Remote Code Execution via Extract App Plugin Analysed #546753 Valid Command and Code Injection High 2019-05-30 – 124 Arbitrary SQL command injection Analysed #508487 Valid SQL Injection Critical 2019-07-21 – 77 Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock Analysed #331489 Valid Information Disclosure Low 2019-07-26 – 58 Expired reshare links allow access to all files in share Analysed #452854 Valid Access Control Critical 2019-06-27 – 38 SQL Injection found in NextCloud Android App Content Provider Analysed #291764 Valid SQL Injection Low 2019-07-26 $150 36 Group admins can remove arbitrary data from "data" directory (including admin data) Analysed #508493 Valid Access Control High 2019-08-12 – 32 Passwords being stored as plain text in logging Analysed #469668 Valid Cryptography Low 2019-08-31 – 30 CSRF vulnerability that allows an attacker to modify encryption settings #630146 Valid Cross-Site Request Forgery Low 2019-12-07 – 27 Gallery: No feedback for invalid password #428660 Valid Input Validation and Logic Low 2019-07-27 $50 22 SQLi allow query restriction bypass on exposed FileContentProvider #518669 Valid SQL Injection Low 2019-07-29 $100 19 Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color` #605915 Valid Cross-site Scripting Medium 2019-08-29 – 17 Exposing debug.log file leads to server full path disclosure #696360 Valid Information Disclosure Low 2019-10-17 – 15 Content Spoofing /Text Injection in https://docs.nextcloud.com #666557 Valid Misconfiguration and Insecure Design Low 2019-09-05 – 14 Delete permission can be added on reshare #633245 Valid Access Control Low 2019-09-03 – 14 Combination of content provider allows private data disclosure #534541 Valid Access Control Low 2019-07-26 $100 14 Nextcloud domain and name of every user leaked to lookup server #508490 Valid Information Disclosure Medium 2019-11-26 – 14 Stored XSS in OAuth redirect URI #261138 Valid Cross-site Scripting Low 2019-05-11 – 14 Bypassing lock protection #490946 Valid Authentication Low 2019-07-26 $50 13 Talk / spreed: Disclosure of Room names and participants for password protected rooms #428010 Valid Information Disclosure Medium 2019-04-17 $50 13 Able to bypass "Device credentials" Lock #507172 Valid Access Control Low 2019-07-26 – 12 Predictable Random Number Generator #504731 Informative Cryptography Medium 2019-06-26 – 12 Remote attacker can impersonate Social users via ActivityPub API #461308 Valid Deserialization and Object Injection – 2019-02-01 – 12 In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access #522876 Valid Access Control High 2019-07-27 – 11 User Editable nextcloud Wiki pages of Public Repositories #498878 Valid No weakness recorded High 2019-08-31 – 11 Server-Side request forgery in New-Subscription feature of the calendar app #427835 Valid Server-Side Request Forgery Medium 2019-12-12 $100 11 The password recovery let users know whether an email address exists or not in the website #681468 Valid Authentication – 2019-11-22 – 10 Some HTML Tags are Getting Executed in com.nextcloud.client #631227 Valid Command and Code Injection None 2019-07-26 – 9 Wordpress Users Disclosure #625199 Duplicate Information Disclosure High 2019-07-01 – 8 Uploading large avatar images cause excessive CPU usage #504759 Valid Denial of Service – 2019-06-27 – 8 Private/confidential setting of calendar events is ignored on activity stream #476615 Valid Information Disclosure Low 2019-06-27 – 7 Click Jacking Nextcloud #347782 Informative Misconfiguration and Insecure Design Low 2019-07-01 – 7 NextCloud is also Accepting OCTET-STREAM Type of Documents instead of jpg or Imge Files Only #271253 Duplicate Authentication – 2019-04-11 – 7 Passcode Protection in Android Devices Can be Bypassed. #631206 Informative Misconfiguration and Insecure Design Medium 2019-08-27 – 6 Stored XSS/HTML injection in autocomplete suggestions for sharing #478957 Valid Cross-site Scripting Medium 2019-06-27 – 6 Vulnerable W3 Total Cache plugin version in use on nextcloud.com #579116 Informative Cross-Site Request Forgery Medium 2019-06-21 – 5 Missing DNSSEC #509390 Valid Cryptography Medium 2019-08-29 – 5 LDAP login possible even though account doesn't match user filter #205908 Valid Authentication None 2019-07-27 – 5 SignUp using Fake Email #664200 Informative Input Validation and Logic – 2019-08-02 – 4 Persistent XSS on favorite via filename #685491 Valid Cross-site Scripting Medium 2019-12-12 – 3 Veracode and security audit record are publicly available #669365 Informative Information Disclosure Low 2019-09-10 – 3 W3 Total Cache plugin multiple vulnerabilities #561805 Valid No weakness recorded – 2019-07-28 – 3 XSS On Nextcloud Integrated with zimbra drive #498852 Informative Cross-site Scripting Medium 2019-11-11 – 3 Retrieval and alteration of exposed media on Android Oreo #462441 Informative Information Disclosure Medium 2019-06-26 – 3 WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED) #696198 Informative Information Disclosure Low 2019-11-11 – 2 Nextcloud Clickjacking Vulnerability #710996 Duplicate Misconfiguration and Insecure Design Low 2019-11-11 – 1 Clickjacking on https://download.nextcloud.com/ #662155 Duplicate Misconfiguration and Insecure Design None 2019-11-11 – 1 Clickjacking on https://download.nextcloud.com #658011 Duplicate Misconfiguration and Insecure Design – 2019-11-11 – 1 Information Exposure Through Directory Listing - https://apps.nextcloud.com/static/ #403909 Duplicate Information Disclosure Low 2019-01-07 – 1 Username Enumeration #667613 Informative Information Disclosure Low 2019-11-11 – – Clickjacking on https://nextcloud.com/ #661768 Duplicate Misconfiguration and Insecure Design None 2019-11-11 – –