Password of failed (2FA) login attempt is stored in log #244092 Valid Authentication High 2020-03-01 – 9 Share recipient can modify a share's expiration date #447494 Valid Access Control Medium 2020-01-31 $100 9 Some HTML Tags are Getting Executed in com.nextcloud.client #631227 Valid Command and Code Injection None 2019-07-26 – 9 Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file #661051 Valid Misconfiguration and Insecure Design Low 2020-11-05 – 9 Mail does not verify IMAP/SMTP host connected via TLS #803734 Valid Cryptography Medium 2020-06-03 – 9 PHPUnit is included in groupfolders release package potentially causing RCE #820146 Valid No weakness recorded – 2020-06-25 – 9 Reduced purmations on encryption #852841 Valid Cryptography Low 2020-10-28 – 9 Allows any user to share their "Root" level folder by sharing "." #889795 Valid Access Control None 2020-06-03 – 9 Nextcloud deck sharee search leaks searches to lookupserver by default #1167958 Valid Access Control Low 2021-05-26 – 9 Webauthn tokens are not removed on user deletion #1202590 Valid Access Control Medium 2021-08-07 – 9 User files is disclosed when someone called while the screen is locked #1338781 Valid Information Disclosure Medium 2022-03-14 – 9 Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic #1520685 Valid Information Disclosure Low 2022-06-09 $100 9 Generated passwords are not fully validated by HIBPValidator #1606961 Valid Authentication Low 2022-10-01 $100 9 Vulnerable moment-timezone version shipped #1708873 Valid Cryptography – 2023-02-08 – 9 No rate limit while adding Additional emails feature #1913951 Valid No weakness recorded Low 2023-05-16 – 9 Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone #3511955 Valid Access Control Medium 2026-10-27 – 9 Public collectives allow to create pages #3533697 Valid Access Control Low 2026-09-17 – 9 Bruteforcing help.nextcloud.com #145727 Informative Authentication – 2016-06-19 – 10 Uploading files to a folder where invited user don't have any EDIT privilege #145950 Valid Authentication – 2016-07-19 – 10 Reflected XSS in U2F plugin by shipping the example endpoints #192786 Valid Cross-site Scripting High 2017-03-22 – 10 bug reporting template encourages users to paste config file with passwords #196878 Valid Information Disclosure Medium 2017-04-19 – 10 Group admin can remove user from all his groups via API #199286 Valid No weakness recorded None 2017-02-23 – 10 GIT Detected #221298 Valid Information Disclosure – 2017-04-20 – 10 [FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification #232347 Valid Command and Code Injection Low 2018-07-29 $100 10 twofactor_auth bypassable if provider fails to load #317711 Valid Authentication Low 2018-09-27 – 10 The password recovery let users know whether an email address exists or not in the website #681468 Valid Authentication – 2019-11-22 – 10 Clickjacking URLS #1039805 Valid No weakness recorded – 2021-03-10 – 10 Improper input-size validation on the user new session name can result in server-side DDoS. #1153138 Valid Denial of Service Medium 2022-05-31 – 10 index.php/apps/files_sharing/shareinfo endpoint is not properly protected #1173684 Valid Denial of Service Medium 2021-08-11 $100 10 End to end encryption folder locking is not properly protected #1189174 Valid Access Control Low 2021-06-10 $250 10 Admin audit is not properly logging unsetting of expiration date #1200810 Valid No weakness recorded Low 2021-07-15 – 10 Download of file with arbitrary extension via injection into attachment header #1215263 Valid Command and Code Injection Medium 2021-08-11 $125 10 High memory usage for generating preview of broken image #1261225 Valid Memory Corruption Low 2022-03-09 – 10 RCE on 17 different Docker containers on your network #1332433 Valid Command and Code Injection Critical 2021-10-20 – 10 SQL injextion via vulnerable doctrine/dbal version #1390331 Valid SQL Injection High 2022-05-11 – 10 Possibility to force an admin to install recommended applications #1403614 Valid Cross-Site Request Forgery Low 2022-04-29 $100 10 Last video frame is still sent after video is disabled in a call #1641088 Valid Information Disclosure Medium 2022-09-16 – 10 nextcloudcmd incorrectly trusts bad TLS certificates #1699740 Valid Cryptography Low 2022-12-25 – 10 Potential directory traversal in OC\Files\Node\Folder::getFullPath #1765631 Valid File and Path Handling Medium 2023-05-04 – 10 Document content of files can be obtained through Collabora for files of other users #1788222 Valid Access Control Medium 2023-05-04 – 10 Content spoofing in lookup.nextcloud.com #171497 Valid Misconfiguration and Insecure Design Low 2016-10-10 – 11 Invalid request may lead content spoofing for phishing #213056 Valid Misconfiguration and Insecure Design – 2017-04-12 – 11 Wordpress Vulnerable to Potential Unauthorized Password Reset #226037 Valid No weakness recorded Low 2017-08-15 – 11 The session token in the URL #341372 Informative Information Disclosure Medium 2018-06-19 – 11 Self xss #388527 Valid Cross-site Scripting Low 2020-04-05 – 11 Server-Side request forgery in New-Subscription feature of the calendar app #427835 Valid Server-Side Request Forgery Medium 2019-12-12 $100 11 WordPress vulnerable to multiple attacks at https://nextcloud.com #476526 Valid Misconfiguration and Insecure Design Medium 2020-03-01 – 11 User Editable nextcloud Wiki pages of Public Repositories #498878 Valid No weakness recorded High 2019-08-31 – 11 In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access #522876 Valid Access Control High 2019-07-27 – 11 Update App Store: Django account high jacking vulnerability #761329 Valid Access Control Medium 2020-01-31 – 11