Stored XSS on Share-popup of a directory's Gallery-view Analysed #145355 Valid Cross-site Scripting – 2016-07-19 – 24 Log pollution can lead to HTML Injection. Analysed #146278 Valid Cross-site Scripting – 2016-07-19 – 18 Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11 Analysed #145392 Valid Misconfiguration and Insecure Design – 2016-08-17 – 18 Content spoofing in lookup.nextcloud.com #171497 Valid Misconfiguration and Insecure Design Low 2016-10-10 – 11 Uploading files to a folder where invited user don't have any EDIT privilege #145950 Valid Authentication – 2016-07-19 – 10 \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype #163338 Valid Cross-site Scripting Medium 2016-12-03 – 9 Password Reset Link issue #161924 Valid Authentication – 2016-09-23 – 9 IDOR - Disable sharing #153905 Valid Access Control Low 2016-12-03 – 8 Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/ #149798 Valid Misconfiguration and Insecure Design Low 2016-12-02 – 8 Reflected XSS in Gallery App #165686 Valid Cross-site Scripting Medium 2016-12-03 – 7 Wordpress: Directory Traversal / Denial of Serivce #163421 Valid Information Disclosure – 2016-08-26 – 7 Expired SSL certificate #163342 Valid Misconfiguration and Insecure Design – 2016-08-25 – 7 Read-only share recipient can restore old versions of file #146067 Valid Authentication – 2016-07-19 $300 7 Password reset link remains valid after email change #145896 Valid Authentication – 2016-12-13 – 7 Directory listening enabled in: 88.198.160.130 #156510 Valid Information Disclosure – 2016-09-04 – 6 Share owner has no possibility to list all existing derived shares #145452 Valid Authentication – 2016-12-13 – 6 Information Disclosure of .htaccess file in Private Server/Subdomain #163106 Valid Information Disclosure – 2016-08-26 – 5 More content spoofing through dir param in the files app #154827 Valid Misconfiguration and Insecure Design Low 2016-11-04 $50 5 nextcloud.com: Content Injection Custom 404 Error #145344 Valid Misconfiguration and Insecure Design – 2016-06-17 – 5 Stored XSS on new Calling plugin (spreed) #190870 Valid Cross-site Scripting High 2016-12-13 – 4 Content spoofing due to the improper behavior of the 403 page in Private Server #177335 Valid Misconfiguration and Insecure Design None 2016-10-31 – 4 Bookmarks: Delete all existing bookmarks of a user #154529 Valid Access Control – 2016-08-08 – 4 [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS #148897 Valid Cross-site Scripting Medium 2016-11-02 – 4 newsletter.nextcloud.com: Bypass firewall protection #145730 Valid Authentication – 2016-07-18 – 4 nextcloud.com: Directory listening for 'wp-includes' forders #145495 Valid Information Disclosure – 2016-06-17 – 4 nextcloud.com: Mail Bombing ( No Rate Limiting On Sending Emails On Contact us Page) #145458 Valid Memory Corruption – 2016-07-17 – 4 help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running #145409 Valid Denial of Service – 2016-07-27 – 4 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4 stats.nextcloud.com: Content Injection #145375 Valid Misconfiguration and Insecure Design – 2016-07-17 – 4 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3 demo.nextcloud.com: Content spoofing due to default Apache Error Page #155189 Valid Misconfiguration and Insecure Design – 2016-09-29 – 3 Content injection in subdomain #145853 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content Spoofing/Text Injection - docs.nextcloud.org #145850 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers #145612 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 https://newsletter.nextcloud.com Directory listening and Information Disclosure #145603 Valid Information Disclosure – 2016-06-18 – 3 Content Spoofing #145374 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content Injection - apps.nextcloud.com #161299 Valid Misconfiguration and Insecure Design – 2016-08-26 – 2 Arbitrary File Upload in Logo & Log in image Theming setting. #155690 Valid Cross-site Scripting – 2016-10-05 – 2 Content spoofing in cloud.nextcloud.com #152925 Valid Misconfiguration and Insecure Design – 2016-08-30 – 2 Content Injection in subdomain #145854 Valid Misconfiguration and Insecure Design – 2016-06-19 – 2 Content Injection 404 page #145849 Valid Misconfiguration and Insecure Design – 2016-06-19 – 2 Nextcloud server software: Content Spoofing #145463 Valid Misconfiguration and Insecure Design – 2016-07-19 – 2 xss on demo.nextcloud.com due to outdated version #177713 Valid Cross-site Scripting – 2016-11-26 – 1 Slow Http attack on nextcloud(DOS) #163823 Valid Denial of Service – 2016-10-05 – 1 Content Injection - demo.nextcloud.com #161323 Valid Misconfiguration and Insecure Design – 2016-08-26 – 1 demo.nextcloud.com: Content spoofing due to default Apache Error Page #156425 Valid Misconfiguration and Insecure Design – 2016-08-30 – 1 [Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter #153251 Valid Misconfiguration and Insecure Design – 2016-12-05 – 1