Information Exposure Through Directory Listing #260221 Informative Information Disclosure None 2018-05-17 – 4 Nextcloud Server Remote Command Execution #226896 N/A No weakness recorded High 2017-05-10 – 4 Clickjacking In https://demo.nextcloud.com #222762 N/A Misconfiguration and Insecure Design Critical 2017-05-20 – 4 The email API to reset password is unlimited and can be used as a email bomb #222080 Duplicate Access Control Low 2017-04-20 – 4 SSRF at apps.nextcloud.com/developer/apps/releases/new #213358 Informative Server-Side Request Forgery – 2017-04-20 – 4 Email Spoofing #200762 Informative Misconfiguration and Insecure Design – 2017-01-25 – 4 Review remote code execution in SwiftMailer #194564 Valid Command and Code Injection None 2017-02-18 – 4 Stored XSS on new Calling plugin (spreed) #190870 Valid Cross-site Scripting High 2016-12-13 – 4 Content Spoofing in "files" app #179073 Valid Misconfiguration and Insecure Design Low 2017-03-06 $50 4 Content spoofing due to the improper behavior of the 403 page in Private Server #177335 Valid Misconfiguration and Insecure Design None 2016-10-31 – 4 Filename enumeration && DoS #174524 Valid Denial of Service Low 2017-02-09 – 4 Bypassing quota limit #173622 Valid Access Control None 2017-03-10 – 4 Bookmarks: Delete all existing bookmarks of a user #154529 Valid Access Control – 2016-08-08 – 4 Information disclosure #152499 N/A Information Disclosure – 2017-04-20 – 4 [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS #148897 Valid Cross-site Scripting Medium 2016-11-02 – 4 REG: Content provider information leakage #146179 Informative Command and Code Injection – 2016-06-24 – 4 WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available #146093 Informative Information Disclosure – 2016-06-22 – 4 newsletter.nextcloud.com: Bypass firewall protection #145730 Valid Authentication – 2016-07-18 – 4 nextcloud.com: Directory listening for 'wp-includes' forders #145495 Valid Information Disclosure – 2016-06-17 – 4 nextcloud.com: Mail Bombing ( No Rate Limiting On Sending Emails On Contact us Page) #145458 Valid Memory Corruption – 2016-07-17 – 4 help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running #145409 Valid Denial of Service – 2016-07-27 – 4 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4 stats.nextcloud.com: Content Injection #145375 Valid Misconfiguration and Insecure Design – 2016-07-17 – 4 Unauthenticated Persistent Denial-of-Service via Federated Share Injection #3679640 Valid Denial of Service High 2026-10-27 – 3 Contacts only sanitizes PHOTO svg if mime type is all lower case #1789602 Valid Cross-site Scripting None 2023-06-24 – 3 Information Exposure Through Directory Listing vulnerability #1476709 Informative Information Disclosure Medium 2022-02-11 – 3 No admin audit log for auth tokens #1200992 Informative No weakness recorded Low 2021-06-16 – 3 Ransomware protection is missing extentions #1195568 Valid No weakness recorded Low 2021-06-16 – 3 Default Nextcloud allows http federated shares #1183302 Informative No weakness recorded Medium 2021-05-11 – 3 Nextcloud update checks leaks information #1173411 Informative Information Disclosure None 2021-05-01 – 3 Federated shares are not password protected #1167817 Informative Authentication Medium 2021-06-16 – 3 Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers #895730 Valid Information Disclosure Low 2020-07-25 – 3 New users can read all Nextcloud Deck data from previous user with same username #882258 Valid Insecure Direct Object Reference Low 2021-02-14 – 3 External storage app saves password for all users in the database #867164 Valid Authentication High 2021-03-01 – 3 Bypassing Passcode/Device credentials #747726 Valid Access Control – 2021-01-15 – 3 Improper confidentiality protection of server-side encryption keys #743505 Valid Authentication Medium 2020-11-13 – 3 Persistent XSS on favorite via filename #685491 Valid Cross-site Scripting Medium 2019-12-12 – 3 Veracode and security audit record are publicly available #669365 Informative Information Disclosure Low 2019-09-10 – 3 W3 Total Cache plugin multiple vulnerabilities #561805 Valid No weakness recorded – 2019-07-28 – 3 XSS On Nextcloud Integrated with zimbra drive #498852 Informative Cross-site Scripting Medium 2019-11-11 – 3 Password authentication at newsletter.nextcloud.com discloses username list #476439 Valid Information Disclosure Low 2020-03-01 – 3 Github repo's wiki publicly editable #475114 Valid Access Control – 2020-01-31 – 3 Retrieval and alteration of exposed media on Android Oreo #462441 Informative Information Disclosure Medium 2019-06-26 – 3 Missing X-Content-Type-Options #369979 Valid Misconfiguration and Insecure Design – 2020-03-01 – 3 Bruteforce in admin panel #341074 Valid Authentication High 2020-01-31 – 3 ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service) #237860 Valid Denial of Service High 2017-06-08 – 3 Content (Text) Injection at https://nextcloud.com #222805 Informative Misconfiguration and Insecure Design Low 2017-05-15 – 3 Login Hints on Admin Panel #188195 Informative Misconfiguration and Insecure Design Medium 2016-12-05 – 3 **minor issue ** -Nextcloud 10.0 session issue with desktop client and android client #165353 Valid Misconfiguration and Insecure Design Medium 2020-03-01 – 3 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3