Nextcloud security-advisories

• CVE-2023-25821 Medium 5.7 Nextcloud download permissions can be changed by resharer 0.9%
• CVE-2023-25816 Medium 4.3 nextcloud vulnerable to Uncontrolled Resource Consumption 1.4%
• CVE-2023-25579 Medium 6.0 Directory traversal in Nextcloud server 0.5%
• CVE-2023-25162 Medium 5.3 Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs 0.8%
• CVE-2023-25161 Low 3.7 Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails 0.7%
• CVE-2023-25160 Medium 4.1 IDOR Vulnerability in Nextcloud Mail 0.5%
• CVE-2023-25159 Low 2.3 Nextcloud Server previews are accessible without a watermark 0.5%
• CVE-2023-25150 Medium 5.8 Document content of files can be obtained through Collabora for files of other users 0.7%
• CVE-2023-23942 Medium 5.4 Self reflected HTML injection in Desktop client 0.7%
• CVE-2023-23943 Medium 5.0 Blind SSRF via server URL input in the Nextcloud Mail app 0.9%
• CVE-2023-23944 Low 2.0 Nexcloud Mail app temporarily stores cleartext password in database 0.5%
• CVE-2023-22471 Low 3.5 Nextcloud Deck vulnerable to authorization bypass 0.5%
• CVE-2023-22470 Low 3.5 Nextcloud Deck vulnerable to uncontrolled resource consumption 0.7%
• CVE-2023-22469 Medium 5.8 Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache 0.7%
• CVE-2023-22473 Low 2.1 Passcode bypass on Talk-Android app 0.6%
• CVE-2023-22472 Medium 5.3 Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link 0.2%
• CVE-2022-41971 Medium 4.8 Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation 0.9%
• CVE-2022-41970 Low 2.6 Nextcloud Server's disabled download shares still allow download through preview images 0.7%
• CVE-2022-41969 Low 2.4 Nextcloud Server has no password length limit when creating a user as an administrator 0.9%
• CVE-2022-41968 Low 3.5 Nextcloud Server's calendar name length not validated before writing to database 1.0%
• CVE-2022-41926 Low 3.3 Nextcloud Talk Android broadcast incorrect permission handling 0.3%
• CVE-2022-39331 Medium 4.6 Cross-site Scripting (XSS) in Nexcloud Desktop Client 0.9%
• CVE-2022-39333 Medium 4.6 Cross-site scripting (XSS) in Nextcloud Desktop Client 1.0%
• CVE-2022-39346 Low 3.5 Missing length validation of user displayname in nextcloud server 1.1%
• CVE-2022-39332 Medium 4.6 Cross-site scripting (XSS) in Nextcloud Desktop Client 1.0%
• CVE-2022-39339 Medium 4.3 Cleartext Transmission of Sensitive Information in user_oidc 0.5%
• CVE-2022-39338 Low 3.5 Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc 0.7%
• CVE-2022-39334 Low 3.9 nextcloudcmd incorrectly trusts bad TLS certificates 0.2%
• CVE-2022-41882 Medium 6.6 Nextcloud Desktop vulnerable to code injection via malicious link 0.5%
• CVE-2022-39329 Low 3.5 Profile of disabled user stays accessible 0.8%
• CVE-2022-39330 Medium 4.8 Database resource exhaustion for logged-in users via sharee recommendations with circles 1.1%
• CVE-2022-39364 Medium 4.0 Exception logging in Sharepoint app reveals clear-text connection details 0.6%
• CVE-2022-39212 Medium 4.3 Last video frame is still sent after video is disabled in a call in Nextcloud Talk 0.7%
• CVE-2022-39210 Low 3.2 Access to internal files of the Nextcloud Android app 0.3%
• CVE-2022-39211 Low 3.0 Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server 1.0%
• CVE-2022-36074 Medium 6.4 Authentication headers exposed on by Nextcloud Server 0.8%
• CVE-2022-36075 Low 2.6 File list exposure in Nextcloud Files Access Control 0.6%
• CVE-2022-35931 Low 2.7 Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator 0.5%
• CVE-2022-35932 Low 3.5 Missing rate limit when trying to join a password protected Nextcloud Talk conversation 1.4%
• CVE-2022-31119 Low 3.1 Password disclosure in log file in Nextcloud Mail App 0.8%
• CVE-2022-31132 High 8.3 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" 0.7%
• CVE-2022-31120 Low 2.1 Federated share accepting/declining is not logged in audit log in Nextcloud Server 0.9%
• CVE-2022-31118 Medium 6.5 Missing brute force protection on cloud federation sharing in Nextcloud Server 0.8%
• CVE-2022-31131 Medium 5.4 Ownership check missing when updating or deleting mail attachments in Nextcloud mail 0.8%
• CVE-2022-31014 Medium 5.4 SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server 2.5%
• CVE-2022-31024 Medium 6.5 Federated editing allows iframing remote servers by default in richdocuments 0.6%
• CVE-2022-29243 Medium 4.3 Improper input-size validation on the user new session name in Nextcloud Server 1.6%
• CVE-2022-29163 Low 3.5 Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server 1.1%
• CVE-2022-29160 Low 2.8 Sensitive files/data exist after deletion of user account in Nextcloud Android 0.4%
• CVE-2022-24906 Low 3.5 Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck 1.1%