Is Nextcloud Server 24.0.1 affected?

Vulnerabilities affecting 24.0.1

• 9.0
  CVE-2023-26482 Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administr… fixed in 24.0.10
• 8.1
  CVE-2023-32319 Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth header allowed to brute-force user credentials when the p… fixed in 24.0.11
• 6.5
  CVE-2023-30539 Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are syste… fixed in 24.0.11
• 6.5
  CVE-2022-31118 Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access t… fixed in 24.0.2
• 6.4
  CVE-2022-36074 Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade.… fixed in 24.0.3
• 6.0
  CVE-2023-25579 Nextcloud server is a self hosted home cloud product. In affected versions the `OC\Files\Node\Folder::getFullPath()` function was validating and normalizing the string in the wrong order. The funct… fixed in 24.0.8
• 5.5
  CVE-2023-28643 Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will r… fixed in 24.0.9
• 5.3
  CVE-2023-25818 Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations… fixed in 24.0.10
• 5.3
  CVE-2023-25162 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to 24.0.8 and 23.0.12 and Nextcloud Enterprise server prior to 24.0.8 and 23.… fixed in 24.0.8
• 4.8
  CVE-2022-39330 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versi… fixed in 24.0.6
• 4.2
  CVE-2023-25820 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud… fixed in 24.0.10
• 4.0
  CVE-2022-39364 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to ver… fixed in 24.0.5
• 3.7
  CVE-2023-25161 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missin… fixed in 24.0.8
• 3.5
  CVE-2024-37315 Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is re…
• 3.5
  CVE-2023-28834 Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.… fixed in 24.0.10
• 3.5
  CVE-2023-28835 Nextcloud server is an open source home cloud implementation. In affected versions the generated fallback password when creating a share was using a weak complexity random number generator, so when… fixed in 24.0.10
• 3.5
  CVE-2023-25817 Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deleta… fixed in 24.0.9
• 3.5
  CVE-2022-41968 Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can se… fixed in 24.0.5
• 3.5
  CVE-2022-39346 Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing… fixed in 24.0.3
• 3.5
  CVE-2022-39329 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable… fixed in 24.0.5
• 3.1
  CVE-2023-28847 Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server 24.0.0 prior to 24.0.11 and 25.0.0 prior to 25.0.5; as well as Nextcloud Server… fixed in 24.0.11
• 3.0
  CVE-2024-22403 Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any t… fixed in 28.0.0
• 3.0
  CVE-2022-39211 Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nex… fixed in 24.0.4
• 2.6
  CVE-2022-41970 Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and p… fixed in 24.0.7
• 2.4
  CVE-2023-28833 Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted an… fixed in 24.0.10
• 2.4
  CVE-2022-41969 Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator… fixed in 24.0.7

Newer releases