xss on setup config page #812028 Valid Cross-site Scripting Low 2021-02-14 – 1 Content spoofing on https://surveyserver.nextcloud.com #473144 Valid Injection and Smuggling Low 2021-02-14 – 2 External Storage - WebDAV - New user has access to storage from deleted user (same user-ID) #549831 Valid Information Disclosure – 2021-02-14 – 2 DoS attack against the client when entering a long password #949712 Valid Denial of Service Low 2021-02-14 – 2 Trusted server shared secret stored unencrypted in the database #1173670 Informative Access Control Low 2021-06-16 – 2 Bypassing Passcode/Device credentials #747726 Valid Access Control – 2021-01-15 – 3 External storage app saves password for all users in the database #867164 Valid Authentication High 2021-03-01 – 3 New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference Low 2021-02-14 – 3 Federated shares are not password protected #1167817 Informative Authentication Medium 2021-06-16 – 3 Nextcloud update checks leaks information #1173411 Informative Information Disclosure None 2021-05-01 – 3 Default Nextcloud allows http federated shares #1183302 Informative No weakness recorded Medium 2021-05-11 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded Low 2021-06-16 – 3 No admin audit log for auth tokens #1200992 Informative No weakness recorded Low 2021-06-16 – 3 DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data. #1147611 Valid Denial of Service High 2021-06-01 – 4 No admin audit entry for enabling/disabling 2FA #1200989 Informative No weakness recorded Low 2021-06-16 – 4 Ratelimits do not apply to OCS DataResponse #1214158 Valid Authentication None 2021-08-11 – 4 No set limit to try to login in "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" page. #855304 Informative Authentication – 2021-04-20 – 5 [nextcloud.com] Control character allowed in Submit Question #1081211 Valid Access Control Medium 2021-01-20 – 5 Create alias does not validate account id #1129996 Valid Access Control Medium 2021-06-01 – 5 Talk discloses turn server to anybody #1195593 Informative No weakness recorded Low 2021-05-26 – 5 nextcloud-snap CircleCI project has vulnerable configuration which can lead to exposing secrets #794407 Valid Authentication High 2021-01-29 – 6 Malicious apps can crash Nextcloud Android client by sending malformed intents #859136 Valid No weakness recorded – 2021-06-17 – 6 Formula Injection vulnerability in CSV export feature #928280 Valid Command and Code Injection Medium 2021-03-04 – 6 Potential DDoS when posting long data into workflow validation rules #1018146 Valid Denial of Service Medium 2021-01-21 – 6 bypassing dashboard without account + Information disclosure trough websockets #1102780 Informative Access Control High 2021-04-20 – 6 HTML Injection on "polls" app - comments section (possibly XSS) #1108420 Valid Cross-site Scripting Low 2021-03-31 – 6 ApiService#fetch serves content as text/html and inline Content-Disposition #1241460 Valid Cross-site Scripting – 2021-08-11 – 6 Text app leaks file path of shared files #1246721 Valid Information Disclosure Low 2021-08-11 – 6 The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18) #888261 Valid Access Control Low 2021-03-04 – 7 Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki #906322 Valid Access Control – 2021-01-15 – 7 Unexpected federated shares added via public link #1167767 Informative Access Control Medium 2021-04-26 – 7 Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud #1167919 Valid Access Control Low 2021-05-31 – 7 Password policy changes not enforced for existing passwords #1169335 Informative Authentication Low 2021-04-26 – 7 Serverinfo endpoints are not bruteforce protected nor are tokens properly generated #1210458 Valid No weakness recorded Low 2021-06-16 – 7 Acting under any different user via DB-stored credentials #1061591 Valid Access Control High 2021-03-01 – 8 Nextcloud deck sharee search leaks searches to lookupserver by default #1167958 Valid Access Control Low 2021-05-26 – 9 Webauthn tokens are not removed on user deletion #1202590 Valid Access Control Medium 2021-08-07 – 9 Clickjacking URLS #1039805 Valid No weakness recorded – 2021-03-10 – 10 index.php/apps/files_sharing/shareinfo endpoint is not properly protected #1173684 Valid Denial of Service Medium 2021-08-11 $100 10 End to end encryption folder locking is not properly protected #1189174 Valid Access Control Low 2021-06-10 $250 10 Admin audit is not properly logging unsetting of expiration date #1200810 Valid No weakness recorded Low 2021-07-15 – 10 Download of file with arbitrary extension via injection into attachment header #1215263 Valid Command and Code Injection Medium 2021-08-11 $125 10 RCE on 17 different Docker containers on your network #1332433 Valid Command and Code Injection Critical 2021-10-20 – 10 Default settings leak federated cloud id to lookup server of all users #1173436 Valid Information Disclosure Low 2021-06-10 $350 11 Add to your nextcloud endpoint is not properly protected #1192144 Valid No weakness recorded Low 2021-08-11 $100 11 Trusted servers exchange can be triggered by attacker #1167853 Valid Access Control Medium 2021-06-10 $750 12 Stored XSS in markdown file with Nextcloud Talk using Internet Explorer #1023787 Valid Cross-site Scripting Low 2021-02-19 – 13 End to end encryption public key is not properly verified on Desktop and Android #1189162 Valid No weakness recorded Medium 2021-09-23 $1,500 13 Android app does not clear end to end encryption keys #1189168 Valid No weakness recorded Low 2021-06-16 $100 14 Virtual Data Room / Hide download on collabora is easy to bypass #1194606 Valid Access Control High 2021-08-07 $150 14