Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0. ...

Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.

Improper Authentication in Nextcloud Server prior to version 12.0.3 wo ...

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks ...

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authent ...

A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.

A missing check in Nextcloud Server prior to 14.0.0 could give unautho ...

Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.

Improper revalidation of permissions in Nextcloud Server prior to 14.0 ...

Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.

Missing state in Nextcloud Server prior to 14.0.0 would not enforce th ...

A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.

A missing access check in Nextcloud Server prior to 14.0.0 could lead ...

A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.

A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13 ...

Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.

Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorizatio ...

Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.