Nextcloud security-advisories

• CVE-2022-29159 Medium 5.0 Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck 1.0%
• CVE-2022-24890 Low 2.4 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk 0.9%
• CVE-2022-24889 Low 2.4 Insufficient Verification of Data Authenticity in Nextcloud Server 0.7%
• CVE-2022-24888 Medium 4.3 Possible Injection in Nextcloud Server 1.3%
• CVE-2022-24887 Medium 4.3 Open Redirect in Nextcloud Talk 0.9%
• CVE-2022-24886 Low 2.2 Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client 0.4%
• CVE-2022-24885 Low 2.0 Improper Authentication in Nextcloud Android Files 0.5%
• CVE-2022-24838 Medium 5.3 Command Injection in Appointment Emails for Nextcloud Calendar 33.0%
• CVE-2021-41233 Medium 6.5 Missing authorization in Nextcloud text 0.8%
• CVE-2022-24741 Low 3.5 High memory usage in Nextcloud server 1.6%
• CVE-2021-41241 Medium 4.3 Advanced permissions is not respected for subfolders in Nextcloud server 0.9%
• CVE-2021-41239 Medium 5.3 User enumeration setting not respected in Nextcloud server 1.2%
• CVE-2021-41181 Low 2.4 Nextcloud Talk app exposes chat messages on lockscreen 0.3%
• CVE-2021-41180 Medium 4.7 Geolocation preview links can be set to arbitrary links in nextcloud talk 1.0%
• CVE-2021-41166 Medium 4.3 Permission bypass in Nextcloud Android App 0.9%
• CVE-2021-39222 Medium 6.4 XSS in Talk 1.1%
• CVE-2021-41179 Medium 6.5 Two-Factor Authentication not enforced for pages marked as public 1.2%
• CVE-2021-41178 High 8.8 File Traversal affecting SVG files on Nextcloud Server 1.8%
• CVE-2021-41177 High 8.1 Rate-limits not working on instances without configured memory cache backend 1.6%
• CVE-2021-39224 Low 3.5 File path disclosure of shared files in OfficeOnline application 0.9%
• CVE-2021-39225 High 8.1 Missing permission check on Deck API 1.3%
• CVE-2021-39223 Medium 4.8 File path disclosure of shared files in Richdocuments application 1.1%
• CVE-2021-39221 Medium 6.4 XSS in Contacts 0.5%
• CVE-2021-39220 Low 3.5 Bypass of image blocking in Nextcloud Mail 0.9%
• CVE-2021-32802 Critical 9.3 Preview generation used third-party library not suited for user-generated content in Nextcloud server 2.6%
• CVE-2021-32801 Medium 5.5 Exceptions may have logged Encryption-at-Rest key content in Nextcloud server 0.2%
• CVE-2021-32800 High 8.1 Bypass of Two Factor Authentication in Nextcloud server 1.8%
• CVE-2021-32766 Medium 5.3 Nextcloud Text app can disclose existence of folders in "File Drop" link share 1.3%
• CVE-2021-37629 Medium 5.3 Lack of ratelimit on Richdocuments OCS endpoint in nextcloud 1.4%
• CVE-2021-37628 High 7.5 File Drop can be bypassed using Richdocuments app in nextcloud 2.1%
• CVE-2021-32782 Medium 5.8 Cross-Site Scripting in Nextcloud Circles 0.8%
• CVE-2021-37630 Medium 6.5 Secret Circle can be joined without approval in Nextcloud Circles 1.2%
• CVE-2021-37631 Medium 6.5 Circle can be accessed by non-Circle members in Nextcloud Deck 1.3%
• CVE-2021-37617 High 7.3 Untrusted Search Path in Nextcloud Desktop Client 0.5%
• CVE-2021-32728 Medium 6.5 End-to-end encryption device setup did not verify public key 0.9%
• CVE-2021-32748 Medium 4.3 WOPI API not protected by credentials/IP check 1.0%
• CVE-2021-32741 Medium 5.3 Lack of ratelimit on public share link mount endpoint 1.3%
• CVE-2021-32734 Low 3.1 File path disclosure of shared files in Nextcloud Text application 1.4%
• CVE-2021-32733 Medium 4.8 XSS in Nextcloud Text application 1.1%
• CVE-2021-32727 Medium 5.7 End-to-end encryption device setup did not verify public key 0.7%
• CVE-2021-32726 High 7.1 Webauthn tokens not removed after user has been deleted 1.8%
• CVE-2021-32725 Low 3.5 Default share permissions not respected for federated reshares 1.2%
• CVE-2021-32707 Medium 4.3 Bypass of image blocking in Nextcloud Mail 1.1%
• CVE-2021-32689 High 8.1 Nextcloud Talk not properly disassociating users from chats after account deletion 1.0%
• CVE-2021-32705 Medium 5.3 Lack of ratelimit on public DAV endpoint 1.7%
• CVE-2021-32703 Medium 5.3 Lack of ratelimit on shareinfo endpoint 1.5%
• CVE-2021-32688 High 8.8 Application specific tokens can change their own scope 2.3%
• CVE-2021-32680 Low 3.3 Audit log is not properly logging unsetting of share expiration date 0.4%
• CVE-2021-32679 Low 3.5 Filenames not escaped by default in controllers using DownloadResponse 1.4%
• CVE-2021-32678 Low 3.7 Ratelimit not applied on OCS API responses 1.4%