Vulnerabilities > Nextcloud > Nextcloud Server > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-05-12 | CVE-2020-8155 | Cross-site Scripting vulnerability in Nextcloud Server An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF. | 5.4 |
| 2020-03-20 | CVE-2020-8139 | Missing Authorization vulnerability in multiple products A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL. | 6.5 |
| 2020-03-20 | CVE-2020-8138 | Server-Side Request Forgery (SSRF) vulnerability in Nextcloud Server A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL. | 4.0 |
| 2020-02-04 | CVE-2020-8122 | Improper Input Validation vulnerability in Nextcloud Server A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received. | 4.0 |
| 2020-02-04 | CVE-2020-8121 | Exposure of Resource to Wrong Sphere vulnerability in Nextcloud Server A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. | 5.5 |
| 2020-02-04 | CVE-2020-8120 | Cross-site Scripting vulnerability in Nextcloud Server 16.0.1 A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation. | 6.1 |
| 2020-02-04 | CVE-2020-8119 | Incorrect Authorization vulnerability in Nextcloud Server Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app. | 4.0 |
| 2020-02-04 | CVE-2020-8118 | Server-Side Request Forgery (SSRF) vulnerability in multiple products An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application. | 4.0 |
| 2020-02-04 | CVE-2020-8117 | Improper Preservation of Permissions vulnerability in Nextcloud Server Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. | 4.0 |
| 2020-02-04 | CVE-2019-15624 | Improper Input Validation vulnerability in multiple products Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. | 4.0 |