| CVE-2020-8133 | 中5.3 | A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file. | 09/11/2020 |
| CVE-2020-8236 | 中6.8 | A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two factor verification by asking for the PIN of the passwordless WebAuthn but not verifying it. | 02/11/2020 |
| CVE-2020-8183 | 高7.5 | A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call. | 02/11/2020 |
| CVE-2020-8173 | 低2.2 | A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended. | 02/11/2020 |
| CVE-2020-8235 | 中4.3 | Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments. | 05/10/2020 |
| CVE-2020-8228 | 中5.3 | A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. | 05/10/2020 |
| CVE-2020-8223 | 中6.5 | A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves. | 05/10/2020 |
| CVE-2020-8182 | 高8.0 | Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves. | 05/10/2020 |
| CVE-2020-8225 | 高7.5 | A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials. | 18/09/2020 |
| CVE-2020-8227 | 中6.8 | Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory. | 21/08/2020 |
| CVE-2020-8189 | 中5.4 | A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt. | 21/08/2020 |
| CVE-2020-8230 | 中5.5 | A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in for windows allowed to corrupt memory. | 17/08/2020 |
| CVE-2020-8229 | 中5.5 | A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system. | 10/08/2020 |
| CVE-2020-8224 | 高7.8 | A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory. | 10/08/2020 |
| CVE-2020-8202 | 中5.3 | Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password. | 30/07/2020 |
| CVE-2020-8181 | 中4.3 | A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars. | 10/07/2020 |
| CVE-2020-8179 | 中4.1 | Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. | 02/07/2020 |
| CVE-2020-8180 | 緊急9.9 | A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator. | 08/06/2020 |
| CVE-2020-8156 | 高7.0 | A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. | 12/05/2020 |
| CVE-2020-8155 | 中5.4 | An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF. | 12/05/2020 |