Server
by Nextcloud
Source repositories
CVEs (87)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-22878 | 0.00 | — | 0.01 | Mar 3, 2021 | Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`. | |||
| CVE-2020-8150 | 0.00 | — | 0.00 | Nov 9, 2020 | A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files. | |||
| CVE-2020-8154 | 0.00 | — | 0.02 | May 12, 2020 | An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint. | |||
| CVE-2020-8139 | 0.00 | — | 0.02 | Mar 20, 2020 | A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL. | |||
| CVE-2019-15619 | 0.00 | — | 0.01 | Feb 4, 2020 | Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project. | |||
| CVE-2020-8121 | 0.00 | — | 0.01 | Feb 4, 2020 | A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. | |||
| CVE-2019-15623 | 0.00 | — | 0.02 | Feb 4, 2020 | Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. |
- CVE-2021-22878Mar 3, 2021risk 0.00cvss —epss 0.01
Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.
- CVE-2020-8150Nov 9, 2020risk 0.00cvss —epss 0.00
A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.
- CVE-2020-8154May 12, 2020risk 0.00cvss —epss 0.02
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
- CVE-2020-8139Mar 20, 2020risk 0.00cvss —epss 0.02
A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.
- CVE-2019-15619Feb 4, 2020risk 0.00cvss —epss 0.01
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
- CVE-2020-8121Feb 4, 2020risk 0.00cvss —epss 0.01
A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.
- CVE-2019-15623Feb 4, 2020risk 0.00cvss —epss 0.02
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
Page 5 of 5