No rate limiting for confirmation email lead to huge Mass mailings Analysed #997070 Valid Input Validation and Logic Medium 2020-11-04 – 82 Basic auth header on WebDAV requests is not bruteforce protected Analysed #1879549 Valid Authentication High 2023-06-02 – 53 Password reset endpoint is not brute force protected Analysed #1987062 Valid Authentication High 2023-07-21 $500 46 Scoped apptokens can be changed by that very apptoken Analysed #1193321 Valid Access Control High 2021-07-15 $1,000 39 Brute force protection allows to send more requests than intended Analysed #1918525 Valid Authentication Medium 2023-07-13 $500 34 App PIN code can be bypassed in Files iOS Analysed #2245437 Valid Authentication Low 2023-12-18 $100 33 Bruteforce protection in password verification can be bypassed Analysed #2230915 Valid Authentication Medium 2024-01-17 – 31 IDOR unsubscribe Anyone from NextClouds Newsletters by knowing their Email Analysed #230328 Valid Insecure Direct Object Reference Medium 2017-09-16 – 29 Password of talk conversations can be bruteforced Analysed #2094473 Valid Authentication Medium 2023-11-12 – 27 Missing brute force protection on password confirmation modal Analysed #1842114 Valid Authentication Medium 2023-03-21 – 24 Improper restriction of excessive authentication attempts on WebDAV endpoint Analysed #1924212 Valid Authentication Medium 2023-08-10 – 23 Ratelimiting can be bypassed using IPv6 subnets Analysed #1154003 Valid Authentication Low 2021-07-01 – 23 Lack of bruteforce protection for TOTP 2FA Analysed #1265709 Valid Authentication Medium 2023-03-26 $750 22 Missing brute force protection on OAuth2 API controller Analysed #1258448 Valid Authentication Medium 2023-08-10 $500 20 Denial of Service by requesting to reset a password Analysed #812754 Valid Denial of Service High 2021-01-25 – 20 Memcached used as RateLimiter backend is no-op Analysed #2110945 Valid Authentication Medium 2023-11-12 – 19 Missing brute force protection for passwords of password protected share links Analysed #1894653 Valid Authentication Low 2023-04-25 – 17 Missing rate limiting on password reset functionality allows to send lot of emails Analysed #1691195 Valid Access Control Low 2023-03-05 $100 17 public webdav endpoint not bruteforce protected Analysed #1192159 Valid No weakness recorded Low 2021-08-11 $100 17 No rate limiting on sinup page Analysed #922470 Valid Input Validation and Logic Low 2020-09-28 – 16 Lack of Brute force protection while joining video call in talk section which is password protected Analysed #1596673 Valid Information Disclosure Low 2022-08-08 – 12