security-advisories
by Nextcloud
Source repositories
- https://github.com/nextcloud/security-advisories
- https://github.com/nextcloud/server
- https://github.com/nextcloud/android
- https://github.com/nextcloud/desktop
- https://github.com/nextcloud/ios
- https://github.com/nextcloud/spreed
- https://github.com/nextcloud/deck
- https://github.com/nextcloud/calendar
- https://github.com/nextcloud/mail
- https://github.com/nextcloud/talk-android
- https://github.com/nextcloud/notes
- https://github.com/nextcloud/text
- https://github.com/nextcloud/contacts
- https://github.com/nextcloud/richdocuments
- https://github.com/nextcloud/groupfolders
- https://github.com/nextcloud/tables
- https://github.com/nextcloud/user_oidc
- https://github.com/nextcloud/circles
- https://github.com/nextcloud/guests
CVEs (233)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-28834 | Low | 0.00 | 3.5 | 0.01 | Apr 3, 2023 | Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.0.6, and 25.0.0 until 25.0.4, have an information disclosure vulnerability. A user… | ||
| CVE-2023-28845 | Low | 0.00 | 3.5 | 0.00 | Mar 31, 2023 | Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation,… | ||
| CVE-2023-28844 | Med | 0.00 | 5.7 | 0.01 | Mar 31, 2023 | Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users… | ||
| CVE-2023-28645 | Med | 0.00 | 5.7 | 0.01 | Mar 31, 2023 | Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the… | ||
| CVE-2023-28835 | Low | 0.00 | 3.5 | 0.01 | Mar 30, 2023 | Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker… | ||
| CVE-2023-28833 | Low | 0.00 | 2.4 | 0.01 | Mar 30, 2023 | Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access… | ||
| CVE-2023-28647 | Med | 0.00 | 4.4 | 0.00 | Mar 30, 2023 | Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password… | ||
| CVE-2023-28646 | Med | 0.00 | 4.4 | 0.00 | Mar 30, 2023 | Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This… | ||
| CVE-2023-28644 | Med | 0.00 | 5.7 | 0.01 | Mar 30, 2023 | Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the… | ||
| CVE-2023-28643 | Med | 0.00 | 5.5 | 0.01 | Mar 30, 2023 | Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended… | ||
| CVE-2023-25817 | Low | 0.00 | 3.5 | 0.01 | Mar 27, 2023 | Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is… | ||
| CVE-2023-25818 | Med | 0.00 | 5.3 | 0.01 | Mar 27, 2023 | Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are… | ||
| CVE-2023-25820 | Med | 0.00 | 4.2 | 0.00 | Mar 22, 2023 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as… | ||
| CVE-2023-26041 | Low | 0.00 | 2.6 | 0.01 | Feb 27, 2023 | Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk… | ||
| CVE-2023-25821 | Med | 0.00 | 5.7 | 0.01 | Feb 25, 2023 | Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is… | ||
| CVE-2023-25816 | Med | 0.00 | 4.3 | 0.01 | Feb 25, 2023 | Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in… | ||
| CVE-2023-25579 | Med | 0.00 | 6.0 | 0.01 | Feb 22, 2023 | Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which may allow to… | ||
| CVE-2023-25162 | Med | 0.00 | 5.3 | 0.01 | Feb 13, 2023 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage… | ||
| CVE-2023-25161 | Low | 0.00 | 3.7 | 0.01 | Feb 13, 2023 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service… | ||
| CVE-2023-25160 | Med | 0.00 | 4.1 | 0.00 | Feb 13, 2023 | Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25,… |
- risk 0.00cvss 3.5epss 0.01
Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.0.6, and 25.0.0 until 25.0.4, have an information disclosure vulnerability. A user…
- risk 0.00cvss 3.5epss 0.00
Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation,…
- risk 0.00cvss 5.7epss 0.01
Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.10 and 25.0.4. Users…
- risk 0.00cvss 5.7epss 0.01
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the…
- risk 0.00cvss 3.5epss 0.01
Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when the sharer did not change it the password could be guessable to an attacker…
- risk 0.00cvss 2.4epss 0.01
Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access…
- risk 0.00cvss 4.4epss 0.00
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password…
- risk 0.00cvss 4.4epss 0.00
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This…
- risk 0.00cvss 5.7epss 0.01
Nextcloud server is an open source home cloud implementation. In releases of the 25.0.x branch before 25.0.3 an inefficient fetch operation may impact server performances and/or can lead to a denial of service. This issue has been addressed and it is recommended that the…
- risk 0.00cvss 5.5epss 0.01
Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended…
- risk 0.00cvss 3.5epss 0.01
Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is…
- risk 0.00cvss 5.3epss 0.01
Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are…
- risk 0.00cvss 4.2epss 0.00
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as…
- risk 0.00cvss 2.6epss 0.01
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk…
- risk 0.00cvss 5.7epss 0.01
Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is…
- risk 0.00cvss 4.3epss 0.01
Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in…
- risk 0.00cvss 6.0epss 0.01
Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which may allow to…
- risk 0.00cvss 5.3epss 0.01
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage…
- risk 0.00cvss 3.7epss 0.01
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service…
- risk 0.00cvss 4.1epss 0.00
Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25,…
Page 7 of 12