Read the docs

nextcloud

Records402All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical19CVSS 9.0–10.0
CVSS high73CVSS 7.0–8.9

Exploited now

nextcloud records in CISA KEV

No nextcloud vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nextcloud Server 189 records HIGH Nextcloud 28 records MEDIUM Desktop 27 records MEDIUM Talk 20 records MEDIUM Deck 17 records MEDIUM Mail 15 records MEDIUM Calendar 10 records HIGH User Oidc 9 records MEDIUM

Records

20 records in Talk · all components

TI-2022-08697 CVE-2022-24887

Open Redirect in Nextcloud Talk

Priority MEDIUM 60

Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00938 Published 2022-04-27 Fixed in 11.3.4, 12.2.2 +1 CWE-601
TI-2020-06598 CVE-2020-8180 · GHSA-h68c-mg65-whp4

Code injection in Nextcloud Talk

Priority MEDIUM 46

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01668 Published 2020-06-08 No fix listed CWE-94
TI-2023-08722 CVE-2023-22473

Passcode bypass on Talk-Android app

Priority MEDIUM 44

Talk-Android enables users to have video & audio calls through Nextcloud on Android.

CVSS 3.1LOW 2.1 Physical No auth User interaction EPSS 0.00576 Published 2023-01-09 Fixed in 15.0.2 CWE-284
TI-2021-12344 CVE-2021-32676

Session Fixation in Nextcloud Talk

Priority LOW 31

Nextcloud Talk is a fully on-premises audio/video and chat communication service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00953 Published 2021-06-16 Fixed in 9.0.10, 10.0.8 +1 CWE-384
TI-2018-02775 CVE-2018-3781 · GHSA-86ww-pfxr-g767

Cross-site scripting in nextcloud/talk

Priority LOW 26

A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00743 Published 2018-08-13 No fix listed CWE-79
TI-2019-11718 CVE-2019-15619 · GHSA-mvc5-w9jr-jvqm

Cross-site scripting in Nextcloud Server

Priority LOW 24

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0084 Published 2020-02-04 No fix listed CWE-79
TI-2019-11719 CVE-2019-15620 · GHSA-hfx4-g7m9-jj99

Improper authentication in Nextcloud Talk

Priority LOW 15

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00766 Published 2020-02-04 No fix listed CWE-287
Open these records in search →