CVE-2020-8122

CVE-2020-8122 affects Nextcloud Server 14.0.3, where a missing authorization check on share expiration updates lets a recipient extend the expiration date of a share they received. The root cause is an inadequate validation of the requester as the owner when modifying a share’s expiration. This v...

CVE-2019-15622

The CVE-2019-15622 issue affects the Nextcloud Android app (3.6.0) where insufficient sanitization in the FileContentProvider allows bypassing query restrictions and exposing data from protected tables (e.g., filelist.db). The root cause is improper validation/restriction of SQL queries, enabling...

PT-2020-9739

Name of the Vulnerable Software and Affected Versions Nextcloud version 16 Description The issue allows for DNS pollution when dangling remote share attempts are made in Nextcloud 16, particularly when running for an extended period. Recommendations For Nextcloud version 16, consider restricting...

CVE-2019-15618: Improper Neutralization of Input During Web Page Generation

Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location...

CVE-2020-8121: Improper Access Control

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer...

CVE-2019-15617: Improper Authentication

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...

CVE-2019-15616: Improper Neutralization of CRLF Sequences

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long...

CVE-2020-8122: Improper Access Control

A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received...

CVE-2019-15619: Improper Neutralization of Input During Web Page Generation

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

CVE-2019-15612: Session Fixation

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset...

CVE-2019-15620: Improper Authentication

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature...

CVE-2020-8120: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation...

PT-2020-9742

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.3 Nextcloud Talk version 6.0.3 Nextcloud Deck version 0.6.5 Description The issue is related to the improper neutralization of file names, conversation names, and board names. This causes a cross-site scripting XS...

PT-2020-9734

Name of the Vulnerable Software and Affected Versions Nextcloud iOS App version 2.23.0 Description The issue is related to a violation of secure design principles, causing the app to leak its login and token to other Nextcloud services. This occurs during specific actions such as searching for...

PT-2020-19956

Name of the Vulnerable Software and Affected Versions Nextcloud server version 17.0.0 Description The issue is related to improper authorization in the Nextcloud server, which causes previews and files to be leaked when a file-drop share link is opened via the gallery app. Recommendations For...

PT-2020-19955

Name of the Vulnerable Software and Affected Versions Nextcloud server version 16.0.1 Description The issue allows for an authenticated server-side request forgery when adding a new subscription in the calendar application, enabling the detection of local and remote services. Recommendations For...

CVE-2019-15621: Improper Preservation of Permissions

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

CVE-2019-15623: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled...

PT-2020-19957 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 16.0.1 Description: A reflected Cross-Site Scripting issue was found in the svg generation of the affected software. Recommendations: For Nextcloud Server version 16.0.1, update to a version that includes a fix for th...

CVE-2020-8118: Server-Side Request Forgery (SSRF)

An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application...