Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

17 records

Vendor: nextcloud Component: Deck Clear all filters
TI-2023-08720 CVE-2023-22471

Nextcloud Deck vulnerable to authorization bypass

Priority LOW 21

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00548 Published 2023-01-14 Fixed in 1.6.5, 1.7.3 +1 CWE-639
TI-2023-08719 CVE-2023-22470

Nextcloud Deck vulnerable to uncontrolled resource consumption

Priority LOW 30

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00694 Published 2023-01-14 Fixed in 1.6.5, 1.7.3 +1 CWE-400
TI-2021-16610 CVE-2021-39225

Missing permission check on Deck API

Priority LOW 38

Nextcloud is an open-source, self-hosted productivity platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01336 Published 2021-10-25 Fixed in 1.2.9, 1.4.5 +1 CWE-639
TI-2021-15506 CVE-2021-37631

Circle can be accessed by non-Circle members in Nextcloud Deck

Priority LOW 31

Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01277 Published 2021-09-07 Fixed in 1.2.9, 1.4.4 +1 CWE-639
TI-2021-05774 CVE-2021-22913

Information disclosure in Nextcloud Deck

Priority LOW 32

Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless a global search has…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01368 Published 2021-06-11 No fix listed CWE-200
TI-2020-06714 CVE-2020-8297 · GHSA-hx5m-93g9-j2jh

Authorization bypass in Nextcloud Deck

Priority LOW 23

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01339 Published 2021-02-23 No fix listed CWE-639
TI-2020-06600 CVE-2020-8182 · GHSA-9fvc-qpfc-hjxh

Improper access control in Nextcloud Deck

Priority LOW 37

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01035 Published 2020-10-05 No fix listed CWE-284
TI-2020-06653 CVE-2020-8235 · GHSA-crm5-43pc-vrcg

Authorization bypass in Nextcloud Deck app

Priority LOW 21

Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00781 Published 2020-10-05 No fix listed CWE-639
TI-2019-11718 CVE-2019-15619 · GHSA-mvc5-w9jr-jvqm

Cross-site scripting in Nextcloud Server

Priority LOW 24

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0084 Published 2020-02-04 No fix listed CWE-79