CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-22915
https://notcve.org/view.php?id=CVE-2021-22915
11 Jun 2021 — Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection. Nextcloud server versiones anteriores a 19.0.11, 20.0.10 y 21.0.2, es vulnerable a ataques de fuerza bruta debido a una falta de inclusión de subredes IPv6 en las consideraciones de limitación de velocidad. Esto podría potencialmen... • https://hackerone.com/reports/1154003 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-32657 – Malicious user could break user administration page
https://notcve.org/view.php?id=CVE-2021-32657
01 Jun 2021 — Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a malicious user may be able to break the user administration page. This would disallow administrators to administrate users on the Nextcloud instance. The vulnerability is fixed in versions 19.0.11, 20.0.10, and 21.0.2. As a workaround, administrators can use the OCC command line tool to administrate the Nextcloud users. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fx62-q47f-f665 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2021-32656 – Trusted servers exchange can be triggered by attacker
https://notcve.org/view.php?id=CVE-2021-32656
01 Jun 2021 — Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 20.0.10, and 21.0.2. An attacker can gain access to basic information about users of a server by accessing a public link that a legitimate server user added as a federated share. This happens because Nextcloud supports sharing registered users with other Nextcloud servers, which can be done automatically when selecting the "Add server automatically once a federated share... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j875-vr2q-h6x6 • CWE-284: Improper Access Control •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-32655 – Files Drop public link can be added as federated share
https://notcve.org/view.php?id=CVE-2021-32655
01 Jun 2021 — Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to convert a Files Drop link to a federated share. This causes an issue on the UI side of the sharing user. When the sharing user opens the sharing panel and tries to remove the "Create" privileges of this unexpected share, Nextcloud server would silently grant the share read privileges. The vulnerability is patched in versions 19.0.11, 20.0.10 and 21.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-grph-cm44-p3jv • CWE-241: Improper Handling of Unexpected Data Type •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-32654 – Attacker can obtain write access to any federated share/public link
https://notcve.org/view.php?id=CVE-2021-32654
01 Jun 2021 — Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive write/read privileges on any Federated File Share. Since public links can be added as federated file share, this can also be exploited on any public link. Users can upgrade to patched versions (19.0.11, 20.0.10 or 21.0.2) or, as a workaround, disable federated file sharing. Nextcloud Server es un paquete de Nextcloud que maneja el almacenamiento de datos. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf9h-v24c-22g5 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-32653 – Default settings leak federated cloud ID to lookup server of all users
https://notcve.org/view.php?id=CVE-2021-32653
01 Jun 2021 — Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user IDs to the lookup server even if the user has no fields set to published. The vulnerability is patched in versions 19.0.11, 20.0.10, and 21.0.2; no workarounds outside the updates are known to exist. Nextcloud Server es un paquete de Nextcloud que maneja el almacenamiento de datos. Nextcloud Server versiones anteriores 19.0.11, 20.0.10 o 21.0.2, envían los ID de usuario... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-396j-vqpr-qg45 • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 6.7EPSS: 0%CPEs: 2EXPL: 2CVE-2020-8296
https://notcve.org/view.php?id=CVE-2020-8296
03 Mar 2021 — Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. Nextcloud Server versiones anteriores a 20.0.0, almacena las contraseñas en un formato recuperable inclusive cuando el almacenamiento externo no está configurado • https://github.com/nextcloud/server/issues/17439 • CWE-257: Storing Passwords in a Recoverable Format CWE-521: Weak Password Requirements •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-22878
https://notcve.org/view.php?id=CVE-2021-22878
03 Mar 2021 — Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`. Nextcloud Server versiones anteriores a 20.0.6, es vulnerable a un ataque de tipo cross-site scripting (XSS) reflejado debido a una falta de saneamiento en "OC.Notification.show" • https://github.com/nextcloud/server/pull/25234 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-22877
https://notcve.org/view.php?id=CVE-2021-22877
03 Mar 2021 — A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users external storage configuration when not already configured yet. Una falta de comprobación de usuario en Nextcloud versiones anteriores a 20.0.6, inadvertidamente llena las propias credenciales del usuario para la configuración del almacenamiento externo de otros usuarios cuando aún no están configuradas • https://github.com/nextcloud/server/issues/24600 • CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8294
https://notcve.org/view.php?id=CVE-2020-8294
03 Feb 2021 — A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format. Una falta comprobación de enlace en Nextcloud Server versiones anteriores a 20.0.2, 19.0.5, 18.0.11, permite una ejecución de un ataque de tipo XSS almacenado usando Internet Explorer cuando se guarda una URL "javascript:" en formato markdown • https://hackerone.com/reports/1023787 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •