WebDAV Empty Property search leads to full CPU usage #255822 Valid Denial of Service Medium 2020-03-01 – 1 Broken link for wrong domain entry may be leveraged for Phishing, Misinformation, Serving Malware #279717 Valid No weakness recorded Low 2020-03-01 – 1 Bypass hide download Nextcloud Share #865777 Informative Input Validation and Logic High 2020-10-05 – 1 Denial of Service when entring an Array in email at seetings #961997 Informative No weakness recorded Medium 2020-08-19 – 1 Nextcloud logs ldap passwords #264426 Valid Authentication Low 2020-01-31 – 2 Missing memory corruption protection on Windows release built #380102 Valid Memory Corruption Medium 2020-08-14 – 2 Improper integrity protection of server-side encryption keys #732431 Valid Authentication High 2020-11-13 – 2 The password of a mail share is not hashed if the password is given when the share is created #885041 Valid Authentication Low 2020-10-28 – 2 **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client #165353 Valid Misconfiguration and Insecure Design Medium 2020-03-01 – 3 Bruteforce in admin panel #341074 Valid Authentication High 2020-01-31 – 3 Missing X-Content-Type-Options #369979 Valid Misconfiguration and Insecure Design – 2020-03-01 – 3 Github repo's wiki publicly editable #475114 Valid Access Control – 2020-01-31 – 3 Password authentication at newsletter.nextcloud.com discloses username list #476439 Valid Information Disclosure Low 2020-03-01 – 3 Improper confidentiality protection of server-side encryption keys #743505 Valid Authentication Medium 2020-11-13 – 3 Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers #895730 Valid Information Disclosure Low 2020-07-25 – 3 Stored XSS on scan.nextcloud.com #390728 Valid Cross-site Scripting Low 2020-03-01 – 4 Social App does not validate server certificates for outgoing connections #915585 Valid Cryptography Medium 2020-11-17 – 4 Full path disclosure vulnerability via Upload .htaccess file #919429 Informative Information Disclosure – 2020-07-09 – 4 PIN for passwordless WebAuthn is asked for but not verified #924393 Valid Authentication Medium 2020-10-28 – 4 RTLO character allowed in shared files #229170 Informative Misconfiguration and Insecure Design Medium 2020-08-17 – 5 Unauthenticated 'display name' information leak on enumeration of login names #237232 Valid Information Disclosure Medium 2020-03-01 – 5 Circle email-members have still access to a shared folder/file after they are removed from the circle #673724 Valid Access Control Low 2020-03-01 $200 5 potential RCE and XSS via file upload requiring user account and default settings #678727 Valid Command and Code Injection High 2020-04-01 – 5 Bypass configured 2FA provider with another provider that can be set up at login #722748 Valid Authentication Medium 2020-03-01 – 5 Downgrade encryption scheme and break integrity through known-plaintext attack #742588 Valid Cryptography Medium 2020-11-05 – 5 Anonymous file drop page ignores user profile visibility restrictions #752353 Valid Information Disclosure – 2020-08-03 – 5 SQL exception in JSON format #225098 Valid Information Disclosure Low 2020-01-31 – 6 DOMPurify 0.8.9 released #225777 Valid Cross-site Scripting Low 2020-03-01 – 6 HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0 #231524 Valid Cross-site Scripting Low 2020-01-31 – 6 Missing SPF flags for customerupdates.nextcloud.com #385037 Valid No weakness recorded Medium 2020-03-01 – 6 Event privacy level does not work in Thunderbird #439828 Valid No weakness recorded Medium 2020-03-01 – 6 Talk - Leak of password-protected room name via already existent resource addition #662218 Valid Authentication Low 2020-03-01 $150 6 Email Spoofing #793532 Duplicate Input Validation and Logic Medium 2020-02-20 – 6 Recently change email but still login with old email #986459 Informative Authentication High 2020-09-29 – 6 Leaked of Profile Image from URL changing #1022211 Informative No weakness recorded – 2020-11-17 – 6 (Authenticated) RCE by bypassing of the .htaccess blacklist #228825 Valid Command and Code Injection Critical 2020-03-01 – 7 Android content provider exposes password-protected share password hashes #242727 Valid Information Disclosure Low 2020-01-31 $75 7 Disabled user can reset their password #261297 Valid Misconfiguration and Insecure Design None 2020-03-01 – 7 Improper protection of FileContentProvider #331302 Valid Access Control Low 2020-03-01 – 7 SSRF on local storage of iOS mobile #746541 Valid Server-Side Request Forgery Medium 2020-03-01 – 7 Delete All Data of Any User #220385 Valid No weakness recorded Low 2020-03-01 – 8 Directory listing is enabled that exposes non public data through multiple path #690796 Valid Information Disclosure Low 2020-02-01 – 8 Improper access control to messages of Social app #921717 Valid Access Control Medium 2020-11-17 – 8 Password of failed (2FA) login attempt is stored in log #244092 Valid Authentication High 2020-03-01 – 9 Share recipient can modify a share's expiration date #447494 Valid Access Control Medium 2020-01-31 $100 9 Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file #661051 Valid Misconfiguration and Insecure Design Low 2020-11-05 – 9 Mail does not verify IMAP/SMTP host connected via TLS #803734 Valid Cryptography Medium 2020-06-03 – 9 PHPUnit is included in groupfolders release package potentially causing RCE #820146 Valid No weakness recorded – 2020-06-25 – 9 Reduced purmations on encryption #852841 Valid Cryptography Low 2020-10-28 – 9 Allows any user to share their "Root" level folder by sharing "." #889795 Valid Access Control None 2020-06-03 – 9