Rate-limits not working on instances without configured memory cache backend

None...

Missing permission check on Deck API

None...

Nextcloud Server shipped insecure Archive_Tar version

None...

Missing User Presence Check in Nextcloud WebAuthn login

None...

File path disclosure of shared files in OfficeOnline application

None...

File path disclosure of shared files in Richdocuments application

None...

XSS in Contacts

None...

XSS in Talk

None...

Bypass of image blocking in Nextcloud Mail

None...

PT-2021-22476

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.2.9 Nextcloud Deck versions prior to 1.4.5 Nextcloud Deck versions prior to 1.5.3 Description A missing permission check in Nextcloud Deck allows another authenticated user to access Deck cards of another use...

CVE-2021-39224: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. e.g. an attacker could see that the file shared.txt is locat...

PT-2021-23154

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.13 Nextcloud Server versions prior to 21.0.5 Nextcloud Server versions prior to 22.2.0 Description Nextcloud is an open-source, self-hosted productivity platform. The Two-Factor Authentication wasn't...

PT-2021-22474

Name of the Vulnerable Software and Affected Versions Nextcloud Richdocuments versions prior to 3.8.6 and 4.2.3 Description The Nextcloud Richdocuments application returned verbatim exception messages to the user, which could result in a full path disclosure on shared files. For example, an...

PT-2021-22472

Name of the Vulnerable Software and Affected Versions Nextcloud Contacts versions prior to 4.0.3 Description The Nextcloud Contacts application is vulnerable to a stored Cross-Site Scripting XSS issue. To exploit this, a user must right-click on a malicious file and open it in a new tab. However,...

PT-2021-22475

Name of the Vulnerable Software and Affected Versions Nextcloud OfficeOnline versions prior to 1.1.1 Description The Nextcloud OfficeOnline application returned verbatim exception messages to the user, which could result in a full path disclosure on shared files. For example, an attacker could se...

CVE-2021-39223: Exposure of Sensitive Information to an Unauthorized Actor

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. e.g. an attacker could see that the file...

NextCloud security vulnerabilities

Nextcloud is an open source, self-hosted file synchronization and sharing communications application platform from Nextcloud, a German company. nextcloud has a security vulnerability that stems from an improper design or implementation during the development of code for a networked system or...

NextCloud code issues and vulnerabilities

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Contacts application prior to version 4.0.3 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side...

CVE-2021-39225: Authorization Bypass Through User-Controlled Key

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3...

CVE-2021-39220: Improper Input Validation

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP. The privacy filter failed to filter images with a relative protocol. It is recommend...