XSS in Desktop Client in the notifications Analysed #1668028 Valid Cross-site Scripting Low 2022-11-25 $750 50 No password length limit when creating a user as an administrator Analysed #1727424 Valid Denial of Service Low 2022-12-31 – 39 SSRF via potential filter bypass with too lax local domain checking Analysed #1608039 Valid Server-Side Request Forgery Low 2022-09-16 $250 30 Profile of disabled user stays accessible Analysed #1675014 Valid Access Control Low 2022-11-26 $100 27 SMTP Command Injection in Appointment Emails via Newlines Analysed #1509216 Valid Injection and Smuggling Medium 2022-12-27 – 27 SMTP Command Injection in iCalendar Attachments to Emails via Newlines #1516377 Valid Injection and Smuggling Medium 2022-07-04 – 22 Notification implicit PendingIntent in com.nextcloud.client allows to access contacts #1161401 Valid Information Disclosure Low 2022-05-27 $250 21 [user_oidc] Unencrypted Communications #1687005 Valid Cryptography Low 2022-12-18 – 20 Sensitive files/ data exists post deletion of user account #1222873 Valid Access Control Low 2022-05-20 – 20 [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only #1687410 Valid Cross-site Scripting Low 2022-12-18 – 19 Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate #1596459 Valid Access Control Low 2022-12-25 – 19 When sharing a Deck card in conversation the metaData can be manipulated to open arbitrary URL #1358977 Valid Input Validation and Logic Medium 2022-02-15 – 19 Disabled download shares still allow download through preview images #1745766 Valid Access Control Low 2022-12-31 – 18 Folder architecture and Filesizes of private file drop shares can be getten #1337422 Valid Information Disclosure Medium 2022-04-09 – 18 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" #1595006 Valid Server-Side Request Forgery Medium 2022-09-03 $250 17 Password disclosure in initial setup of Mail App #1561471 Valid Cryptography Low 2022-09-03 – 17 Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log] #1767439 Valid Information Disclosure Low 2022-12-15 – 16 Guests can continue to receive video streams from call after being removed from a conversation #1706248 Valid Information Disclosure Medium 2022-12-31 – 15 bypass forced password protection via circles app #1406926 Valid Input Validation and Logic Low 2022-06-19 $100 14 Database resource exhaustion for logged-in users via sharee recommendations with circles #1688199 Valid Denial of Service Medium 2022-11-26 $250 13 Nextcloud Deck : Possibility for anyone to add a stack with existing tasks on anyone's board #1450117 Valid Insecure Direct Object Reference Medium 2022-05-20 – 13 Information exposure in in guzzlehttp/guzzle (https://github.com/nextcloud/3rdparty/tree/master/guzzlehttp/guzzle) #1604606 Valid Information Disclosure Low 2022-09-16 – 12 Lack of Brute force protection while joining video call in talk section which is password protected #1596673 Valid Information Disclosure Low 2022-08-08 – 12 Missing length validation of user displayname allows to generate an SQL error #1588562 Valid Denial of Service Low 2022-12-20 – 12 Access to arbitrary file of the Nextcloud Android app from within the Nextcloud Android app #1408692 Valid File and Path Handling Low 2022-09-11 $250 12 Federated share accepting/declining is not logged in audit log #1200815 Valid Input Validation and Logic Low 2022-09-03 – 12 [nextcloud/server] Moment.js vulnerable to Inefficient Regular Expression Complexity #1712329 Valid Authentication – 2022-12-09 – 11 com.nextcloud.client bypass the protection lock in andoid app v 3.18.1 latest version. #1450368 Valid Access Control Low 2022-04-30 $200 11 nextcloudcmd incorrectly trusts bad TLS certificates #1699740 Valid Cryptography Low 2022-12-25 – 10 Last video frame is still sent after video is disabled in a call #1641088 Valid Information Disclosure Medium 2022-09-16 – 10 Possibility to force an admin to install recommended applications #1403614 Valid Cross-Site Request Forgery Low 2022-04-29 $100 10 SQL injextion via vulnerable doctrine/dbal version #1390331 Valid SQL Injection High 2022-05-11 – 10 High memory usage for generating preview of broken image #1261225 Valid Memory Corruption Low 2022-03-09 – 10 Improper input-size validation on the user new session name can result in server-side DDoS. #1153138 Valid Denial of Service Medium 2022-05-31 – 10 Generated passwords are not fully validated by HIBPValidator #1606961 Valid Authentication Low 2022-10-01 $100 9 Moderator can enable cam/mic remotely if cam/mic-permission was disabled while user has activated cam/mic #1520685 Valid Information Disclosure Low 2022-06-09 $100 9 User files is disclosed when someone called while the screen is locked #1338781 Valid Information Disclosure Medium 2022-03-14 – 9 Control character filtering misses leading and trailing whitespace in file and folder names #1402249 Valid Injection and Smuggling Medium 2022-05-27 – 8 objectId in share location can be set to open arbitrary URL or Deeplinks #1337178 Valid Input Validation and Logic Medium 2022-03-08 – 8 Federated editing allows iframing possibly malicious remotes #1210424 Valid Access Control Low 2022-07-02 $100 8 user can bypass password enforcement when federated sharing is enabled #838510 Valid No weakness recorded – 2022-06-01 $250 8 Ownership check missing when updating or deleting attachments #1579820 Valid Insecure Direct Object Reference Medium 2022-07-06 – 7 A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22 #1726445 Valid No weakness recorded Low 2022-12-10 – 6 Error in Deleting Deck cards attachment reveals the full path of the website #1354334 Valid Information Disclosure Low 2022-05-20 – 6 XSS in Desktop Client in call notification popup #1711847 Valid Injection and Smuggling Low 2022-11-25 – 5 XSS in Desktop Client via user status and information #1707977 Valid Injection and Smuggling Low 2022-11-25 – 5 Calendar name length not validated before writing to database #1596148 Valid Denial of Service Low 2022-12-01 – 5 Exception logging in Sharepoint app reveals clear-text connection details #1652903 Valid Cryptography Medium 2022-11-26 – 4 @nextcloud/logger NPM package brings vulnerable ansi-regex version #1607601 Valid Denial of Service Low 2022-07-29 – 4 Brute force protections don't work #1596918 Valid Information Disclosure Low 2022-09-03 – 4