Vulnerabilities > Nextcloud > Nextcloud Server > 15.0.2
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-02-04 | CVE-2019-15618 | Cross-site Scripting vulnerability in Nextcloud Server Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location. | 3.5 |
| 2020-02-04 | CVE-2019-15617 | Improper Authentication vulnerability in Nextcloud Server A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. | 5.5 |
| 2020-02-04 | CVE-2019-15616 | Injection vulnerability in Nextcloud Server Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. | 4.0 |
| 2020-02-04 | CVE-2019-15613 | Insufficient Verification of Data Authenticity vulnerability in multiple products A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. | 8.0 |
| 2020-02-04 | CVE-2019-15612 | Session Fixation vulnerability in Nextcloud Server A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. | 3.2 |