CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-25816 – nextcloud vulnerable to Uncontrolled Resource Consumption
https://notcve.org/view.php?id=CVE-2023-25816
24 Feb 2023 — Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consumption. A user can configure a very long password, consuming more resources on password validation than desired. This issue is patched in 25.0.3 No workaround is available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-53q2-cm29-7j83 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-25579 – Directory traversal in Nextcloud server
https://notcve.org/view.php?id=CVE-2023-25579
22 Feb 2023 — Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The function is used in the `newFile()` and `newFolder()` items, which may allow to creation of paths outside of ones own space and overwriting data from other users with crafted paths. This issue has been addressed in versions 25.0.2, 24.0.8, and 23.0.12. Users are advised to upgrade. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-273v-9h7x-p68v • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-25162 – Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs
https://notcve.org/view.php?id=CVE-2023-25162
13 Feb 2023 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.0.12 are vulnerable to server-side request forgery (SSRF). Attackers can leverage enclosed alphanumeric payloads to bypass IP filters and gain SSRF, which would allow an attacker to read crucial metadata if the server is hosted on the AWS platform. Nextcloud Server 24.0.8 and 23.0.2 and Nextcloud Enterprise Server... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mqrx-grp7-244m • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25161 – Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails
https://notcve.org/view.php?id=CVE-2023-25161
13 Feb 2023 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could result in service slowdown, storage overflow, or cost impact when using external email services. Users should upgrade to Nextcloud Server 25.0.1, 24.0.8, or 23.0.12 or Nextcloud Enterprise Server 25.0.1, 24.0.8, or 23.0.12 to receive a patch. No known wor... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-492h-596q-xr2f • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-25159 – Nextcloud Server previews are accessible without a watermark
https://notcve.org/view.php?id=CVE-2023-25159
13 Feb 2023 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to 7.0.1 have previews accessible without a watermark. The download should be hidden and the watermark should get appl... • https://github.com/nextcloud/richdocuments/pull/2579 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-41970 – Nextcloud Server's disabled download shares still allow download through preview images
https://notcve.org/view.php?id=CVE-2022-41970
01 Dec 2022 — Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9mh6-cph8-772c • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-41969 – Nextcloud Server has no password length limit when creating a user as an administrator
https://notcve.org/view.php?id=CVE-2022-41969
01 Dec 2022 — Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fx • CWE-400: Uncontrolled Resource Consumption CWE-521: Weak Password Requirements •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-41968 – Nextcloud Server's calendar name length not validated before writing to database
https://notcve.org/view.php?id=CVE-2022-41968
01 Dec 2022 — Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v • CWE-400: Uncontrolled Resource Consumption CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-39346 – Missing length validation of user displayname in nextcloud server
https://notcve.org/view.php?id=CVE-2022-39346
25 Nov 2022 — Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue. El servidor Nextcloud es un servidor en la nube personal de código abierto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6w9f-jgjx-4vj6 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 1CVE-2022-39364 – Exception logging in Sharepoint app reveals clear-text connection details
https://notcve.org/view.php?id=CVE-2022-39364
27 Oct 2022 — Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qpf5-jj85-36h5 • CWE-312: Cleartext Storage of Sensitive Information •