CVE-2020-8120: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation...

CVE-2019-15623: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled...

CVE-2019-15617: Improper Authentication

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...

CVE-2019-15613: Improper Input Validation

A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes...

CVE-2020-8121: Improper Access Control

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer...

PT-2020-9745

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1 Description The issue is related to improper permissions preservation, allowing sharees to reshare with write permissions when sharing the mount point of a share they received as a public link. Recommendations F...

PT-2020-9747

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1 Description The issue causes the server to send its domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. This results in the exposure of private...

CVE-2019-15612: Session Fixation

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

CVE-2019-15624: Improper Input Validation

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...

CVE-2019-15621: Improper Preservation of Permissions

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

CVE-2020-8122: Improper Access Control

A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received...

PT-2020-9740

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 17.0.0 Description A missing check in the software allowed an attacker to set up a new second factor when trying to login. Recommendations For Nextcloud Server version 17.0.0, update to a version that includes the fix...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

CVE-2019-5449 affects Nextcloud Server prior to 15.0.1. A missing check allows leaking calendar event names when adding or modifying confidential or private events. Multiple connected sources confirm an information disclosure vulnerability in Nextcloud Server before 15.0.1. Impact is information ...

CVE-2019-5449: Improper Authentication

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

Improper neutralization of item names in projects feature (NC-SA-2020-009)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Improper neutralization of item names in projects feature (NC-SA-2020-008)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

PT-2020-9748

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 15.0.7 Description The issue is related to improper input validation, allowing group admins to create users with IDs of system folders. Recommendations For Nextcloud Server version 15.0.7, consider restricting the...