Nextcloud: Self XSS when sending HTML as a comment in the Deck app

A vulnerability was found in the Deck app comments that allowed HTML injection. This could lead to malicious script execution when a user clicked a specially crafted link. The issue was reported to the Nextcloud security team...

PT-2021-22476

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.2.9 Nextcloud Deck versions prior to 1.4.5 Nextcloud Deck versions prior to 1.5.3 Description A missing permission check in Nextcloud Deck allows another authenticated user to access Deck cards of another use...

CVE-2021-39225: Authorization Bypass Through User-Controlled Key

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3...