Vulnerabilities > Nextcloud
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-02-04 | CVE-2019-15610 | Unspecified vulnerability in Nextcloud Circles Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle. | 4.3 |
| 2019-08-07 | CVE-2019-5476 | SQL Injection vulnerability in Nextcloud Lookup-Server 0.2.0 An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary SQL commands. | 9.8 |
| 2019-07-30 | CVE-2019-5455 | Improper Authentication vulnerability in Nextcloud 3.6.0 Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. | 6.8 |
| 2019-07-30 | CVE-2019-5454 | SQL Injection vulnerability in Nextcloud SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account. | 9.8 |
| 2019-07-30 | CVE-2019-5453 | Improper Authentication vulnerability in Nextcloud Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider. | 6.1 |
| 2019-07-30 | CVE-2019-5452 | Unspecified vulnerability in Nextcloud Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved. low complexity nextcloud | 2.4 |
| 2019-07-30 | CVE-2019-5451 | Missing Authentication for Critical Function vulnerability in Nextcloud Server Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time. | 4.6 |
| 2019-07-30 | CVE-2019-5450 | Cross-site Scripting vulnerability in Nextcloud Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when using basic HTML. | 6.8 |
| 2019-07-30 | CVE-2019-5449 | Missing Authorization vulnerability in Nextcloud Server A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. | 4.3 |
| 2019-06-05 | CVE-2019-12739 | OS Command Injection vulnerability in Nextcloud Extract lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters). | 8.8 |