Stored XSS on Share-popup of a directory's Gallery-view #145355 Valid Cross-site Scripting – 2016-07-19 – 24 Server side request forgery (SSRF) on nextcloud implementation. #145524 Informative No weakness recorded – 2016-06-17 – 19 Log pollution can lead to HTML Injection. #146278 Valid Cross-site Scripting – 2016-07-19 – 18 Response Header injection using redirect_uri together with PHP that utilizes Header Folding according to RFC1945 and Internet Explorer 11 #145392 Valid Misconfiguration and Insecure Design – 2016-08-17 – 18 Unauthenticated Stored xss #168054 N/A Cross-site Scripting – 2016-09-13 – 14 No Rate Limiting on stats.nextcloud.com login #146424 Informative Misconfiguration and Insecure Design – 2016-06-22 – 12 Content spoofing in lookup.nextcloud.com #171497 Valid Misconfiguration and Insecure Design – 2016-10-10 – 11 Uploading files to a folder where invited user don't have any EDIT privilege #145950 Valid Authentication – 2016-07-19 – 10 Bruteforcing help.nextcloud.com #145727 Informative Authentication – 2016-06-19 – 10 \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype #163338 Valid Cross-site Scripting – 2016-12-03 – 9 Password Reset Link issue #161924 Valid Authentication – 2016-09-23 – 9 help.nextcloud Email Address/Username enumeration #145734 Informative Information Disclosure – 2016-06-19 – 9 IDOR - Disable sharing #153905 Valid Access Control – 2016-12-03 – 8 Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/ #149798 Valid Misconfiguration and Insecure Design – 2016-12-02 – 8 Reflected XSS in Gallery App #165686 Valid Cross-site Scripting – 2016-12-03 – 7 Wordpress: Directory Traversal / Denial of Serivce #163421 Valid Information Disclosure – 2016-08-26 – 7 Expired SSL certificate #163342 Valid Misconfiguration and Insecure Design – 2016-08-25 – 7 Read-only share recipient can restore old versions of file #146067 Valid Authentication – 2016-07-19 $300 7 Password reset link remains valid after email change #145896 Valid Authentication – 2016-12-13 – 7 Wordpress Version Disclosure Bug On Nextcloud #188132 Informative Information Disclosure – 2016-12-04 – 6 Directory listening enabled in: 88.198.160.130 #156510 Valid Information Disclosure – 2016-09-04 – 6 Share owner has no possibility to list all existing derived shares #145452 Valid Authentication – 2016-12-13 – 6 Information Disclosure of .htaccess file in Private Server/Subdomain #163106 Valid Information Disclosure – 2016-08-26 – 5 More content spoofing through dir param in the files app #154827 Valid Misconfiguration and Insecure Design – 2016-11-04 $50 5 Email ID Disclosure. #146106 Informative Information Disclosure – 2016-06-20 – 5 Business/Functional logic bypass: Remove admins from admin group. #145745 Informative Access Control – 2016-06-19 – 5 Vulnerable Javascript library #145517 Informative Information Disclosure – 2016-06-17 – 5 nextcloud.com: Content Injection Custom 404 Error #145344 Valid Misconfiguration and Insecure Design – 2016-06-17 – 5 Stored XSS on new Calling plugin (spreed) #190870 Valid Cross-site Scripting – 2016-12-13 – 4 Content spoofing due to the improper behavior of the 403 page in Private Server #177335 Valid Misconfiguration and Insecure Design – 2016-10-31 – 4 Bookmarks: Delete all existing bookmarks of a user #154529 Valid Access Control – 2016-08-08 – 4 [Thirdparty] Stored XSS in chat module - nextcloud server 9.0.51 installed in ubuntu 14.0.4 LTS #148897 Valid Cross-site Scripting – 2016-11-02 – 4 REG: Content provider information leakage #146179 Informative Command and Code Injection – 2016-06-24 – 4 WordPress Vulnerabilities: User Enumeration, Vulnerable Akismet Plugin, XML-RPC Interface available #146093 Informative Information Disclosure – 2016-06-22 – 4 newsletter.nextcloud.com: Bypass firewall protection #145730 Valid Authentication – 2016-07-18 – 4 nextcloud.com: Directory listening for 'wp-includes' forders #145495 Valid Information Disclosure – 2016-06-17 – 4 nextcloud.com: Mail Bombing ( No Rate Limiting On Sending Emails On Contact us Page) #145458 Valid Memory Corruption – 2016-07-17 – 4 help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running #145409 Valid Denial of Service – 2016-07-27 – 4 Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe #145396 Valid Information Disclosure – 2016-06-19 – 4 stats.nextcloud.com: Content Injection #145375 Valid Misconfiguration and Insecure Design – 2016-07-17 – 4 Login Hints on Admin Panel #188195 Informative Misconfiguration and Insecure Design – 2016-12-05 – 3 Reflected Self-XSS Vulnerability in the Comment section of Files Information #164027 Valid Cross-site Scripting – 2016-08-30 $100 3 demo.nextcloud.com: Content spoofing due to default Apache Error Page #155189 Valid Misconfiguration and Insecure Design – 2016-09-29 – 3 The application uses basic authentication. #151847 Informative Authentication – 2016-07-18 – 3 Content injection in subdomain #145853 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Content Spoofing/Text Injection - docs.nextcloud.org #145850 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 Bruteforce attack is possible on newsletter.nextcloud.com #145722 Informative Authentication – 2016-06-19 – 3 No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers #145612 Valid Misconfiguration and Insecure Design – 2016-06-19 – 3 https://newsletter.nextcloud.com Directory listening and Information Disclosure #145603 Valid Information Disclosure – 2016-06-18 – 3 No rate limiting on password protected shared file link #145462 Duplicate Authentication – 2016-06-20 – 3