387 matches found
Alias creation did not validate account ID
None...
Denial of Service by requesting to reset a password (NC-SA-2021-003)
A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user...
SQL Injection in lookup-server (NC-SA-2019-010)
Improper sanitation of user input allowed any unauthenticated user to perform SQL injection attacks...
Missing brute force protection on password reset token
None...
Generated passwords are not fully validated by HIBPValidator
None...
Missing permission check on email metadata retrieval
None...
Global credentials of external storages are sent back to the frontend
None...
ID4me does not validate signature or expiration
None...
Insecure randomness for default password in file sharing when password policy app is disabled
None...
Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link
None...
WOPI API not protected by credentials/IP check
None...
Missing rate limit on signup page (NC-SA-2020-033)
A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...
No password length restriction in reset password endpoint
None...
File path disclosure of shared files in OfficeOnline application
None...
Group admins can create users with IDs of system folders (NC-SA-2019-015)
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...
Calendar app returns full stacktrace when an error happens while editing appointment
None...
Missing brute force protection on cloud federation sharing
None...
XSS in Talk
None...
Stored XSS in markdown file with Nextcloud Talk using Internet Explorer (NC-SA-2021-002)
A missing link validation in Nextcloud Server 20.0.1 allowed to execute a stored XSS attack on Internet Explorer users by saving a javascript url in a Markdown...
Missing brute force protection for passwords of password protected share links
None...
Profile of disabled user stays accessible
None...
Missing permission check on Deck API
None...
End-to-end encryption device setup did not verify public key
None...
File path disclosure of shared files in Nextcloud Text application
None...
Password of talk conversations can be bruteforced
None...
Disabled download shares still allow download through preview images
None...
Default Nextcloud Server and iOS Client leak sharee searches to Nextcloud
None...
XSS in desktop client via invalid server address on login form (NC-SA-2020-027)
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...
Can download "view-only" files with the Files ZIP app
None...
OAuth2 client_secret stored in plain text in the database
None...
XSS in Desktop Client in the notifications
None...
Ratelimiting can be bypassed using IPv6 subnets
None...
External storage credentials stored for wrong user (NC-SA-2021-004)
A missing user check in Nextcloud 20.0.5 and prior allowed to populate your own credentials for other users external storage configuration when they did not configure one yet...
PIN for passwordless WebAuthn is asked for but not verified (NC-SA-2020-037)
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it...
Improper validation on OAuth2 token endpoint (NC-SA-2018-003)
Improper validation of input allowed an attacker with access to the OAuth2 refresh token to obtain new tokens...
Missing password confirmation when changing external storage options
None...
Require strict cookies for image proxy requests
None...
End to end encryption folder locking is not properly protected
None...
Missing URL validation allowed RCE for the server on the Desktop client (NC-SA-2021-008)
Missing validation of URLs in Nextcloud Desktop Client 3.1.2 and earlier allowed a malicious server to execute code on the client. User interaction was required...
XSS through image upload of contacts using svg file (NC-SA-2020-045)
A missing file type check in Nextcloud Contacts 3.3.0 allowed a malicious user to upload malicious SVG files to perform XSS attacks...
Improper permission preservation on reshares (NC-SA-2020-012)
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...
Improper validation of permissions (NC-SA-2018-010)
Improper revalidation of permissions lead to not accepting access restrictions by acess tokens...
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
None...
Code injection in Nextcloud Desktop Client for macOS
None...
Initialization vector reuse in end-to-end encryption allows a malicious server admin to break manipulate and access files
None...
XSS in Contacts
None...
SSL certificate was not validated in Provider Registration Flow
None...
Improper confidentiality protection of server-side encryption keys (NC-SA-2020-040)
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on...
External storage app saves password for all users in the database (NC-SA-2021-006)
A missing condition in Nextcloud Server 19 and prior caused the external storage app to always store the users password in a recoverable format...
Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file (NC-SA-2020-038)
A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file...