CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...

CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...

CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...

CVE-2024-52589

Discourse CVE-2024-52589 involves an authorization issue where moderators can view the Screened emails list in the admin dashboard and learn users’ emails. Multiple sources flag this as a vulnerability in Discourse with the fix being applied in the latest versions; where upgrade is not possible, ...

CVE-2024-52794 Magnific lightbox susceptible to Cross-site Scripting in Discourse

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2024-52794

Technical details for CVE-2024-52794 are not publicly available in the provided documents. The materials mention a lightbox-related cross-site scripting in Discourse and a patch in the latest version. Monitor for official advisories for specifics.

CVE-2024-52794 Magnific lightbox susceptible to Cross-site Scripting in Discourse

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2024-52794 Magnific lightbox susceptible to Cross-site Scripting in Discourse

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2024-53991

Discourse backup file disclosure via default Nginx configuration (CVE-2024-53991) affects Discourse instances using FileStore::LocalStore for local uploads/backups. Attackers who know a backup filename can trick nginx into serving the backup file, exposing complete backups with sensitive data. Th...

CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

Discourse 跨站脚本漏洞

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

PT-2024-35446 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. The issue is resolved in the latest version of Discourse...

Discourse 信息泄露漏洞

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse has an authorization issue vulnerability that stems from improper privilege management of the Filter Email List feature in the...

Discourse 安全漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse that stems from enabling local login and could allow an attacker to bypass Discourse Connect to create...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from an information disclosure vulnerability that stems from the use of FileStore::LocalStore to store uploaded and backed up fil...

PT-2024-33675 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: The issue affects sites using Discourse Connect with local logins enabled, potentially allowing attackers to bypass Discourse Connect and create accounts or log in. This problem has...

MAL-2024-10242 Malicious code in buildkit-discourse-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 386870ecb90240b5c6c802a2a051da4b8eafa7a293f6c17ca1bfe46cbf8eb733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buildkit-discourse-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 386870ecb90240b5c6c802a2a051da4b8eafa7a293f6c17ca1bfe46cbf8eb733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...