Read the docs

nextcloud

Records402All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical19CVSS 9.0–10.0
CVSS high73CVSS 7.0–8.9

Exploited now

nextcloud records in CISA KEV

No nextcloud vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nextcloud Server 189 records HIGH Nextcloud 28 records MEDIUM Desktop 27 records MEDIUM Talk 20 records MEDIUM Deck 17 records MEDIUM Mail 15 records MEDIUM Calendar 10 records HIGH User Oidc 9 records MEDIUM

Records

27 records in Desktop · all components

TI-2022-18710 CVE-2022-39334

nextcloudcmd incorrectly trusts bad TLS certificates

Priority MEDIUM 55

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00203 Published 2022-11-25 Fixed in 3.6.1 CWE-295
TI-2020-06645 CVE-2020-8227 · GHSA-64gg-6m36-39px

Path traversal in Desktop Client

Priority MEDIUM 52

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.25769 Published 2020-08-21 No fix listed CWE-22
TI-2021-05740 CVE-2021-22879 · GHSA-vrvw-x9cv-3j76

Injection in Nextcloud Desktop Client

Priority MEDIUM 46

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05036 Published 2021-04-14 No fix listed CWE-99
TI-2020-06643 CVE-2020-8225 · GHSA-j6gm-vwj7-5633

Cleartext storage of sensitive information in Desktop Client

Priority LOW 35

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0091 Published 2020-09-18 No fix listed CWE-312
TI-2020-06642 CVE-2020-8224 · GHSA-79jq-9hhm-7rfm

Code injection in Desktop Client

Priority LOW 35

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00662 Published 2020-08-10 No fix listed CWE-94
TI-2021-15492 CVE-2021-37617

Untrusted Search Path in Nextcloud Desktop Client

Priority LOW 32

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00456 Published 2021-08-18 No fix listed CWE-426
TI-2020-06558 CVE-2020-8140 · GHSA-2xxg-j453-5c23

Code injection in Desktop Client

Priority LOW 31

A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00689 Published 2020-03-20 No fix listed CWE-94
TI-2023-09740 CVE-2023-23942

Self reflected HTML injection in Desktop client

Priority LOW 28

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00682 Published 2023-02-06 Fixed in 3.6.3 CWE-79
TI-2021-05756 CVE-2021-22895

Improper certificate validation in Nextcloud Desktop Client

Priority LOW 28

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01036 Published 2021-06-11 No fix listed CWE-295
TI-2020-06607 CVE-2020-8189 · GHSA-vc58-g8xx-fx3p

Cross-site scripting in Desktop Client

Priority LOW 27

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01401 Published 2020-08-21 No fix listed CWE-79
TI-2020-06648 CVE-2020-8230 · GHSA-7m96-3q52-cjxh

Memory corruption in Desktop Client

Priority LOW 25

A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00351 Published 2020-08-17 No fix listed CWE-119
Load more
Open these records in search →