Vulnerabilidades en nextcloud

297 resultados
Análisis Vexday

O ecossistema Nextcloud acumula 266 CVEs catalogadas, com volume de novas vulnerabilidades ainda ativo — 27 surgiram nos últimos 90 dias —, mas apresenta taxa de exploração ativa abaixo da média geral do catálogo, sem registros no CISA KEV. O tipo de falha predominante é CWE-284 (controle de acesso inadequado), o que indica fragilidades estruturais na gestão de permissões que tendem a ampliar a superfície de ataque em ambientes colaborativos. A CVE mais relevante no momento é CVE-2022-24838, com escore EPSS de 0,3155 — o mais alto observado no conjunto —, sinalizando probabilidade não negligenciável de exploração e merecendo atenção prioritária em qualquer plano de remediação. A existência de 2 CVEs com PoC pública, combinada a 4 falhas críticas, reforça a necessidade de monitoramento contínuo mesmo em um cenário onde a exploração confirmada ainda é ausente.

CVE-2023-25817LOWDelete permissions are not saved when creating public share in Nextcloud serverEPSS 0.6%CVE-2022-36075LOWFile list exposure in Nextcloud Files Access ControlEPSS 0.6%CVE-2023-22473LOWPasscode bypass on Talk-Android appEPSS 0.6%CVE-2023-48308LOWCalendar app returns full stacktrace when an error happens while editing appointmentEPSS 0.5%CVE-2023-39953MEDIUMIssuer not verified from obtained token in user_oidcEPSS 0.5%CVE-2023-28835LOWInsecure randomness for default password in nextcloudEPSS 0.5%CVE-2024-37882HIGHNextcloud Server can reshare read&share only folder with more permissionsEPSS 0.5%CVE-2024-52518MEDIUMNextcloud Server is missing password confirmation when changing external storage optionsEPSS 0.5%CVE-2025-58051MEDIUMNextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a tableEPSS 0.5%CVE-2023-33184LOWBlind SSRF in the Nextcloud Mail app on avatar endpointEPSS 0.5%CVE-2024-52513LOWNextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" sharesEPSS 0.5%CVE-2023-22471LOWNextcloud Deck vulnerable to authorization bypassEPSS 0.5%CVE-2021-39221MEDIUMXSS in ContactsEPSS 0.5%CVE-2024-22404MEDIUMPermissions bypass in Nextcloud with the files zip appEPSS 0.5%CVE-2024-22402MEDIUMImproper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlistEPSS 0.5%CVE-2024-52509LOWNextcloud Mail app does not respect download permissions in sharesEPSS 0.5%CVE-2023-25579MEDIUMDirectory traversal in Nextcloud serverEPSS 0.5%CVE-2024-22213NONECross-site Scripting when sending HTML as a comment in the Nextcloud Deck appEPSS 0.5%CVE-2024-52519LOWNextcloud Server's OAuth2 client secrets were stored in a recoverable wayEPSS 0.5%CVE-2022-39364MEDIUMException logging in Sharepoint app reveals clear-text connection detailsEPSS 0.5%