[Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter #153251 Valid Misconfiguration and Insecure Design – 2016-12-05 – 1 demo.nextcloud.com: Content spoofing due to default Apache Error Page #156425 Valid Misconfiguration and Insecure Design – 2016-08-30 – 1 Content Injection - demo.nextcloud.com #161323 Valid Misconfiguration and Insecure Design – 2016-08-26 – 1 Slow Http attack on nextcloud(DOS) #163823 Valid Denial of Service – 2016-10-05 – 1 xss on demo.nextcloud.com due to outdated version #177713 Valid Cross-site Scripting – 2016-11-26 – 1 WebDAV Empty Property search leads to full CPU usage #255822 Valid Denial of Service – 2020-03-01 – 1 Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware #279717 Valid No weakness recorded – 2020-03-01 – 1 xss on setup config page #812028 Valid Cross-site Scripting – 2021-02-14 – 1 Nextcloud server software: Content Spoofing #145463 Valid Misconfiguration and Insecure Design – 2016-07-19 – 2 Content Injection 404 page #145849 Valid Misconfiguration and Insecure Design – 2016-06-19 – 2 Content Injection in subdomain #145854 Valid Misconfiguration and Insecure Design – 2016-06-19 – 2 Content spoofing in cloud.nextcloud.com #152925 Valid Misconfiguration and Insecure Design – 2016-08-30 – 2 Arbitrary File Upload in Logo & Log in image Theming setting. #155690 Valid Cross-site Scripting – 2016-10-05 – 2 Content Injection - apps.nextcloud.com #161299 Valid Misconfiguration and Insecure Design – 2016-08-26 – 2 Share tokens for public calendars disclosed (NC-SA-2017-011) #218876 Valid Information Disclosure – 2017-06-06 – 2 Stored XSS in Gallery application (NC-SA-2017-010) #222838 Valid Cross-site Scripting – 2017-06-06 – 2 Nextcloud logs ldap passwords #264426 Valid Authentication – 2020-01-31 – 2 Missing memory corruption protection on Windows release built #380102 Valid Memory Corruption – 2020-08-14 – 2 Content spoofing on https://surveyserver.nextcloud.com #473144 Valid Injection and Smuggling – 2021-02-14 – 2 External Storage - WebDAV - New user has access to storage from deleted user (same user-ID) #549831 Valid Information Disclosure – 2021-02-14 – 2 Improper integrity protection of server-side encryption keys #732431 Valid Authentication – 2020-11-13 – 2 The password of a mail share is not hashed if the password is given when the share is created #885041 Valid Authentication – 2020-10-28 – 2 DoS attack against the client when entering a long password #949712 Valid Denial of Service – 2021-02-14 – 2 No password confirmation required when using apptoken on sensitive endpoint #3566607 Valid Access Control Medium 2026-10-27 – 2 Content Spoofing #145374 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 https://newsletter.nextcloud.com Directory listening and Information Disclosure #145603 Valid Information Disclosure – 2016-06-18 – 3 No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers #145612 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content Spoofing/Text Injection - docs.nextcloud.org #145850 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content injection in subdomain #145853 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 xss for admin of https://newsletter.nextcloud.com #153799 Valid Cross-site Scripting – 2017-02-17 – 3 demo.nextcloud.com: Content spoofing due to default Apache Error Page #155189 Valid Misconfiguration and Insecure Design – 2016-09-29 – 3 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3 **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client #165353 Valid Misconfiguration and Insecure Design – 2020-03-01 – 3 ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service) #237860 Valid Denial of Service – 2017-06-08 – 3 Bruteforce in admin panel #341074 Valid Authentication – 2020-01-31 – 3 Missing X-Content-Type-Options #369979 Valid Misconfiguration and Insecure Design – 2020-03-01 – 3 Github repo's wiki publicly editable #475114 Valid Access Control – 2020-01-31 – 3 Password authentication at newsletter.nextcloud.com discloses username list #476439 Valid Information Disclosure – 2020-03-01 – 3 W3 Total Cache plugin multiple vulnerabilities #561805 Valid No weakness recorded – 2019-07-28 – 3 Persistent XSS on favorite via filename #685491 Valid Cross-site Scripting – 2019-12-12 – 3 Improper confidentiality protection of server-side encryption keys #743505 Valid Authentication – 2020-11-13 – 3 Bypassing Passcode/Device credentials #747726 Valid Access Control – 2021-01-15 – 3 External storage app saves password for all users in the database #867164 Valid Authentication – 2021-03-01 – 3 New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference – 2021-02-14 – 3 Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers #895730 Valid Information Disclosure – 2020-07-25 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded – 2021-06-16 – 3 Contacts only sanitizes PHOTO svg if mime type is all lower case #1789602 Valid Cross-site Scripting – 2023-06-24 – 3 Unauthenticated Persistent Denial-of-Service via Federated Share Injection #3679640 Valid Denial of Service High 2026-10-27 – 3 stats.nextcloud.com: Content Injection #145375 Valid Misconfiguration and Insecure Design – 2016-07-17 – 4 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4