NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files Only #271253 Duplicate Authentication – 2019-04-11 – 7 WordPress < 4.8.2 vulnerable to multiple attacks #269705 Valid Misconfiguration and Insecure Design – 2017-09-27 – 7 Disabled user can reset their password #261297 Valid Misconfiguration and Insecure Design – 2020-03-01 – 7 Android content provider exposes password-protected share password hashes #242727 Valid Information Disclosure – 2020-01-31 $75 7 (Authenticated) RCE by bypassing of the .htaccess blacklist #228825 Valid Command and Code Injection – 2020-03-01 – 7 Calendar and addressbook names disclosed (NC-SA-2017-012) #203594 Valid Information Disclosure – 2017-05-08 $183 7 Bad content-type in response header when getting document can lead to html injection #173721 Valid Cross-site Scripting – 2017-01-12 – 7 Reflected XSS in Gallery App #165686 Valid Cross-site Scripting – 2016-12-03 – 7 Wordpress: Directory Traversal / Denial of Serivce #163421 Valid Information Disclosure – 2016-08-26 – 7 Expired SSL certificate #163342 Valid Misconfiguration and Insecure Design – 2016-08-25 – 7 XSS on IOS app via HTML rendering #157434 Valid Cross-site Scripting – 2017-04-20 – 7 Read-only share recipient can restore old versions of file #146067 Valid Authentication – 2016-07-19 $300 7 Password reset link remains valid after email change #145896 Valid Authentication – 2016-12-13 – 7 Tables application does not respect sharing limitations set by admin #3642236 Valid Access Control Medium 2026-10-27 – 6 Public shares remain accessible via alternate endpoints after owner account is disabled #3620539 Valid Access Control Medium 2026-10-27 $270 6 Ability to control the filename when uploading a logo or favicon on theming #1781751 Valid Misconfiguration and Insecure Design Low 2023-04-10 – 6 A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22 #1726445 Valid No weakness recorded Low 2022-12-10 – 6 Error in Deleting Deck cards attachment reveals the full path of the website #1354334 Valid Information Disclosure Low 2022-05-20 – 6 Text app leaks file path of shared files #1246721 Valid Information Disclosure Low 2021-08-11 – 6 ApiService#fetch serves content as text/html and inline Content-Disposition #1241460 Valid Cross-site Scripting – 2021-08-11 – 6 Targeted phishing attacks in Login flow v2 #1169033 Informative Input Validation and Logic Medium 2023-03-03 – 6 HTML Injection on "polls" app - comments section (possibly XSS) #1108420 Valid Cross-site Scripting Low 2021-03-31 – 6 bypassing dashboard without account + Information disclosure trough websockets #1102780 Informative Access Control High 2021-04-20 – 6 Leaked of Profile Image from URL changing #1022211 Informative No weakness recorded – 2020-11-17 – 6 Potential DDoS when posting long data into workflow validation rules #1018146 Valid Denial of Service Medium 2021-01-21 – 6 Recently change email but still login with old email #986459 Informative Authentication High 2020-09-29 – 6 Formula Injection vulnerability in CSV export feature #928280 Valid Command and Code Injection Medium 2021-03-04 – 6 Malicious apps can crash Nextcloud Android client by sending malformed intents #859136 Valid No weakness recorded – 2021-06-17 – 6 nextcloud-snap CircleCI project has vulnerable configuration which can lead to exposing secrets #794407 Valid Authentication High 2021-01-29 – 6 Email Spoofing #793532 Duplicate Input Validation and Logic Medium 2020-02-20 – 6 Talk - Leak of password-protected room name via already existent resource addition #662218 Valid Authentication Low 2020-03-01 $150 6 Passcode Protection in Android Devices Can be Bypassed. #631206 Informative Misconfiguration and Insecure Design Medium 2019-08-27 – 6 Stored XSS/HTML injection in autocomplete suggestions for sharing #478957 Valid Cross-site Scripting Medium 2019-06-27 – 6 Event privacy level does not work in Thunderbird #439828 Valid No weakness recorded Medium 2020-03-01 – 6 Missing SPF flags for customerupdates.nextcloud.com #385037 Valid No weakness recorded Medium 2020-03-01 – 6 HTML injection and limited XSS via logo image upload - Nextcloud 12.0.0 #231524 Valid Cross-site Scripting – 2020-01-31 – 6 DOMPurify 0.8.9 released #225777 Valid Cross-site Scripting – 2020-03-01 – 6 SQL exception in JSON format #225098 Valid Information Disclosure – 2020-01-31 – 6 Content spoofing due to the improper behavior of the 403 page #214340 Valid No weakness recorded – 2017-05-18 – 6 Content Spoofing/Text Injection in nextcloud.com #213360 Valid Misconfiguration and Insecure Design – 2017-04-19 – 6 Wordpress Version Disclosure Bug On Nextcloud #188132 Informative Information Disclosure – 2016-12-04 – 6 Directory listening enabled in: 88.198.160.130 #156510 Valid Information Disclosure – 2016-09-04 – 6 Avatar image upload and bypass real image verification #145604 Informative Misconfiguration and Insecure Design – 2017-01-15 – 6 Share owner has no possibility to list all existing derived shares #145452 Valid Authentication – 2016-12-13 – 6 Insecure randomness for default password in file sharing when password policy app is disabled #1745702 Valid Cryptography Low 2023-03-30 – 5 XSS in Desktop Client in call notification popup #1711847 Valid Injection and Smuggling Low 2022-11-25 – 5 XSS in Desktop Client via user status and information #1707977 Valid Injection and Smuggling Low 2022-11-25 – 5 Name collision of shared folders #1697281 Valid Input Validation and Logic Medium 2023-04-29 – 5 the complete server installation path is visible in cloud/user endpoint #1690510 Valid Information Disclosure Low 2023-03-30 – 5 Calendar name length not validated before writing to database #1596148 Valid Denial of Service Low 2022-12-01 – 5