Read the docs

nextcloud

Records402All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical19CVSS 9.0–10.0
CVSS high73CVSS 7.0–8.9

Exploited now

nextcloud records in CISA KEV

No nextcloud vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nextcloud Server 189 records HIGH Nextcloud 28 records MEDIUM Desktop 27 records MEDIUM Talk 20 records MEDIUM Deck 17 records MEDIUM Mail 15 records MEDIUM Calendar 10 records HIGH User Oidc 9 records MEDIUM

Records

17 records in Deck · all components

TI-2021-16610 CVE-2021-39225

Missing permission check on Deck API

Priority LOW 38

Nextcloud is an open-source, self-hosted productivity platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01336 Published 2021-10-25 Fixed in 1.2.9, 1.4.5 +1 CWE-639
TI-2020-06600 CVE-2020-8182 · GHSA-9fvc-qpfc-hjxh

Improper access control in Nextcloud Deck

Priority LOW 37

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01035 Published 2020-10-05 No fix listed CWE-284
TI-2021-05774 CVE-2021-22913

Information disclosure in Nextcloud Deck

Priority LOW 32

Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01368 Published 2021-06-11 No fix listed CWE-200
TI-2021-15506 CVE-2021-37631

Circle can be accessed by non-Circle members in Nextcloud Deck

Priority LOW 31

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01277 Published 2021-09-07 Fixed in 1.2.9, 1.4.4 +1 CWE-639
TI-2023-08719 CVE-2023-22470

Nextcloud Deck vulnerable to uncontrolled resource consumption

Priority LOW 30

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00694 Published 2023-01-14 Fixed in 1.6.5, 1.7.3 +1 CWE-400
TI-2019-11718 CVE-2019-15619 · GHSA-mvc5-w9jr-jvqm

Cross-site scripting in Nextcloud Server

Priority LOW 24

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0084 Published 2020-02-04 No fix listed CWE-79
TI-2020-06714 CVE-2020-8297 · GHSA-hx5m-93g9-j2jh

Authorization bypass in Nextcloud Deck

Priority LOW 23

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01339 Published 2021-02-23 No fix listed CWE-639
TI-2023-08720 CVE-2023-22471

Nextcloud Deck vulnerable to authorization bypass

Priority LOW 21

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00548 Published 2023-01-14 Fixed in 1.6.5, 1.7.3 +1 CWE-639
TI-2020-06653 CVE-2020-8235 · GHSA-crm5-43pc-vrcg

Authorization bypass in Nextcloud Deck app

Priority LOW 21

Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00781 Published 2020-10-05 No fix listed CWE-639
Open these records in search →