Nextcloud Server — набор клиент-серверных программ для создания и использования хранилища данных.
Релизный цикл, информация об уязвимостях
График релизов
Количество 456
CVE-2021-32678
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.
CVE-2021-32688
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading.
CVE-2021-32734
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.
CVE-2021-32680
Nextcloud Server is a Nextcloud package that handles data storage. In ...
CVE-2021-32703
Nextcloud Server is a Nextcloud package that handles data storage. In ...
CVE-2021-32679
Nextcloud Server is a Nextcloud package that handles data storage. In ...
CVE-2021-32725
Nextcloud Server is a Nextcloud package that handles data storage. In ...
CVE-2021-32678
Nextcloud Server is a Nextcloud package that handles data storage. In ...
CVE-2021-32688
Nextcloud Server is a Nextcloud package that handles data storage. Nex ...
CVE-2021-32734
Nextcloud Server is a Nextcloud package that handles data storage. In ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2021-32678 Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist. | CVSS3: 5.3 | 1% Низкий | больше 5 лет назад |
| CVE-2021-32688 Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading. | CVSS3: 8.8 | 2% Низкий | больше 5 лет назад |
| CVE-2021-32734 Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings. | CVSS3: 5.3 | 1% Низкий | больше 5 лет назад |
| CVE-2021-32680 Nextcloud Server is a Nextcloud package that handles data storage. In ... | CVSS3: 3.3 | 0% Низкий | больше 5 лет назад |
| CVE-2021-32703 Nextcloud Server is a Nextcloud package that handles data storage. In ... | CVSS3: 5.3 | 2% Низкий | больше 5 лет назад |
| CVE-2021-32679 Nextcloud Server is a Nextcloud package that handles data storage. In ... | CVSS3: 8.8 | 1% Низкий | больше 5 лет назад |
| CVE-2021-32725 Nextcloud Server is a Nextcloud package that handles data storage. In ... | CVSS3: 5.3 | 1% Низкий | больше 5 лет назад |
| CVE-2021-32678 Nextcloud Server is a Nextcloud package that handles data storage. In ... | CVSS3: 5.3 | 1% Низкий | больше 5 лет назад |
| CVE-2021-32688 Nextcloud Server is a Nextcloud package that handles data storage. Nex ... | CVSS3: 8.8 | 2% Низкий | больше 5 лет назад |
| CVE-2021-32734 Nextcloud Server is a Nextcloud package that handles data storage. In ... | CVSS3: 5.3 | 1% Низкий | больше 5 лет назад |
Уязвимостей на страницу