Product by Nextcloud
Nextcloud Server
207 known vulnerabilities in Nextcloud Server (Nextcloud), 0 of them actively exploited (CISA KEV).
Key figures
207
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-26482 | Scope of workflow operations is not validated in nextcloud server | 9.1 | |
| High | CVE-2016-9463 | ownCloud: Incorrect Implementation of Authentication Algorithm | 8.1 | |
| Critical | CVE-2021-32802 | Nextcloud Security-advisories: Inclusion of Functionality from Untrusted Control Sphere | 9.3 | |
| High | CVE-2021-32688 | Application specific tokens can change their own scope | 8.8 | |
| Critical | CVE-2021-22915 | Nextcloud Server: Improper Restriction of Excessive Authentication Attempts | 9.8 | |
| High | CVE-2021-32656 | Trusted servers exchange can be triggered by attacker | 8.6 | |
| Critical | CVE-2021-32654 | Attacker can obtain write access to any federated share/public link | 8.1 | |
| High | CVE-2021-32800 | Bypass of Two Factor Authentication in Nextcloud server | 8.1 | |
| High | CVE-2020-8183 | Nextcloud Server: Plaintext Storage of a Password | 7.5 | |
| High | CVE-2018-3761 | Nextcloud Server: Improper Authentication | 8.1 | |
| Medium | CVE-2016-9467 | Nextcloud Server: User Interface (UI) Misrepresentation of Critical Information | 5.3 | |
| High | CVE-2020-8154 | Nextcloud Server: Authorization Bypass Through User-Controlled Key | 7.7 | |
| High | CVE-2020-8295 | Nextcloud Server: Uncontrolled Resource Consumption | 7.5 | |
| Medium | CVE-2022-31014 | SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server | 5.4 | |
| High | CVE-2021-41177 | Rate-limits not working on instances without configured memory cache backend | 8.1 | |
| Critical | CVE-2021-32726 | Webauthn tokens not removed after user has been deleted | 7.1 | |
| High | CVE-2018-3775 | HackerOne Nextcloud Server: Improper Authentication | 8.8 | |
| Medium | CVE-2021-22877 | Nextcloud Server: Improper Access Control | 6.5 | |
| Medium | CVE-2016-9468 | Nextcloud Server: User Interface (UI) Misrepresentation of Critical Information | 5.3 | |
| Medium | CVE-2020-8293 | Nextcloud Server: Uncontrolled Resource Consumption | 6.5 | |
| Medium | CVE-2019-15623 | Nextcloud Server: Exposure of Private Personal Information to an Unauthorized Actor | 5.3 | |
| Medium | CVE-2016-9466 | ownCloud: Cross-site Scripting | 6.1 | |
| Medium | CVE-2020-8139 | Nextcloud Server: Improper Access Control | 6.5 | |
| High | CVE-2023-35928 | Nextcloud user scoped external storage can be used to gather credentials of other users | 8.5 | |
| High | CVE-2023-48239 | Nextcloud Server users can make external storage mount points inaccessible for other users | 8.5 |