CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-36074 – Authentication headers exposed on by Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-36074
15 Sep 2022 — Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31120 – Federated share accepting/declining is not logged in audit log in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-31120
04 Aug 2022 — Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9qvg-7fwg-722x • CWE-778: Insufficient Logging •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31118 – Missing brute force protection on cloud federation sharing in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-31118
04 Aug 2022 — Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`. El servidor Nextcloud es una solución de nube personal de c... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vwh-5v93-3vcq • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 2CVE-2022-31014 – SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-31014
05 Jul 2022 — Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, bu... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29243 – Improper input-size validation on the user new session name in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-29243
31 May 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7cwm-qph5-4h5w • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-29163 – Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-29163
20 May 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds. Nextcloud Server es el software de servidor de archivos de Nextcloud, una plataforma de productividad auto alojada. • https://github.com/nextcloud/circles/pull/866 • CWE-671: Lack of Administrator Control over Security •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24889 – Insufficient Verification of Data Authenticity in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-24889
27 Apr 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1. Nextcloud Server es el software de servidor de archivos de Nextcloud, una plataforma de productividad autoalojada. En versiones anteriore... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24888 – Possible Injection in Nextcloud Server
https://notcve.org/view.php?id=CVE-2022-24888
27 Apr 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-41233 – Missing authorization in Nextcloud text
https://notcve.org/view.php?id=CVE-2021-41233
10 Mar 2022 — Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text application, which is by default shipped with Nextcloud Server, an attacker is able to access the folder names of "File Drop". For successful exploitation an attacker requires knowledge of the sharing link. It is recommended that users upgrade their Nextcloud Server to 20.0.14, 21.0.6 or 22.2.1. Users unable to upgrade should disable the Nextcloud Text application in the ... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-26c8-35cm-xq9m • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24741 – High memory usage in Nextcloud server
https://notcve.org/view.php?id=CVE-2022-24741
09 Mar 2022 — Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading specially crafted files which will cause the server to allocate too much memory / CPU. It is recommended that the Nextcloud Server is upgraded to 21.0.8 , 22.2.4 or 23.0.1. Users unable to upgrade should disable preview generation with the `'enable_previews'` config flag. El servidor Nextcloud es una plataforma de servicios de código abierto, de estilo de... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •