CVE-2020-8173

A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.

• CWE-310
• CWE-311

• https://hackerone.com/reports/852841Exploit, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-023Broken Link, Vendor Advisory
• https://hackerone.com/reports/852841Exploit, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-023Broken Link, Vendor Advisory

Published

Nov 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8167A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs modu…6.5
• CVE-2020-8168We have recently released new version of AirMax AirOS firmwa…8.8
• CVE-2020-8169curl 7.62.0 through 7.70.0 is vulnerable to an information d…7.5
• CVE-2020-8170We have recently released new version of AirMax AirOS firmwa…6.1
• CVE-2020-8171We have recently released new version of AirMax AirOS firmwa…9.8
• CVE-2020-8172TLS session reuse can lead to host certificate verification …7.4
• CVE-2020-8174napi_get_value_string_*() allows various kinds of memory cor…8.1
• CVE-2020-8175Uncontrolled resource consumption in `jpeg-js` before 0.4.0 …5.5
• CVE-2020-8176A cross-site scripting vulnerability exists in koa-shopify-a…6.1
• CVE-2020-8177curl 7.20.0 through 7.70.0 is vulnerable to improper restric…7.8
• CVE-2020-8178Insufficient input validation in npm package `jison` <= 0.4.…9.8
• CVE-2020-8179Improper access control in Nextcloud Deck 1.0.0 allowed an a…4.1