Homepage

nextcloud vulnerabilities

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the https://download.nextcloud.com|nextcloud package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free
VulnerabilityVulnerable Version
  • M
CVE-2019-15617

[,17.0.1)
  • M
Insufficiently Protected Credentials

[,20.0.0)
  • M
Privilege Escalation

[,20.0.6)
  • M
Improper Authentication

[,14.0.0)
  • M
Denial of Service (DoS)

[,9.0.55)
  • M
Server-side Request Forgery (SSRF)

[,15.0.9)[16.0.0,16.0.2)
  • M
Cross-site Scripting (XSS)

[,13.0.5)
  • M
Information Exposure

[,3.16.1)
  • M
Incorrect Authorization

[,15.0.13)[16.0.0,16.0.6)[17.0.0,17.0.1)
  • M
Server-side Request Forgery (SSRF)

[,15.0.14)[16.0.0,16.0.7)[17.0.0,17.0.2)
  • H
Security Features

[,12.0.3)
  • M
Insertion of Sensitive Information into Log File

[11.0.0,11.0.5)[12.0.0,12.0.3)
  • M
Denial of Service (DoS)

[,19.0.11)[20.0.0,20.0.10)[21.0.0,21.0.2)
  • M
Cross-site Scripting (XSS)

[,9.0.58)[10.0.0,10.0.5)[11.0.0,11.0.3)
  • M
Improper Authentication

[,3.9.1)
  • M
Out-of-bounds Write

[,2.6.5)
  • M
Insecure Permissions

[,11.0.7)
  • M
Denial of Service (DoS)

[,3.15.1)
  • M
Session Fixation

[13.0.0,13.0.11)[14.0.0,14.0.7)[15.0.0,15.0.3)
  • H
Improper Access Control

[,12.0.11)[13.0.0,13.0.6)
  • H
Insufficiently Protected Credentials

[,20.0.0)
  • M
Denial of Service (DoS)

[,18.0.11)[19.0.0,19.0.5)[20.0.0,20.0.2)
  • M
Insertion of Sensitive Information into Log File

[,20.0.12)[21.0.0,21.0.4)[22.0.0,22.1.0)
  • C
Information Exposure

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Cross-site Scripting (XSS)

[,2.25.0)
  • H
Denial of Service (DoS)

[,20.0.0)
  • M
CVE-2021-32741

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Arbitrary Code Injection

[,17.0.0)
  • H
Brute Force

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Improper Verification of Cryptographic Signature

[0,)
  • M
Cross-site Scripting (XSS)

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • L
CVE-2021-32655

[,19.0.11)[20.0.0,20.0.10)[21.0.0,21.0.2)
  • M
Memory Leak

[,2.6.5)
  • L
Session Fixation

[,11.0.3)
  • H
Insufficiently Protected Credentials

[,18.0.6)[19.0.0,19.0.1)
  • M
Information Exposure

[,3.16.0)
  • M
Information Exposure

[,14.0.13)[15.0.0,15.0.9)[16.0.0,16.0.2)
  • C
Authorization Bypass

[,19.0.11)[20.0.0,20.0.10)[21.0.0,21.0.2)
  • M
Remote Code Execution (RCE)

[,2.6.3)
  • L
Session Fixation

[,12.0.8)[13.0.0,13.0.3)
  • M
Cross-site Scripting (XSS)

[,11.0.3)
  • H
Information Exposure

[,13.0.9)[14.0.0,14.0.5)[14.0.6,15.0.0)
  • H
Insufficiently Protected Credentials

[,2.6.5)
  • M
Cryptographic Weakness

[,20.0.0)
  • H
Remote Code Execution (RCE)

[,2.6.5)
  • M
Cross-site Scripting (XSS)

[,3.6.1)
  • M
Improper Input Validation

[,9.0.55)
  • M
Improper Authentication

[,3.3.0)
  • M
Brute Force

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Information Exposure

[,9.0.55)
  • H
Improper Certificate Validation

[,3.16.1)
  • L
Information Exposure

[,3.16.1)
  • M
Missing Encryption of Sensitive Data

[,19.0.2)
  • M
Cross-site Scripting (XSS)

[,18.0.11)[19.0.0,19.0.5)[20.0.0,20.0.2)
  • M
Improper Authentication

[,14.0.0)
  • M
Information Exposure

[,20.0.12)[21.0.0,21.0.4)[22.0.0,22.1.0)
  • M
Cross-site Scripting (XSS)

