Existance of calendars and addressbooks can be checked by unauthenticated users

None...

Ownership check missing when updating or deleting mail attachments

None...

Filenames not escaped by default in controllers using DownloadResponse

None...

Missing permission check on email metadata retrieval

None...

Alias creation did not validate account ID

None...

Ability to by-pass second factor

None...

Insecure randomness for default password in file sharing when password policy app is disabled

None...

Missing brute force protection on password reset token

None...

No password length restriction in reset password endpoint

None...

Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link

None...

Two-Factor Authentication not enforced for pages marked as public

None...

File path disclosure of shared files in OfficeOnline application

None...

Stored XSS in markdown file with Nextcloud Talk using Internet Explorer (NC-SA-2021-002)

A missing link validation in Nextcloud Server 20.0.1 allowed to execute a stored XSS attack on Internet Explorer users by saving a javascript url in a Markdown...

Missing rate limit on signup page (NC-SA-2020-033)

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times...

Group admins can create users with IDs of system folders (NC-SA-2019-015)

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders...

Global credentials of external storages are sent back to the frontend

None...

Missing permission check on Deck API

None...

XSS in Talk

None...

Users can delete old versions of read-only shared files

None...

Calendar app returns full stacktrace when an error happens while editing appointment

None...

Missing brute force protection on cloud federation sharing

None...

Missing sanitization in iOS App allows XSS (NC-SA-2020-003)

Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files...

ID4me does not validate signature or expiration

None...

Password of talk conversations can be bruteforced

None...

Profile of disabled user stays accessible

None...

Default Nextcloud Server and iOS Client leak sharee searches to Nextcloud

None...

Improper permission preservation on reshares (NC-SA-2020-012)

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

Improper validation on OAuth2 token endpoint (NC-SA-2018-003)

Improper validation of input allowed an attacker with access to the OAuth2 refresh token to obtain new tokens...

Missing password confirmation when changing external storage options

None...

Missing permission check when removing a photo from an album

None...

Missing brute force protection for passwords of password protected share links

None...

End-to-end encryption device setup did not verify public key

None...

Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner

None...

Can download "view-only" files with the Files ZIP app

None...

OAuth2 client_secret stored in plain text in the database

None...

Delete permissions are not saved when creating public share

None...

Disabled download shares still allow download through preview images

None...

XSS in Desktop Client in the notifications

None...

Ratelimiting can be bypassed using IPv6 subnets

None...

External storage credentials stored for wrong user (NC-SA-2021-004)

A missing user check in Nextcloud 20.0.5 and prior allowed to populate your own credentials for other users external storage configuration when they did not configure one yet...

PIN for passwordless WebAuthn is asked for but not verified (NC-SA-2020-037)

A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it...

XSS in desktop client via invalid server address on login form (NC-SA-2020-027)

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html including local links when responding with invalid data on the login attempt...

Code injection in Nextcloud Desktop Client for macOS

None...

Inviting excessive long email addresses to a calendar event makes the server unresponsive

None...

nextcloudcmd incorrectly trusts bad TLS certificates

None...

Malicious Android application can crash the Nextcloud Android Client

None...

External storage app saves password for all users in the database (NC-SA-2021-006)

A missing condition in Nextcloud Server 19 and prior caused the external storage app to always store the users password in a recoverable format...

Improper confidentiality protection of server-side encryption keys (NC-SA-2020-040)

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on...

Message Authentication Codes calculated by the Default Encryption Module allow an attacker to silently overwrite blocks in a file (NC-SA-2020-038)

A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file...

Code injection in Nextcloud Desktop Client for macOS (NC-SA-2020-016)

A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLDINSERTLIBRARIES set in the enviroment...