Generated passwords are not fully validated by HIBPValidator #1606961 Valid Authentication Low 2022-10-01 $100 9 Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic #1520685 Valid Information Disclosure Low 2022-06-09 $100 9 User files is disclosed when someone called while the screen is locked #1338781 Valid Information Disclosure Medium 2022-03-14 – 9 Webauthn tokens are not removed on user deletion #1202590 Valid Access Control Medium 2021-08-07 – 9 Nextcloud deck sharee search leaks searches to lookupserver by default #1167958 Valid Access Control Low 2021-05-26 – 9 Allows any user to share their "Root" level folder by sharing "." #889795 Valid Access Control None 2020-06-03 – 9 Reduced purmations on encryption #852841 Valid Cryptography Low 2020-10-28 – 9 PHPUnit is included in groupfolders release package potentially causing RCE #820146 Valid No weakness recorded – 2020-06-25 – 9 Mail does not verify IMAP/SMTP host connected via TLS #803734 Valid Cryptography Medium 2020-06-03 – 9 Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file #661051 Valid Misconfiguration and Insecure Design Low 2020-11-05 – 9 Some HTML Tags are Getting Executed in com.nextcloud.client #631227 Valid Command and Code Injection None 2019-07-26 – 9 Share recipient can modify a share's expiration date #447494 Valid Access Control Medium 2020-01-31 $100 9 Password of failed (2FA) login attempt is stored in log #244092 Valid Authentication – 2020-03-01 – 9 Files Drop: WebDAV endpoint is leaking existence of resources #187460 Valid Information Disclosure – 2017-01-01 – 9 Bypass permissions #169680 Valid Access Control – 2017-02-09 – 9 Privilege escalation - Normal user can somehow make admin to delete shared folders #166581 Valid Access Control – 2017-05-20 – 9 \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype #163338 Valid Cross-site Scripting – 2016-12-03 – 9 Password Reset Link issue #161924 Valid Authentication – 2016-09-23 – 9 help.nextcloud Email Address/Username enumeration #145734 Informative Information Disclosure – 2016-06-19 – 9 Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory #3159877 Valid Information Disclosure None 2026-01-04 – 8 Open redirect on "Unsupported browser" warning #1977222 Valid Open Redirect Medium 2023-06-22 $150 8 Control character filtering misses leading and trailing whitespace in file and folder names #1402249 Valid Injection and Smuggling Medium 2022-05-27 – 8 objectId in share location can be set to open arbitrary URL or Deeplinks #1337178 Valid Input Validation and Logic Medium 2022-03-08 – 8 Federated editing allows iframing possibly malicious remotes #1210424 Valid Access Control Low 2022-07-02 $100 8 Acting under any different user via DB-stored credentials #1061591 Valid Access Control High 2021-03-01 – 8 Improper access control to messages of Social app #921717 Valid Access Control Medium 2020-11-17 – 8 user can bypass password enforcement when federated sharing is enabled #838510 Valid No weakness recorded – 2022-06-01 $250 8 Directory listing is enabled that exposes non public data through multiple path #690796 Valid Information Disclosure Low 2020-02-01 – 8 Wordpress Users Disclosure #625199 Duplicate Information Disclosure High 2019-07-01 – 8 Uploading large avatar images cause excessive CPU usage #504759 Valid Denial of Service – 2019-06-27 – 8 Github wikis are editable by anyone #457032 Valid Access Control Medium 2018-12-07 – 8 Delete All Data of Any User #220385 Valid No weakness recorded – 2020-03-01 – 8 Update php-saml library to 2.10.5 #213789 Valid Cryptography – 2017-04-27 – 8 Missing Rate Limit for Current Password field in nextcloud.com #199714 Valid Authentication – 2017-05-20 – 8 User Information Disclosure via REST API #197877 Valid Information Disclosure – 2017-02-11 – 8 IDOR - Disable sharing #153905 Valid Access Control – 2016-12-03 – 8 Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/ #149798 Valid Misconfiguration and Insecure Design – 2016-12-02 – 8 Ownership check missing when updating or deleting attachments #1579820 Valid Insecure Direct Object Reference Medium 2022-07-06 – 7 Serverinfo endpoints are not bruteforce protected nor are tokens properly generated #1210458 Valid No weakness recorded Low 2021-06-16 – 7 Password policy changes not enforced for existing passwords #1169335 Informative Authentication Low 2021-04-26 – 7 Default Nextcloud server config and iOS Nextcloud client leak sharee searches to Nextcloud #1167919 Valid Access Control Low 2021-05-31 – 7 Unexpected federated shares added via public link #1167767 Informative Access Control Medium 2021-04-26 – 7 Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki #906322 Valid Access Control – 2021-01-15 – 7 The password of a mail share is not set if the password is given when the share is created (Nextcloud < 18) #888261 Valid Access Control Low 2021-03-04 – 7 SSRF on local storage of iOS mobile #746541 Valid Server-Side Request Forgery Medium 2020-03-01 – 7 Private/confidential setting of calendar events is ignored on activity stream #476615 Valid Information Disclosure Low 2019-06-27 – 7 File access control rules not enforced on image files #358339 Valid Access Control Low 2018-06-15 – 7 Click Jacking Nextcloud #347782 Informative Misconfiguration and Insecure Design Low 2019-07-01 – 7 Improper protection of FileContentProvider #331302 Valid Access Control Low 2020-03-01 – 7 Email Notification should be get while changing password on apps.nextcloud.com #308156 Informative No weakness recorded – 2018-02-28 – 7