Vulnerabilities > Nextcloud > Critical

DATE CVE VULNERABILITY TITLE RISK
2021-06-11 CVE-2021-22915 Improper Restriction of Excessive Authentication Attempts vulnerability in multiple products
Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations.
network
low complexity
nextcloud fedoraproject CWE-307
critical
 9.8
9.8
2021-06-01 CVE-2021-32654 Authorization Bypass Through User-Controlled Key vulnerability in Nextcloud Server
Nextcloud Server is a Nextcloud package that handles data storage.
network
low complexity
nextcloud CWE-639
critical
 9.1
9.1
2019-08-07 CVE-2019-5476 SQL Injection vulnerability in Nextcloud Lookup-Server 0.2.0
An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary SQL commands.
network
low complexity
nextcloud CWE-89
critical
 9.8
9.8
2019-07-30 CVE-2019-5454 SQL Injection vulnerability in Nextcloud
SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account.
network
low complexity
nextcloud CWE-89
critical
 9.8
9.8