RCE on Wordpress website Analysed #2248328 Valid Deserialization and Object Injection Critical 2023-12-28 – 83 CSRF protection on OIDC login is broken Analysed #1878381 Valid Cross-Site Request Forgery Medium 2023-04-04 $500 77 Basic auth header on WebDAV requests is not bruteforce protected Analysed #1879549 Valid Authentication High 2023-06-02 – 53 Download permissions can be changed by resharer Analysed #1724016 Valid Access Control Medium 2023-02-24 $500 49 Inviting excessive long email addresses to a calendar event makes the server unresponsive Analysed #2058337 Valid Denial of Service Medium 2023-10-16 – 46 Password reset endpoint is not brute force protected Analysed #1987062 Valid Authentication High 2023-07-21 $500 46 Delete external storage of any user Analysed #2212627 Valid Access Control High 2023-11-21 – 45 Path traversal allows tricking the Talk Android app into writing files into it's root directory Analysed #1997029 Valid File and Path Handling Medium 2023-08-14 – 43 End-to-end encrypted file-drops can be made inaccessible Analysed #1914115 Valid Access Control High 2023-06-22 $400 43 Arbitrary read of all SVG files on a Nextcloud server Analysed #1302155 Valid File and Path Handling High 2023-03-26 $1,250 36 Brute force protection allows to send more requests than intended Analysed #1918525 Valid Authentication Medium 2023-07-13 $500 34 Ability to read any emails through IDOR on Nextcloud Mail Analysed #1784681 Valid Insecure Direct Object Reference Medium 2023-04-12 – 34 App PIN code can be bypassed in Files iOS Analysed #2245437 Valid Authentication Low 2023-12-18 $100 33 SSRF via filter bypass due to lax checking on IPs Analysed #1702864 Valid Server-Side Request Forgery Medium 2023-02-10 $250 33 Admins can change authentication details of user configured external storage Analysed #2107934 Valid Access Control Low 2023-12-21 $100 31 OAuth2 client_secret stored in plain text in the database Analysed #1994324 Valid Cryptography Medium 2023-11-15 $100 31 HTML injection in search UI when selecting a circle with HTML in the display name Analysed #2210038 Valid Cross-site Scripting Low 2023-11-21 – 30 Passcode bypass on Talk Android app Analysed #1784645 Valid Access Control Low 2023-01-09 – 30 Enabling Birthday Contact to any user Analysed #2112973 Valid Insecure Direct Object Reference Medium 2023-11-21 – 29 user_ldap app logs user passwords in the log file on level debug Analysed #2101165 Valid Cryptography Medium 2023-11-21 – 28 Password of talk conversations can be bruteforced Analysed #2094473 Valid Authentication Medium 2023-11-12 – 27 CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link Analysed #1741430 Valid Cross-Site Request Forgery Medium 2023-01-11 – 25 Cards in Deck are readable by any user Analysed #1331728 Valid Information Disclosure Medium 2023-03-26 – 25 Missing brute force protection on password confirmation modal Analysed #1842114 Valid Authentication Medium 2023-03-21 – 24 Error in Booking an appointment reveals the full path of the website Analysed #1841408 Valid Access Control Low 2023-06-18 – 24 User scoped external storage can be used to gather credentials of other users Analysed #1978882 Valid Input Validation and Logic High 2023-06-27 – 23 Improper restriction of excessive authentication attempts on WebDAV endpoint Analysed #1924212 Valid Authentication Medium 2023-08-10 – 23 Lack of bruteforce protection for TOTP 2FA Analysed #1265709 Valid Authentication Medium 2023-03-26 $750 22 Full Passcode bypass on Nextcloud App iOS Analysed #1847368 Valid Access Control Low 2023-04-10 – 21 Possibility to delete files attached to deck cards of other users Analysed #1755555 Valid Insecure Direct Object Reference Low 2023-01-09 – 21 Self XSS when pasting HTML into Text app with Ctrl+Shift+V #2211561 Valid Cross-site Scripting Medium 2023-12-21 – 20 Missing brute force protection on OAuth2 API controller #1258448 Valid Authentication Medium 2023-08-10 $500 20 Memcached used as RateLimiter backend is no-op #2110945 Valid Authentication Medium 2023-11-12 – 19 App pin of the Android app can be bypassed via 3rdparty apps generating deep links #1825679 Valid Authentication Low 2023-05-04 – 18 Users can set up workflows using restricted and invisible system tags #1895976 Valid Access Control Medium 2023-05-17 – 17 Missing brute force protection for passwords of password protected share links #1894653 Valid Authentication Low 2023-04-25 – 17 Chat room member disclosure via autocomplete API #1850407 Valid Access Control Medium 2023-03-25 – 17 Suspicious login app ships old league/flysystem version #1720822 Valid Misconfiguration and Insecure Design – 2023-02-08 – 17 Missing rate limiting on password reset functionality allows to send lot of emails #1691195 Valid Access Control Low 2023-03-05 $100 17 HEIC image preview can be used to invoke Imagick #1261413 Valid Information Disclosure Critical 2023-01-07 – 16 Twitter Account hijack @nextcloudfrance #1916565 Valid No weakness recorded Medium 2023-03-30 – 15 Responsive Server-side Request Forgery (SSRF) #1895874 Valid Server-Side Request Forgery Medium 2023-10-19 – 15 Messages can still be seen on conversation after expiring when cron is misconfigured #1784310 Valid Information Disclosure Low 2023-02-27 – 15 Blind SSRF as normal user from mailapp #1913095 Valid Server-Side Request Forgery Low 2023-05-30 – 14 Reference caching can leak data to unauthorized users #1767503 Valid Information Disclosure Medium 2023-01-13 – 14 Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle #1893186 Valid Cross-site Scripting Medium 2023-05-15 – 13 Mail app - blind SSRF via imapHost parameter #1736390 Valid Server-Side Request Forgery Low 2023-02-06 – 13 Secure view trivial to bypass #1724021 Valid Access Control Medium 2023-03-30 $150 13 Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link #1720043 Valid Command and Code Injection Medium 2023-02-10 – 13 Desktop client does not verify received singed certificate in end to end encryption #1679267 Valid Cryptography Medium 2023-04-27 $1,000 13