Nextcloud Server Improper Access Control

The vulnerability of cloud-based software for creating and using Nextcloud Server lies in the ability to update any personal or global external storage, making it inaccessible to everyone else. Exploiting this vulnerability could allow a malicious actor to circumvent existing access control...

Nextcloud Server XSS

The vulnerability of cloud-based software for creating and using Nextcloud Server storage involves improper input validation during the creation of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Nextcloud Server XSS

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the ability to copy HTML code without formatting Ctrl+Shift+V. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks XSS...

Nextcloud Server Authentication Bypass

The vulnerability of cloud-based software for creating and using Nextcloud Server storage involves the ability to include or exclude birthdays of any user on the same server in the calendar. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected...

Nextcloud Server Permission File Deletion

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the improper assignment of permissions for files. Exploiting this vulnerability could allow a malicious actor to delete any files they desire...

Nextcloud Server Open Redirection

The vulnerability of cloud software for creating and using Nextcloud Server storage relates to the use of open redirection. Exploiting this vulnerability could allow a malicious actor to redirect users to an arbitrary URL address...

Nextcloud Server SSRF

The vulnerability of cloud software for creating and using Nextcloud Server storage solutions is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

Nextcloud Server Unencrypted Storage

The vulnerability of cloud software for creating and using Nextcloud Server storage involves the unencrypted storage of critical information. Exploiting this vulnerability can allow attackers to disclose the passwords of arbitrary users...

Nextcloud Server Authentication Bypass

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to the lack of restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor to bypass the authentication process remotely...

Nextcloud Server Improper Access Control

The vulnerability of cloud-based software for creating and using Nextcloud Server storage solutions is related to improper access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Nextcloud Server Brute Force

The vulnerability of cloud-based software for creating and using Nextcloud Server’s data storage solution is related to the lack of restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to carry out a brute-force attack...

NextCloud Server Access Control

The vulnerability of the index.php component in the Enterprise Server software package, a cloud-based software for creating and managing data storage in NextCloud Server, is related to inadequate access control mechanisms. Exploiting this vulnerability could allow an attacker to remotely modify o...

Nextcloud Server Session Expiration Bypass

The vulnerability of cloud software for creating and using Nextcloud Server storage solutions is related to incorrect session expiration times. Exploiting this vulnerability can allow a malicious actor to bypass authentication processes remotely...

SUSE CVE-2024-22403

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no...

CVE-2024-22403

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no...

CVE-2024-22400

The CVE-2024-22400 issue affects Nextcloud User SAML, an app for authenticating Nextcloud users via SAML. Affected versions allow an open redirect: a user_saml RelayState parameter can redirect to an uncontrolled third-party server. Mitigation per sources is to upgrade the User SAML app to versio...

PT-2024-1285 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.0 Description: The issue concerns the expiration of OAuth codes in Nextcloud Server, a self-hosted personal cloud system. In affected versions, OAuth codes did not expire, allowing an attacker who gains...

SUSE CVE-2023-49791

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an...

SUSE CVE-2023-49792

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a reverse proxy is configured as truste...

Authentication flaw

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a reverse proxy is configured as truste...