Contacts only sanitizes PHOTO svg if mime type is all lower case #1789602 Valid Cross-site Scripting None 2023-06-24 – 3 Website PHP source code returned in javascript #1794462 Valid No weakness recorded Medium 2023-04-10 – 4 Reference fetch can saturate the server bandwidth for 10 seconds #1806223 Valid Denial of Service Medium 2023-04-29 – 4 user_oidc app is missing bruteforce protection #1954711 Valid Authentication Medium 2023-06-23 – 4 the complete server installation path is visible in cloud/user endpoint #1690510 Valid Information Disclosure Low 2023-03-30 – 5 Name collision of shared folders #1697281 Valid Input Validation and Logic Medium 2023-04-29 – 5 Insecure randomness for default password in file sharing when password policy app is disabled #1745702 Valid Cryptography Low 2023-03-30 – 5 Targeted phishing attacks in Login flow v2 #1169033 Informative Input Validation and Logic Medium 2023-03-03 – 6 Ability to control the filename when uploading a logo or favicon on theming #1781751 Valid Misconfiguration and Insecure Design Low 2023-04-10 – 6 Open redirect on "Unsupported browser" warning #1977222 Valid Open Redirect Medium 2023-06-22 $150 8 Vulnerable moment-timezone version shipped #1708873 Valid Cryptography – 2023-02-08 – 9 No rate limit while adding Additional emails feature #1913951 Valid No weakness recorded Low 2023-05-16 – 9 Potential directory traversal in OC\Files\Node\Folder::getFullPath #1765631 Valid File and Path Handling Medium 2023-05-04 – 10 Document content of files can be obtained through Collabora for files of other users #1788222 Valid Access Control Medium 2023-05-04 – 10 Mail app - Blind SSRF via Sierve server fonctionnality and sieveHost parameter #1741525 Valid Server-Side Request Forgery Low 2023-02-06 – 11 Hide download previews are accessible without a watermark #1745755 Valid Access Control Low 2023-05-04 – 11 Mail app - blind SSRF via smtpHost parameter #1746582 Valid Server-Side Request Forgery Low 2023-02-06 – 11 New AppPassword can be generated without password confirmation #2067572 Valid Access Control High 2023-08-10 $250 11 Missing character limitation allows to put generate a database error #1596059 Valid Denial of Service Low 2023-01-09 – 12 Mail app stores cleartext password in database until OAUTH2 setup is done #1806275 Valid Authentication Low 2023-03-08 – 12 No password length restriction in reset password endpoint #1820864 Valid Denial of Service Low 2023-02-09 – 12 Text does not respect 'Allow download' permissions #1965156 Valid Access Control Low 2023-08-23 $250 12 Desktop client does not verify received singed certificate in end to end encryption #1679267 Valid Cryptography Medium 2023-04-27 $1,000 13 Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link #1720043 Valid Command and Code Injection Medium 2023-02-10 – 13 Secure view trivial to bypass #1724021 Valid Access Control Medium 2023-03-30 $150 13 Mail app - blind SSRF via imapHost parameter #1736390 Valid Server-Side Request Forgery Low 2023-02-06 – 13 Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle #1893186 Valid Cross-site Scripting Medium 2023-05-15 – 13 Reference caching can leak data to unauthorized users #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 Blind SSRF as normal user from mailapp #1913095 Valid Server-Side Request Forgery Low 2023-05-30 – 14 Messages can still be seen on conversation after expiring when cron is misconfigured #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Responsive Server-side Request Forgery (SSRF) #1895874 Valid Server-Side Request Forgery Medium 2023-10-19 – 15 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 HEIC image preview can be used to invoke Imagick #1261413 Valid Information Disclosure Critical 2023-01-07 – 16 Missing rate limiting on password reset functionality allows to send lot of emails #1691195 Valid Access Control Low 2023-03-05 $100 17 Suspicious login app ships old league/flysystem version #1720822 Valid Misconfiguration and Insecure Design – 2023-02-08 – 17 Chat room member disclosure via autocomplete API #1850407 Valid Access Control Medium 2023-03-25 – 17 Missing brute force protection for passwords of password protected share links #1894653 Valid Authentication Low 2023-04-25 – 17 Users can set up workflows using restricted and invisible system tags #1895976 Valid Access Control Medium 2023-05-17 – 17 App pin of the Android app can be bypassed via 3rdparty apps generating deep links #1825679 Valid Authentication Low 2023-05-04 – 18 Memcached used as RateLimiter backend is no-op #2110945 Valid Authentication Medium 2023-11-12 – 19 Missing brute force protection on OAuth2 API controller #1258448 Valid Authentication Medium 2023-08-10 $500 20 Self XSS when pasting HTML into Text app with Ctrl+Shift+V #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Possibility to delete files attached to deck cards of other users #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Full Passcode bypass on Nextcloud App iOS #1847368 Valid Access Control Low 2023-04-10 – 21 Lack of bruteforce protection for TOTP 2FA #1265709 Valid Authentication Medium 2023-03-26 $750 22 Improper restriction of excessive authentication attempts on WebDAV endpoint #1924212 Valid Authentication Medium 2023-08-10 – 23 User scoped external storage can be used to gather credentials of other users #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Error in Booking an appointment reveals the full path of the website #1841408 Valid Access Control Low 2023-06-18 – 24 Missing brute force protection on password confirmation modal #1842114 Valid Authentication Medium 2023-03-21 – 24 Cards in Deck are readable by any user Analysed #1331728 Valid Information Disclosure Medium 2023-03-26 – 25