Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | Deck (303a4a3f-0c5f-5b20-b12d-bb61da800050) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nextcloud/deck |
purl2cpe | 2026-06-01 10:17:59.339486 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66557 |
vulnerable | 2026-06-08 07:41:19.173439 |
Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners
MEDIUM (5.4)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.14.6 and 1.15.2, a bug in the permission logic allowed users with "Can share" permission to modify the permissions of other recipients. This vulnerability is fixed in 1.14.6 and 1.15.2.
Published: 2025-12-05T17:28:48.642Z
Updated: 2025-12-08T20:12:45.372Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66548 |
vulnerable | 2026-06-08 07:41:19.162275 |
Nextcloud Deck app allows to spoof file extensions by using RTLO characters
LOW (3.3)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Prior to 1.12.7, 1.14.4, and 1.15.1, file extension can be spoofed by using RTLO characters, tricking users into download files with a different extension than what is displayed. This vulnerability is fixed in 1.12.7, 1.14.4, and 1.15.1.
Published: 2025-12-05T17:26:11.306Z
Updated: 2025-12-08T20:12:07.012Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37883 |
vulnerable | 2026-06-08 06:39:48.178859 |
Nextcloud Deck can access comments and attachments of deleted cards
MEDIUM (4.3)
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.
Published: 2024-06-14T15:33:18.525Z
Updated: 2024-08-02T03:57:39.902Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22213 |
vulnerable | 2026-06-08 06:29:34.147711 |
Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app
NONE
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
Published: 2024-01-18T19:11:40.584Z
Updated: 2024-11-13T19:21:11.400Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22471 |
vulnerable | 2026-06-08 05:54:26.389816 |
Nextcloud Deck vulnerable to authorization bypass
LOW (3.5)
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
Published: 2023-01-14T00:34:06.722Z
Updated: 2025-03-10T21:23:18.841Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22470 |
vulnerable | 2026-06-08 05:54:26.389375 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22469 |
vulnerable | 2026-06-08 05:54:26.388845 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29159 |
vulnerable | 2026-06-08 05:42:47.025500 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24906 |
vulnerable | 2026-06-08 05:41:44.871366 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39225 |
vulnerable | 2026-06-08 05:33:49.225437 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37631 |
vulnerable | 2026-06-08 05:32:54.518272 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22913 |
vulnerable | 2026-06-08 05:30:01.854437 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8297 |
vulnerable | 2026-06-08 05:27:15.567981 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8179 |
vulnerable | 2026-06-08 05:27:15.107633 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-15619 |
vulnerable | 2026-06-08 05:12:57.698724 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.