Talk discloses turn server to anybody #1195593 Informative No weakness recorded Low 2021-05-26 – 5 Create alias does not validate account id #1129996 Valid Access Control Medium 2021-06-01 – 5 [nextcloud.com] Control character allowed in Submit Question #1081211 Valid Access Control Medium 2021-01-20 – 5 No set limit to try to login in "https://auth.nextcloud.com/auth/realms/master/protocol/openid-connect/auth" page. #855304 Informative Authentication – 2021-04-20 – 5 Anonymous file drop page ignores user profile visibility restrictions #752353 Valid Information Disclosure – 2020-08-03 – 5 Downgrade encryption scheme and break integrity through known-plaintext attack #742588 Valid Cryptography Medium 2020-11-05 – 5 Bypass configured 2FA provider with another provider that can be set up at login #722748 Valid Authentication Medium 2020-03-01 – 5 potential RCE and XSS via file upload requiring user account and default settings #678727 Valid Command and Code Injection High 2020-04-01 – 5 Circle email-members have still access to a shared folder/file after they are removed from the circle #673724 Valid Access Control Low 2020-03-01 $200 5 Vulnerable W3 Total Cache plugin version in use on nextcloud.com #579116 Informative Cross-Site Request Forgery Medium 2019-06-21 – 5 Missing DNSSEC #509390 Valid Cryptography Medium 2019-08-29 – 5 HTML injection with AutoComplete suggestions #383117 Valid Cross-site Scripting None 2018-08-10 – 5 Banner Grabbing - Apache Server Version Disclousure #269449 Informative Information Disclosure – 2018-05-17 – 5 Unauthenticated 'display name' information leak on enumeration of login names #237232 Valid Information Disclosure Medium 2020-03-01 – 5 Shared file link - password protection bypass under certain conditions #231917 Valid Information Disclosure Medium 2018-09-25 $50 5 RTLO character allowed in shared files #229170 Informative Misconfiguration and Insecure Design Medium 2020-08-17 – 5 Missing Rate Limiting protection leading to mass triggering of e-mails #224927 Valid Misconfiguration and Insecure Design Medium 2017-06-05 – 5 Content spoofing due to the improper behavior of the 403 page #212770 Valid Misconfiguration and Insecure Design – 2017-05-18 – 5 Version 4.7.2 of wordpress is vulnerable #211206 Valid No weakness recorded High 2017-03-07 – 5 LDAP login possible even though account doesn't match user filter #205908 Valid Authentication None 2019-07-27 – 5 Missing SPF Flags on nextcloud.com #205250 Duplicate Misconfiguration and Insecure Design – 2017-02-10 – 5 Drone Nextcloud #198773 Informative No weakness recorded – 2017-02-12 – 5 HTTP-Basic Authentication on logs.nextcloud.com #198673 Informative Misconfiguration and Insecure Design – 2017-01-17 – 5 Limitation of app specific password scope can be bypassed (NC-SA-2017-009) #191979 Valid Access Control Low 2017-05-08 $300 5 URI scheme bypass in mail app lead to HTML content spoof and opener control #175085 Valid Misconfiguration and Insecure Design – 2017-01-12 – 5 Dav sharing permissions issue #174896 Valid Access Control Medium 2017-05-20 – 5 Information Disclosure of .htaccess file in Private Server/Subdomain #163106 Valid Information Disclosure – 2016-08-26 – 5 More content spoofing through dir param in the files app #154827 Valid Misconfiguration and Insecure Design Low 2016-11-04 $50 5 Email ID Disclosure. #146106 Informative Information Disclosure – 2016-06-20 – 5 Business/Functional logic bypass: Remove admins from admin group. #145745 Informative Access Control – 2016-06-19 – 5 Vulnerable Javascript library #145517 Informative Information Disclosure – 2016-06-17 – 5 nextcloud.com: Content Injection Custom 404 Error #145344 Valid Misconfiguration and Insecure Design – 2016-06-17 – 5 Possible RCE #145343 Informative Command and Code Injection – 2018-03-08 – 5 Files Confidential tagging can be bypassed with # in filename #3682163 Valid Access Control Medium 2026-10-27 – 4 user_oidc app is missing bruteforce protection #1954711 Valid Authentication Medium 2023-06-23 – 4 Reference fetch can saturate the server bandwidth for 10 seconds #1806223 Valid Denial of Service Medium 2023-04-29 – 4 Website PHP source code returned in javascript #1794462 Valid No weakness recorded Medium 2023-04-10 – 4 Exception logging in Sharepoint app reveals clear-text connection details #1652903 Valid Cryptography Medium 2022-11-26 – 4 @nextcloud/logger NPM package brings vulnerable ansi-regex version #1607601 Valid Denial of Service Low 2022-07-29 – 4 Brute force protections don't work #1596918 Valid Information Disclosure Low 2022-09-03 – 4 Ratelimits do not apply to OCS DataResponse #1214158 Valid Authentication None 2021-08-11 – 4 No admin audit entry for enabling/disabling 2FA #1200989 Informative No weakness recorded Low 2021-06-16 – 4 DoS due to improper input validation can break the admin access into the user data will disallow him from editing that user's data. #1147611 Valid Denial of Service High 2021-06-01 – 4 PIN for passwordless WebAuthn is asked for but not verified #924393 Valid Authentication Medium 2020-10-28 – 4 Full path disclosure vulnerability via Upload .htaccess file #919429 Informative Information Disclosure – 2020-07-09 – 4 Social App does not validate server certificates for outgoing connections #915585 Valid Cryptography Medium 2020-11-17 – 4 SignUp using Fake Email #664200 Informative Input Validation and Logic – 2019-08-02 – 4 Stored XSS on scan.nextcloud.com #390728 Valid Cross-site Scripting Low 2020-03-01 – 4 Disclosed Version of PORTS SSH|HTTP|SSL #358102 Duplicate Information Disclosure Low 2018-06-14 – 4 Banner Grabbing - Apache Server Version Disclosure #348801 Informative Information Disclosure – 2018-05-17 – 4