-04-26 – 7 Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud #1167919 Valid Access Control Low 2021-05-31 – 7 Password policy changes not enforced for existing passwords #1169335 Informative Authentication Low 2021-04-26 – 7 Serverinfo endpoints are not bruteforce protected nor are tokens properly generated #1210458 Valid No weakness recorded Low 2021-06-16 – 7 Ownership check missing when updating or deleting attachments #1579820 Valid Insecure Direct Object Reference Medium 2022-07-06 – 7 Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/ #149798 Valid Misconfiguration and Insecure Design Low 2016-12-02 – 8 IDOR - Disable sharing #153905 Valid Access Control Low 2016-12-03 – 8 User Information Disclosure via REST API #197877 Valid Information Disclosure – 2017-02-11 – 8 Missing Rate Limit for Current Password field in nextcloud.com #199714 Valid Authentication Low 2017-05-20 – 8 Update php-saml library to 2.10.5 #213789 Valid Cryptography Low 2017-04-27 – 8 Delete All Data of Any User #220385 Valid No weakness recorded Low 2020-03-01 – 8 Github wikis are editable by anyone #457032 Valid Access Control Medium 2018-12-07 – 8 Uploading large avatar images cause excessive CPU usage #504759 Valid Denial of Service – 2019-06-27 – 8 Wordpress Users Disclosure #625199 Duplicate Information Disclosure High 2019-07-01 – 8 Directory listing is enabled that exposes non public data through multiple path #690796 Valid Information Disclosure Low 2020-02-01 – 8 user can bypass password enforcement when federated sharing is enabled #838510 Valid No weakness recorded – 2022-06-01 $250 8 Improper access control to messages of Social app #921717 Valid Access Control Medium 2020-11-17 – 8 Acting under any different user via DB-stored credentials #1061591 Valid Access Control High 2021-03-01 – 8 Federated editing allows iframing possibly malicious remotes #1210424 Valid Access Control Low 2022-07-02 $100 8 objectId in share location can be set to open arbitrary URL or Deeplinks #1337178 Valid Input Validation and Logic Medium 2022-03-08 – 8 Control character filtering misses leading and trailing whitespace in file and folder names #1402249 Valid Injection and Smuggling Medium 2022-05-27 – 8 Open redirect on "Unsupported browser" warning #1977222 Valid Open Redirect Medium 2023-06-22 $150 8 Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory #3159877 Valid Information Disclosure None 2026-01-04 – 8 help.nextcloud Email Address/Username enumeration #145734 Informative Information Disclosure – 2016-06-19 – 9 Password Reset Link issue #161924 Valid Authentication – 2016-09-23 – 9 \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype #163338 Valid Cross-site Scripting Medium 2016-12-03 – 9 Privilege escalation - Normal user can somehow make admin to delete shared folders #166581 Valid Access Control High 2017-05-20 – 9 Bypass permissions #169680 Valid Access Control Medium 2017-02-09 – 9 Files Drop: WebDAV endpoint is leaking existence of resources #187460 Valid Information Disclosure Low 2017-01-01 – 9