Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

27 records

Vendor: nextcloud Component: Desktop Clear all filters
TI-2023-09740 CVE-2023-23942

Self reflected HTML injection in Desktop client

Priority LOW 28

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00682 Published 2023-02-06 Fixed in 3.6.3 CWE-79
TI-2022-18710 CVE-2022-39334

nextcloudcmd incorrectly trusts bad TLS certificates

Priority MEDIUM 55

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00203 Published 2022-11-25 Fixed in 3.6.1 CWE-295
TI-2021-15492 CVE-2021-37617

Untrusted Search Path in Nextcloud Desktop Client

Priority LOW 32

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00456 Published 2021-08-18 No fix listed CWE-426
TI-2021-05756 CVE-2021-22895

Improper certificate validation in Nextcloud Desktop Client

Priority LOW 28

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01036 Published 2021-06-11 No fix listed CWE-295
TI-2021-05740 CVE-2021-22879 · GHSA-vrvw-x9cv-3j76

Injection in Nextcloud Desktop Client

Priority MEDIUM 46

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05036 Published 2021-04-14 No fix listed CWE-99
TI-2020-06643 CVE-2020-8225 · GHSA-j6gm-vwj7-5633

Cleartext storage of sensitive information in Desktop Client

Priority LOW 35

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0091 Published 2020-09-18 No fix listed CWE-312
TI-2020-06607 CVE-2020-8189 · GHSA-vc58-g8xx-fx3p

Cross-site scripting in Desktop Client

Priority LOW 27

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01401 Published 2020-08-21 No fix listed CWE-79
TI-2020-06645 CVE-2020-8227 · GHSA-64gg-6m36-39px

Path traversal in Desktop Client

Priority MEDIUM 52

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.25769 Published 2020-08-21 No fix listed CWE-22
TI-2020-06648 CVE-2020-8230 · GHSA-7m96-3q52-cjxh

Memory corruption in Desktop Client

Priority LOW 25

A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00351 Published 2020-08-17 No fix listed CWE-119
TI-2020-06642 CVE-2020-8224 · GHSA-79jq-9hhm-7rfm

Code injection in Desktop Client

Priority LOW 35

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00662 Published 2020-08-10 No fix listed CWE-94
Load more