Username Enumeration #667613 Informative Information Disclosure Low 2019-11-11 – – Directory Listing In Subdomain Of nextcloud.com #218199 Informative Information Disclosure Low 2017-07-14 – 1 Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware #279717 Valid No weakness recorded Low 2020-03-01 – 1 Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/ #403909 Duplicate Information Disclosure Low 2019-01-07 – 1 Nextcloud Clickjacking Vulnerability #710996 Duplicate Misconfiguration and Insecure Design Low 2019-11-11 – 1 xss on setup config page #812028 Valid Cross-site Scripting Low 2021-02-14 – 1 Server version/OS type disclosure via HTTP Response Header #215372 Informative No weakness recorded Low 2017-03-23 – 2 Stored XSS in Gallery application (NC-SA-2017-010) #222838 Valid Cross-site Scripting Low 2017-06-06 – 2 Nextcloud logs ldap passwords #264426 Valid Authentication Low 2020-01-31 – 2 Content spoofing on https://surveyserver.nextcloud.com #473144 Valid Injection and Smuggling Low 2021-02-14 – 2 WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED) #696198 Informative Information Disclosure Low 2019-11-11 – 2 The password of a mail share is not hashed if the password is given when the share is created #885041 Valid Authentication Low 2020-10-28 – 2 DoS attack against the client when entering a long password #949712 Valid Denial of Service Low 2021-02-14 – 2 Trusted server shared secret stored unencrypted in the database #1173670 Informative Access Control Low 2021-06-16 – 2 Content (Text) Injection at https://nextcloud.com #222805 Informative Misconfiguration and Insecure Design Low 2017-05-15 – 3 Password authentication at newsletter.nextcloud.com discloses username list #476439 Valid Information Disclosure Low 2020-03-01 – 3 Veracode and security audit record are publicly available #669365 Informative Information Disclosure Low 2019-09-10 – 3 New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference Low 2021-02-14 – 3 Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers #895730 Valid Information Disclosure Low 2020-07-25 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded Low 2021-06-16 – 3 No admin audit log for auth tokens #1200992 Informative No weakness recorded Low 2021-06-16 – 3 Filename enumeration && DoS #174524 Valid Denial of Service Low 2017-02-09 – 4 Content Spoofing in "files" app #179073 Valid Misconfiguration and Insecure Design Low 2017-03-06 $50 4 The email API to reset password is unlimited and can be used as a email bomb #222080 Duplicate Access Control Low 2017-04-20 – 4 Disclosed Version of PORTS SSH|HTTP|SSL #358102 Duplicate Information Disclosure Low 2018-06-14 – 4 Stored XSS on scan.nextcloud.com #390728 Valid Cross-site Scripting Low 2020-03-01 – 4 No admin audit entry for enabling/disabling 2FA #1200989 Informative No weakness recorded Low 2021-06-16 – 4 Brute force protections don't work #1596918 Valid Information Disclosure Low 2022-09-03 – 4 @nextcloud/logger NPM package brings vulnerable ansi-regex version #1607601 Valid Denial of Service Low 2022-07-29 – 4 More content spoofing through dir param in the files app #154827 Valid Misconfiguration and Insecure Design Low 2016-11-04 $50 5 Limitation of app specific password scope can be bypassed (NC-SA-2017-009) #191979 Valid Access Control Low 2017-05-08 $300 5 Circle email-members have still access to a shared folder/file after they are removed from the circle #673724 Valid Access Control Low 2020-03-01 $200 5 Talk discloses turn server to anybody #1195593 Informative No weakness recorded Low 2021-05-26 – 5 Calendar name length not validated before writing to database #1596148 Valid Denial of Service Low 2022-12-01 – 5 the complete server installation path is visible in cloud/user endpoint #1690510 Valid Information Disclosure Low 2023-03-30 – 5 XSS in Desktop Client via user status and information #1707977 Valid Injection and Smuggling Low 2022-11-25 – 5 XSS in Desktop Client in call notification popup #1711847 Valid Injection and Smuggling Low 2022-11-25 – 5 Insecure randomness for default password in file sharing when password policy app is disabled #1745702 Valid Cryptography Low 2023-03-30 – 5 Wordpress Version Disclosure Bug On Nextcloud #188132 Informative Information Disclosure Low 2016-12-04 – 6 Content Spoofing/Text Injection in nextcloud.com #213360 Valid Misconfiguration and Insecure Design Low 2017-04-19 – 6 SQL exception in JSON format #225098 Valid Information Disclosure Low 2020-01-31 – 6 DOMPurify 0.8.9 released #225777 Valid Cross-site Scripting Low 2020-03-01 – 6 HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0 #231524 Valid Cross-site Scripting Low 2020-01-31 – 6 Talk - Leak of password-protected room name via already existent resource addition #662218 Valid Authentication Low 2020-03-01 $150 6 HTML Injection on "polls" app - comments section (possibly XSS) #1108420 Valid Cross-site Scripting Low 2021-03-31 – 6 Text app leaks file path of shared files #1246721 Valid Information Disclosure Low 2021-08-11 – 6 Error in Deleting Deck cards attachment reveals the full path of the website #1354334 Valid Information Disclosure Low 2022-05-20 – 6 A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22 #1726445 Valid No weakness recorded Low 2022-12-10 – 6 Ability to control the filename when uploading a logo or favicon on theming #1781751 Valid Misconfiguration and Insecure Design Low 2023-04-10 – 6 XSS on IOS app via HTML rendering #157434 Valid Cross-site Scripting Low 2017-04-20 – 7