Code injection possible with malformed Nextcloud Talk chat commands Analysed #851807 Valid Command and Code Injection High 2020-06-02 – 317 User can delete data in shared folders he's not autorized to access Analysed #642515 Valid Access Control Medium 2020-04-10 – 173 Access to all files of remote user through shared file Analysed #258084 Valid Information Disclosure Medium 2020-03-01 – 154 Missing ownership check on remote wipe endpoint Analysed #819807 Valid Insecure Direct Object Reference High 2020-04-19 $500 141 Re-Sharing allows increase of privileges Analysed #889243 Valid Access Control Medium 2020-09-28 – 92 No rate limiting for confirmation email lead to huge Mass mailings Analysed #997070 Valid Input Validation and Logic Medium 2020-11-04 – 82 File-drop content is visible through the gallery app Analysed #719426 Valid No weakness recorded Medium 2020-01-31 – 68 Arbitrary code execution in desktop client via OpenSSL config Analysed #622170 Valid Command and Code Injection Medium 2020-08-05 $100 59 Clear text storage of proxy parameters and passwords Analysed #685990 Valid Cryptography Low 2020-09-16 – 53 Stored XSS in collabora via user name Analysed #968232 Valid Cross-site Scripting Low 2020-09-19 – 48 http://www.nextcloud.com/wp-includes/js/swfupload/swfupload.swf allows open redirect / site defacement Analysed #209520 Valid Open Redirect – 2020-03-07 – 42 Remote code execution via path traversal in Zip extraction in the Extract app Analysed #765291 Valid File and Path Handling High 2020-03-07 – 40 Memory Leak in OCUtil.dll library in Desktop client can lead to DoS Analysed #588562 Valid Denial of Service Medium 2020-08-06 $100 40 [Reflected XSS] In Request URL Analysed #515484 Valid Cross-site Scripting Low 2020-03-01 – 37 No session logout after changing password & alsoandroid sessions not shown in sessions list so they can be deleted Analysed #194329 Valid Misconfiguration and Insecure Design – 2020-02-09 – 35 Cross site scripting - XSRF Token #858255 Valid Cross-site Scripting Medium 2020-06-14 – 32 Code injection in macOS Desktop Client #633266 Valid Command and Code Injection Low 2020-04-10 – 29 Blind Stored XSS on iOS App due to Unsanitized Webview #575562 Valid Cross-site Scripting Low 2020-03-07 $100 28 XSS in PDF Viewer #819863 Valid Cross-site Scripting Low 2020-05-23 $100 26 https://help.nextcloud.com::: Web cache poisoning attack #429747 Valid No weakness recorded High 2020-01-31 – 25 Unrestricted file upload on the image of contacts #808287 Valid Input Validation and Logic Low 2020-07-08 $100 24 Possible denial of service when entering a loooong password #840598 Valid Authentication Medium 2020-07-29 $100 23 Persistent XSS via filename in projects #662204 Valid Cross-site Scripting Low 2020-03-01 $150 23 XSS through image upload of contacts using svg file #894876 Valid Cross-site Scripting Low 2020-12-17 $100 22 "Secure View" aka "Hide Download" can be bypassed easily #788257 Valid Access Control High 2020-04-10 – 22 XSS through image upload of contacts using svg file with png extension #998422 Valid Cross-site Scripting Low 2020-12-26 – 21 Access control missing while viewing the attachments in the "All boards" #916704 Valid Insecure Direct Object Reference Medium 2020-09-29 $150 20 Username and Access Token Disclousure #672623 Valid Misconfiguration and Insecure Design Low 2020-03-01 $250 20 SSRF protection bypass #736867 Valid Server-Side Request Forgery Medium 2020-03-14 $100 18 XSS in desktop client via invalid server address on login form #685552 Valid Cross-site Scripting Medium 2020-08-17 – 17 User with read-only access to a share can gain write access to sub-folders in the share #619484 Valid Access Control Medium 2020-03-01 – 17 xmlrpc.php is enabled - Nextcloud #458696 Valid Access Control Medium 2020-03-01 – 17 Possible denial of service when entering a loooong password #952349 Valid Authentication Medium 2020-09-16 – 16 No rate limiting on sinup page #922470 Valid Input Validation and Logic Low 2020-09-28 – 16 Missing server side controls when editing the board’s sharing permissions per user #827816 Valid Access Control High 2020-09-28 – 16 Docker image with FPM is vulnerable to CVE-2019-11043 #720306 Valid Command and Code Injection Critical 2020-03-14 $100 16 Non-admin users can trigger writes to memcached by entering a malicious server as a share URL #592864 Valid Injection and Smuggling Medium 2020-07-09 $100 15 Linux client is vulnerable to directory traversal when downloading files #590319 Valid File and Path Handling Medium 2020-08-17 $250 14 Nextcloud 10.0 privilege escalation issue - Normal user can mask external storage shared by admin #165229 Valid Access Control Medium 2020-03-01 – 14 Only the file extensions are checked, not the MIME types as configured #697959 Valid No weakness recorded Medium 2020-03-14 – 13 XSS in image metadata field #896511 Valid Cross-site Scripting Medium 2020-08-05 – 12 Update App Store: Django account high jacking vulnerability #761329 Valid Access Control Medium 2020-01-31 – 11 WordPress vulnerable to multiple attacks at https://nextcloud.com #476526 Valid Misconfiguration and Insecure Design Medium 2020-03-01 – 11 Self xss #388527 Valid Cross-site Scripting Low 2020-04-05 – 11 Allows any user to share their "Root" level folder by sharing "." #889795 Valid Access Control None 2020-06-03 – 9 Reduced purmations on encryption #852841 Valid Cryptography Low 2020-10-28 – 9 PHPUnit is included in groupfolders release package potentially causing RCE #820146 Valid No weakness recorded – 2020-06-25 – 9 Mail does not verify IMAP/SMTP host connected via TLS #803734 Valid Cryptography Medium 2020-06-03 – 9 Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file #661051 Valid Misconfiguration and Insecure Design Low 2020-11-05 – 9 Share recipient can modify a share's expiration date #447494 Valid Access Control Medium 2020-01-31 $100 9