DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Nextcloud: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-12-04
Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um falsche Informationen darzustellen.
01
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-66553US | — | — | ||
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables… | ||||
| CVE-2025-66551US | medium4.3 | — | ||
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column… | ||||
| CVE-2025-66549US | low2.7 | — | ||
Nextcloud Desktop is the desktop sync client for Nextcloud. Prior to 3.16.5, when trying to manually lock a file inside an end-to-end encrypted directory, the path of the file was… | ||||
| CVE-2025-66548US | medium5.5 | — | ||
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, fil… | ||||
| CVE-2025-66545US | medium4.3 | — | ||
Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with… | ||||
| CVE-2025-66515US | — | — | ||
The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set anoth… | ||||
| CVE-2025-66514US | medium5.4 | — | ||
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated u… | ||||
| CVE-2025-66513US | medium5.3 | — | ||
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which group… | ||||
| CVE-2025-66552US | medium4.3 | — | ||
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the… | ||||
| CVE-2025-66550US | — | — | ||
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.17 and 5.2.4, when a malicious user creates a calendar event with a crafted attachment that links to a download lin… | ||||
| CVE-2025-66547US | — | — | ||
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not ha… | ||||
| CVE-2025-66546US | — | — | ||
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 4.7.19, 5.5.6, and 6.0.1, the calendar app allowed blindly booking appointments with a squential ID without known the a… | ||||
| CVE-2025-66512US | medium6.1 | — | ||
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31.0.12 and 32.0.3, a missing sanitization allowed malicious users to ci… | ||||
| CVE-2025-66511US | medium6.5OT erhöht | — | ||
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker… | ||||
| CVE-2025-66510US | medium4.9 | — | ||
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3,… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
- NextCloud Security Advisory vom 2025-12-04external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan