Lucene search

K

Discourse-calendar Security Vulnerabilities

cve
cve

CVE-2024-24817

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discussion platform Discourse. Prior to version 0.4, event invitees created in topics in private categories or PMs (private messages) can be retrieved by anyone, even if they're not...

4.3CVSS

4.5AI Score

0.0004EPSS

2024-02-22 06:15 PM
48
cve
cve

CVE-2024-26145

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a.....

6.5CVSS

6.5AI Score

0.0004EPSS

2024-02-21 06:15 PM
14
cve
cve

CVE-2023-43658

dicourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Improper escaping of event titles could lead to Cross-site Scripting (XSS) within the 'email preview' UI when a site has CSP disabled. Having CSP...

8CVSS

5.9AI Score

0.001EPSS

2023-10-16 10:15 PM
26
cve
cve

CVE-2022-41913

Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members of private groups or public groups with private members can be listed by users, who can create and edit post events. This vulnerability only....

5.4CVSS

5.3AI Score

0.001EPSS

2022-11-14 09:15 PM
22
8
cve
cve

CVE-2022-31059

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting (XSS) attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default...

6.5CVSS

5.2AI Score

0.001EPSS

2022-06-14 08:15 PM
40
4