CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25161 – Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails
https://notcve.org/view.php?id=CVE-2023-25161
13 Feb 2023 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known wor... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f • CWE-284: Improper Access Control •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-39346 – Missing length validation of user displayname in nextcloud server
https://notcve.org/view.php?id=CVE-2022-39346
25 Nov 2022 — Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue. El servidor Nextcloud es un servidor en la nube personal de código abierto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-39330 – Database resource exhaustion for logged-in users via sharee recommendations with circles
https://notcve.org/view.php?id=CVE-2022-39330
27 Oct 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. As a workaround, disable the C... • https://github.com/nextcloud/circles/pull/1147 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 1CVE-2022-39364 – Exception logging in Sharepoint app reveals clear-text connection details
https://notcve.org/view.php?id=CVE-2022-39364
27 Oct 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpf5-jj85-36h5 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-39329 – Profile of disabled user stays accessible
https://notcve.org/view.php?id=CVE-2022-39329
27 Oct 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available. Nextcloud Server es el software de servidor de archivos para Nextcloud, una plataforma de productividad autohospedad... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3 • CWE-284: Improper Access Control CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-39211 – Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-39211
16 Sep 2022 — Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-36074 – Authentication headers exposed on by Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-36074
15 Sep 2022 — Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31120 – Federated share accepting/declining is not logged in audit log in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-31120
04 Aug 2022 — Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x • CWE-778: Insufficient Logging •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31118 – Missing brute force protection on cloud federation sharing in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-31118
04 Aug 2022 — Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`. El servidor Nextcloud es una solución de nube personal de c... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 2CVE-2022-31014 – SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-31014
05 Jul 2022 — Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, bu... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •