Clear text storage of proxy parameters and passwords (NC-SA-2020-031)

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials...

Linux client is vulnerable to directory traversal when downloading files (NC-SA-2020-032)

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory...

Query restriction bypass on exposed FileContentProvider in Android app (NC-SA-2019-011)

Not strictly enough sanitization allowed an attacker to get content information from protected tables when using custom queries...

Server-Side request forgery in New-Subscription feature of the calendar app (NC-SA-2019-014)

An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application...

Content-Spoofing in "files" app (NC-SA-2017-006)

The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information...

ImageMagick vulnerability abusable via previews of malicious files

None...

XSS in Desktop Client via user status and information

None...

Missing length validation of user displayname allows to generate an SQL error

None...

Password of share by mail is not hashed when given on the create share call (NC-SA-2020-026)

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call...

Reflected XSS in svg logo generation (NC-SA-2019-018)

A reflected Cross-Site Scripting vunerability was discovered in the svg generation...

Improper share updates could result in extended data access (NC-SA-2019-003)

A bug could expose more data in reshared link shares than intended by the sharer...

Reflected XSS in error pages (NC-SA-2017-008)

Inadequate escaping of error messages leads to XSS vulnerabilities in multiple components.Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers...

Reflected XSS in Gallery application (NC-SA-2016-009)

The gallery app was not properly sanitizing exception messages from the Nextcloud server. Due to an endpoint where an attacker could influence the error message this lead to a reflected Cross-Site-Scripting vulnerability...

Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views

None...

Federated share accepting/declining is not logged in audit log

None...

Arbitrary code execution in desktop client via OpenSSL config (NC-SA-2020-030)

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory...

Bypass lock protection in Android app (NC-SA-2019-006)

If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, they can easily access the nextcloud-files even if the nextcloud app is locked with a fingerprint or pin...

fileId parameter reveals workflow associations in Nextcloud Approval app

None...

Deck app allows to spoof file extensions by using RTLO characters

None...

Improper handling of request URLs in Guests app allows guest users to bypass app allowlist

None...

Memory Leak in OCUtil.dll library in Desktop client can lead to DoS (NC-SA-2020-034)

A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system...

Missing permission check on resharing a board (NC-SA-2020-025)

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves...

Improper sanitization of HTML in directory names (NC-SA-2019-009)

Some basic HTML tags were rendered as Markup in directory names...

Thumbnails of files leaked via Android content provider (NC-SA-2019-007)

If an attacker has physical access to an Android smartphone without a screen lock, but with nextcloud installed and set up, he can easily access the nextcloud-files even if the nextcloud app is locked with a fingerprint or pin...

Stored XSS in calendar via group shares (NC-SA-2018-004)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...

File access control rules not applied to image previews (NC-SA-2018-002)

A missing check for read permissions allowed users that received an incomming share containing files tagged so they should be denied access to still request a preview for those files...

user_oidc app stores client secret unencrypted in database

None...

Users can set up workflows using restricted and invisible system tags

None...

Vulnerable moment-timezone version shipped

None...

Missing memory corruption protection on Windows release built (NC-SA-2020-035)

Missing ASLR and DEP protections in Nextcloud Desktop Client 2.6.4 for windows allowed to corrupt memory...

File-drop content is visible through the gallery app (NC-SA-2019-012)

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app...

Removing emails from circles does not revoke access to shared items (NC-SA-2019-013)

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle...

Improper neutralization of item names in projects feature (NC-SA-2020-010)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Stored XSS in contacts via group shares (NC-SA-2018-005)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins...

Denial of Service attack (NC-SA-2017-004)

Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service...

Two-Factor Authentication Bypass via Pending Session Token Replay

None...

Bypass of second factor authentication on DAV endpoints by reusing a pre-2FA session ID

None...

Nextcloud Server shipped insecure Archive_Tar version

None...

Missing default timeout on HTTP requests (NC-SA-2020-005)

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long...

Stored XSS in autocomplete suggestions for file comments (NC-SA-2018-008)

A missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users...

Limitation of app specific password scope can be bypassed (NC-SA-2017-009)

Improper session handling allowed an application specific password without permission to the files access to the users file...

Content-Spoofing in "files" app (NC-SA-2016-010)

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...

Content-Spoofing in "files" app (NC-SA-2016-003)

The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user...

Tables app allowed users to view columns metadata information of any table

None...

Share information of Tables app is not limited to affected users

None...

Can access comments and attachments of deleted cards

None...

Lack of ratelimit on shareinfo endpoint

None...

Improper integrity protection of server-side encryption keys (NC-SA-2020-041)

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys...

Duplicate setup of second factor allowed (NC-SA-2020-006)

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login...

Renaming an item to a protected hidden folder deletes the target (NC-SA-2020-017)

Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name...