CVE-2019-15621: Improper Preservation of Permissions

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

CVE-2019-15623: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled...

PT-2020-19957 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 16.0.1 Description: A reflected Cross-Site Scripting issue was found in the svg generation of the affected software. Recommendations: For Nextcloud Server version 16.0.1, update to a version that includes a fix for th...

CVE-2019-15624: Improper Input Validation

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...

PT-2020-9745

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1 Description The issue is related to improper permissions preservation, allowing sharees to reshare with write permissions when sharing the mount point of a share they received as a public link. Recommendations F...

PT-2020-9747

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1 Description The issue causes the server to send its domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. This results in the exposure of private...

CVE-2019-15613: Improper Input Validation

A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes...

CVE-2020-8117: Improper Handling of Insufficient Permissions or Privileges

Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event...

CVE-2020-8122: Improper Access Control

A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received...

CVE-2019-15612: Session Fixation

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

PT-2020-9740

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 17.0.0 Description A missing check in the software allowed an attacker to set up a new second factor when trying to login. Recommendations For Nextcloud Server version 17.0.0, update to a version that includes the fix...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449

CVE-2019-5449 affects Nextcloud Server prior to 15.0.1. A missing check allows leaking calendar event names when adding or modifying confidential or private events. Multiple connected sources confirm an information disclosure vulnerability in Nextcloud Server before 15.0.1. Impact is information ...

CVE-2019-5449

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

CVE-2019-5449: Improper Authentication

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events...

Improper neutralization of item names in projects feature (NC-SA-2020-008)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Improper neutralization of item names in projects feature (NC-SA-2020-009)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

PT-2020-9748

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 15.0.7 Description The issue is related to improper input validation, allowing group admins to create users with IDs of system folders. Recommendations For Nextcloud Server version 15.0.7, consider restricting the...

PT-2019-17678

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 15.0.1 Description A missing check in the Nextcloud Server causes leaking of calendar event names when adding or modifying confidential or private events. Recommendations For versions prior to 15.0.1, update ...