Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

28 records

Vendor: nextcloud Component: Nextcloud Clear all filters
TI-2023-27197 CVE-2023-49790

App PIN code can be bypassed in Nextcloud Files iOS

Priority LOW 20

The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 4.3 Physical No auth No interaction EPSS 0.00288 Published 2023-12-22 Fixed in 4.9.2 CWE-287
TI-2021-18005 CVE-2021-41166

Permission bypass in Nextcloud Android App

Priority LOW 26

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00948 Published 2022-01-26 Fixed in 3.17.1 CWE-276
TI-2021-05766 CVE-2021-22905

Information disclosure in Nextcloud Android App

Priority LOW 32

Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud se…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01373 Published 2021-06-11 No fix listed CWE-200
TI-2021-05757 CVE-2021-22896

Missing authorization in Nextcloud Mail

Priority LOW 22

Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00988 Published 2021-06-11 No fix listed CWE-862
TI-2021-05773 CVE-2021-22912

Information disclosure in Nextcloud iOS app

Priority LOW 32

Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01367 Published 2021-06-11 No fix listed CWE-200
TI-2019-11721 CVE-2019-15622 · GHSA-q7g4-5r54-q83r

SQL injection in Nextcloud Android

Priority LOW 13

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.

CVSS 3.1LOW 2.4 Physical No auth No interaction EPSS 0.00507 Published 2020-02-04 No fix listed CWE-89
TI-2019-11714 CVE-2019-15615 · GHSA-68x5-pgwq-vm7v

Improper access control in Nextcloud Android

Priority LOW 27

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.

CVSS 3.1MEDIUM 6.1 Physical No auth No interaction EPSS 0.00369 Published 2020-02-04 No fix listed CWE-284
TI-2019-03858 CVE-2019-5450 · GHSA-x6fc-pmf5-67rv

Cross-site scripting in com.nextcloud.client

Priority LOW 31

Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML.

CVSS 3.1MEDIUM 6.8 Physical No auth No interaction EPSS 0.00495 Published 2019-07-30 No fix listed CWE-80
TI-2019-03860 CVE-2019-5452 · GHSA-ghq6-qfqp-33g5

Improper access control in com.nextcloud.client

Priority LOW 13

Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.

CVSS 3.1LOW 2.4 Physical No auth No interaction EPSS 0.00434 Published 2019-07-30 No fix listed CWE-284
TI-2019-03861 CVE-2019-5453 · GHSA-8q57-r99x-pmhc

Authentication bypass in nextcloud com.nextcloud.client

Priority LOW 28

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.

CVSS 3.1MEDIUM 6.1 Physical No auth No interaction EPSS 0.00469 Published 2019-07-30 No fix listed CWE-288
TI-2019-03862 CVE-2019-5454 · GHSA-8xmq-qp2g-jjf3

SQL injection in com.nextcloud.client

Priority MEDIUM 46

SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02019 Published 2019-07-30 No fix listed CWE-89
Load more