NE
Product
Nextcloud
29
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 19Low 7
Watch
Add Nextcloud to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-28647 | 6.8 | Mar 30 | App pin of the iOS app can be bypassed in Nextcloud iOS Affected: before 4.7.0 |
| CVE-2019-5455 | 6.8 | Jul 30 | Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process Affected: 3.6.0 |
| CVE-2019-5450 | 6.8 | Jul 30 | Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML Affected: before 3.7.0 |
| CVE-2021-22912 | 6.5 | Jun 11 | Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local… Affected: before 3.4.2 |
| CVE-2021-22905 | 6.5 | Jun 11 | Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server… Affected: before 3.16.0 |
| CVE-2023-28999 | 6.4 | Apr 4 | Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders Affected: 3.0.5 before 4.8.0; 3.13.0 before 3.25.0 |
| CVE-2019-15615 | 6.1 | Feb 4 | A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past Affected: through 3.9.0 |
| CVE-2019-5453 | 6.1 | Jul 30 | Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file… Affected: through 3.2.4; 3.3.0; 3.3.0; 3.3.0 |
| CVE-2022-39210 | 5.5 | Sep 17 | Nextcloud android is the official Android client for the Nextcloud home server platform Affected: before 3.21.0 |
| CVE-2021-32694 | 5.5 | Jun 17 | Nextcloud Android app is the Android client for Nextcloud Affected: before 3.15.1 |
| CVE-2025-59788 | 5.4 | Dec 4 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23,… Affected: before 22.2.10.33; 23 before 23.0.12.29; 24 before 24.0.12.28; 25 before 25.0.13.23; 26 before 26.0.13.20; 27 before 27.1.11.20; +5 more |
| CVE-2019-15614 | 5.4 | Feb 4 | Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files Affected: before 2.25.0 |
| CVE-2021-41166 | 5.3 | Jan 26 | The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform Affected: before 3.17.1 |
| CVE-2016-9460 | 5.3 | Mar 28 | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app Affected: through 9.0.51 |
| CVE-2019-15611 | 4.9 | Feb 4 | Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g Affected: before 2.24.0 |
| CVE-2021-32658 | 4.6 | Jun 8 | Nextcloud Android is the Android client for the Nextcloud open source home cloud system Affected: before 3.16.1 |
| CVE-2023-49790 | 4.3 | Dec 22 | App PIN code can be bypassed in Nextcloud Files iOS Affected: before 4.9.2 |
| CVE-2021-22896 | 4.3 | Jun 11 | Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to create mail aliases for other users Affected: before 1.9.5 |
| CVE-2017-0888 | 4.3 | Apr 5 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app Affected: through 9.0.54 |
Showing 19