The Nextcloud Desktop Client
application does not properly neutralize the name of a group conversation before using it.
Nextcloud Server
applicationNextcloud Desktop Client
application on a machine that is running the Windows 10
operating systemNextcloud Talk
applicationNextcloud Talk
application<img src="https://avatars.githubusercontent.com/u/99037623">
HyperText Markup Language
Please do note that group conversation messages are also treated as HyperText Markup Language
.
{F1953705}
{F1953706}
{F1953851}
An attacker can inject arbitrary HyperText Markup Language
in to the Nextcloud Desktop Client
application.