CVE-2023-39960

Technical details for CVE-2023-39960 are not publicly available in the provided documents; monitor for updates.

CVE-2023-39959

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for...

CVE-2023-35928

CVE-2023-35928 affects Nextcloud Server and Enterprise Server prior to the patched versions. A user could abuse a functionality to access another user’s login credentials and take over the account. Affected ranges include Nextcloud Server 25.0.0–25.0.7 and 26.0.0–26.0.2; Enterprise Server 19.0.0–...

CVE-2023-35927

The CVE-2023-35927 issue affects Nextcloud Server and Enterprise Server where two trusted servers exchange share secrets and an attacker could modify or delete VCards in the origin server’s system address book, impacting user search and avatar menus. The initial description lists affected lines f...

CVE-2023-35172

Technical details about CVE-2023-35172 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

User scoped external storage can be used to gather credentials of other users

None...

Password reset endpoint is not brute force protected

None...

CVE-2023-30539

Nextcloud Server/server family suffers an access control vulnerability where system tag based file access control or file retention rules can be abused to limit or grant access. Affected: Nextcloud Server, Enterprise Server, and related Files automated tagging app. Root cause: misapplied access c...

Default credentials

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud...

CVE-2023-25820

CVE-2023-25820 affects Nextcloud Server and Enterprise Server: if an attacker gains access to an already logged-in user session, they can brute-force the password on the confirmation endpoint. Affected ranges and patches per sources include Nextcloud Server 24.0.x < 24.0.10 and 25.0.x < 25....

CVE-2023-25161 Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage...

CVE-2023-25161

CVE-2023-25161 affects Nextcloud Server (and Enterprise Server) with missing rate limiting on the password reset function prior to versions 25.0.1, 24.0.8, and 23.0.12. The root issue is lack of rate limiting, which can cause service slowdown, storage overflow, or cost impact when external email ...

PT-2023-19947 · Nextcloud +1 · Nextcloud Enterprise Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 25.0.1 Nextcloud Server versions prior to 24.0.8 Nextcloud Server versions prior to 23.0.12 Nextcloud Enterprise Server versions prior to 25.0.1 Nextcloud Enterprise Server versions prior to 24.0.8 Nextcloud...

PT-2023-8425 · Nextcloud +1 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 24.0.x through 24.0.7 Nextcloud Server versions 25.0.x through 25.0.0 Nextcloud Enterprise Server versions 24.0.x through 24.0.7 Nextcloud Enterprise Server versions 25.0.x through 25.0.0 Nextcloud Office Richdocumen...

No password length limit when creating a user as an administrator

None...

Code injection

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading nextcloud.log may gain knowledge of...

Nextcloud 资源管理错误漏洞

Nextcloud is a suite of open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. A security vulnerability exists in Nextcloud Server, Nextccloud Enterprise Server versions prior to 24.0.6. An attacker exploited the vulnerability to cause...

CVE-2022-39330 Database resource exhaustion for logged-in users via sharee recommendations with circles

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by...

CVE-2022-39330 Database resource exhaustion for logged-in users via sharee recommendations with circles

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by...

PT-2022-24931 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 23.0.9 and 24.0.5 Nextcloud Enterprise Server versions prior to 22.2.10.5, 23.0.9, and 24.0.5 Description: The issue affects Nextcloud Server, a file server software for the self-hosted productivity platform...