[Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter #153251 Valid Misconfiguration and Insecure Design – 2016-12-05 – 1 demo.nextcloud.com: Content spoofing due to default Apache Error Page #156425 Valid Misconfiguration and Insecure Design – 2016-08-30 – 1 Content Injection - demo.nextcloud.com #161323 Valid Misconfiguration and Insecure Design – 2016-08-26 – 1 Slow Http attack on nextcloud(DOS) #163823 Valid Denial of Service – 2016-10-05 – 1 xss on demo.nextcloud.com due to outdated version #177713 Valid Cross-site Scripting – 2016-11-26 – 1 help.nextcloud.com: Session Management Issue #145430 Informative No weakness recorded – 2016-06-17 – 2 Nextcloud server software: Content Spoofing #145463 Valid Misconfiguration and Insecure Design – 2016-07-19 – 2 Directory Listing On download.nextcloud.com & Practical Attacks on PGP (Pretty Good Privacy) #145552 Informative Cryptography – 2016-06-17 – 2 Lost Password CSRF #145583 Informative Cross-Site Request Forgery – 2016-06-19 – 2 Content Injection 404 page #145849 Valid Misconfiguration and Insecure Design – 2016-06-19 – 2 Content Injection in subdomain #145854 Valid Misconfiguration and Insecure Design – 2016-06-19 – 2 Deny access to download.nextcloud.com + folders #146314 Informative Information Disclosure – 2016-06-21 – 2 Content spoofing in cloud.nextcloud.com #152925 Valid Misconfiguration and Insecure Design – 2016-08-30 – 2 Arbitrary File Upload in Logo & Log in image Theming setting. #155690 Valid Cross-site Scripting – 2016-10-05 – 2 Content Injection - apps.nextcloud.com #161299 Valid Misconfiguration and Insecure Design – 2016-08-26 – 2 Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads) #164520 Duplicate Cross-site Scripting – 2016-08-31 – 2 BruteForce in to Admin Account #188205 Informative Authentication – 2016-12-04 – 2 Content Spoofing #145374 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 No permission set on Activities [Android App] #145402 Informative Authentication – 2016-06-20 – 3 No rate limiting on password protected shared file link #145462 Duplicate Authentication – 2016-06-20 – 3 https://newsletter.nextcloud.com Directory listening and Information Disclosure #145603 Valid Information Disclosure – 2016-06-18 – 3 No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers #145612 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Bruteforce attack is possible on newsletter.nextcloud.com #145722 Informative Authentication – 2016-06-19 – 3 Content Spoofing/Text Injection - docs.nextcloud.org #145850 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content injection in subdomain #145853 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 The application uses basic authentication. #151847 Informative Authentication – 2016-07-18 – 3 demo.nextcloud.com: Content spoofing due to default Apache Error Page #155189 Valid Misconfiguration and Insecure Design – 2016-09-29 – 3 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3 Login Hints on Admin Panel #188195 Informative Misconfiguration and Insecure Design – 2016-12-05 – 3 stats.nextcloud.com: Content Injection #145375 Valid Misconfiguration and Insecure Design – 2016-07-17 – 4 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4 help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running #145409 Valid Denial of Service – 2016-07-27 – 4 nextcloud.com: Mail Bombing ( No Rate Limiting On Sending Emails On Contact us Page) #145458 Valid Memory Corruption – 2016-07-17 – 4 nextcloud.com: Directory listening for 'wp-includes' forders #145495 Valid Information Disclosure – 2016-06-17 – 4 newsletter.nextcloud.com: Bypass firewall protection #145730 Valid Authentication – 2016-07-18 – 4 WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available #146093 Informative Information Disclosure – 2016-06-22 – 4 REG: Content provider information leakage #146179 Informative Command and Code Injection – 2016-06-24 – 4 [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS #148897 Valid Cross-site Scripting – 2016-11-02 – 4 Bookmarks: Delete all existing bookmarks of a user #154529 Valid Access Control – 2016-08-08 – 4 Content spoofing due to the improper behavior of the 403 page in Private Server #177335 Valid Misconfiguration and Insecure Design – 2016-10-31 – 4 Stored XSS on new Calling plugin (spreed) #190870 Valid Cross-site Scripting – 2016-12-13 – 4 nextcloud.com: Content Injection Custom 404 Error #145344 Valid Misconfiguration and Insecure Design – 2016-06-17 – 5 Vulnerable Javascript library #145517 Informative Information Disclosure – 2016-06-17 – 5 Business/Functional logic bypass: Remove admins from admin group. #145745 Informative Access Control – 2016-06-19 – 5 Email ID Disclosure. #146106 Informative Information Disclosure – 2016-06-20 – 5 More content spoofing through dir param in the files app #154827 Valid Misconfiguration and Insecure Design – 2016-11-04 $50 5 Information Disclosure of .htaccess file in Private Server/Subdomain #163106 Valid Information Disclosure – 2016-08-26 – 5 Share owner has no possibility to list all existing derived shares #145452 Valid Authentication – 2016-12-13 – 6 Directory listening enabled in: 88.198.160.130 #156510 Valid Information Disclosure – 2016-09-04 – 6 Wordpress Version Disclosure Bug On Nextcloud #188132 Informative Information Disclosure – 2016-12-04 – 6