[,3.7.0)
  • M
Improper Authorization

[,9.0.54)
  • M
Cross-site Scripting (XSS)

[,18.0.3)
  • M
Access Restriction Bypass

[,15.0.1)
  • H
Key Management Errors

[,12.0.8)
  • M
Brute Force

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Access Restriction Bypass

[,1.9.5)
  • M
Insecure Permissions

[,9.0.55)
  • M
Information Exposure

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Information Exposure

[,11.0.3)
  • H
Cross-site Scripting (XSS)

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Improper Input Validation

[,14.0.11)[15.0.0,15.0.8)
  • H
Unauthorized File Access

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Cross-site Scripting (XSS)

[,20.0.6)
  • M
Cross-site Scripting (XSS)

[,14.0.9)[15.0.0,15.0.6)
  • M
CVE-2019-15611

[,2.24.0)
  • L
CVE-2021-32680

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Cross-site Scripting (XSS)

[,9.0.58)[10.0.0,10.0.5)[11.0.0,11.0.3)
  • C
Unsafe Dependency Resolution

[,20.0.12)[21.0.0,21.0.4)[22.0.0,22.1.0)
  • M
Improper Input Validation

[,12.0.13)[13.0.0,13.0.8)[14.0.0,14.0.4)[14.0.5,15.0.0)
  • M
Privilege Escalation

[0,)
  • M
Improper Access Control

[,12.0.8)
  • C
SQL Injection

[0,)
  • M
Improper Preservation of Permissions

[,14.0.13)[15.0.0,15.0.9)[16.0.0,16.0.2)
  • L
Missing Encryption of Sensitive Data

[,17.0.7)[18.0.0,18.0.5)
  • M
Directory Traversal

[0,)
  • M
Information Exposure

[,3.4.2)
  • H
Authorization Bypass

[,17.0.5)[18.0.0,18.0.3)
  • L
Uninitialized Memory Exposure

[,19.0.11)[20.0.0,20.0.10)[21.0.0,21.0.2)
  • H
Improper Access Control

[,19.0.11)[20.0.0,20.0.10)[21.0.0,21.0.2)
  • M
Improper Authentication

[0,)
  • M
Improper Preservation of Permissions

[,12.0.13)[13.0.0,13.0.8)[14.0.0,14.0.4)
  • H
Untrusted Search Path

[3.0.3,3.3.0)
  • L
CVE-2019-5452

[,3.6.2)
  • C
Brute Force

[,19.0.11)[20.0.0,20.0.10)[21.0.0,21.0.2)
  • H
Arbitrary Code Injection

[,3.1.3)
  • M
Cross-site Scripting (XSS)

[,16.0.4)
  • M
Improper Authentication

[,19.0.2)
  • L
SQL Injection

[,3.6.1)
  • M
Insecure Default

[,19.0.13)[20.0.0,20.0.11)[21.0.0,21.0.3)
  • M
Improper Certificate Validation

[,3.3.0)
  • M
Improper Authentication

[,14.0.0)
  • M
Access Restriction Bypass

[16.0.0,16.0.9)[17.0.0,17.0.4)[18.0.0,18.0.1)
  • M
Insecure Permissions

[,9.0.55)
  • L
Information Exposure

[10.0.0,10.0.4)[11.0.0,11.0.2)
  • M
Improper Certificate Validation

[,3.1.3)
  • H
Missing Authentication

[,20.0.12)[21.0.0,21.0.4)[22.0.0,22.1.0)
  • M
Improper Input Validation

[,9.0.55)
  • M
Improper Access Control

[,9.0.52)
  • M
Improper Access Control

[,9.0.54)[10.0.0,10.0.1)
  • M
Cross-site Scripting (XSS)

[10.0.0,10.0.1)
  • M
Cross-site Scripting (XSS)

[10.0.0,10.0.1)
  • H
Improper Authentication

[,9.0.54)[10.0.0,10.0.1)
  • M
Improper Access Control

[,9.0.54)[10.0.0,10.0.2)
  • M
Cross-site Scripting (XSS)

[,9.0.52)
  • M
Cross-site Scripting (XSS)

[,9.0.52)
  • M
Improper Access Control

[,9.0.52)
  • M
Improper Access Control

[,9.0.52)