Nextcloud: >> Nextcloud Server >> 15.0.13 Security Vulnerabilities
A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.
CVSS Score
4.1
EPSS Score
0.0
Published
2020-11-09
A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.
CVSS Score
2.2
EPSS Score
0.003
Published
2020-11-02
A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.
CVSS Score
7.5
EPSS Score
0.01
Published
2020-11-02
A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it.
CVSS Score
6.8
EPSS Score
0.002
Published
2020-11-02
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
CVSS Score
7.7
EPSS Score
0.01
Published
2020-05-12
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-05-12
A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.
CVSS Score
6.5
EPSS Score
0.002
Published
2020-03-20
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
CVSS Score
4.3
EPSS Score
0.003
Published
2020-02-04
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
CVSS Score
5.4
EPSS Score
0.001
Published
2020-02-04
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
CVSS Score
4.8
EPSS Score
0.003
Published
2020-02-04