CVE-2023-47119 HTML injection in oneboxed links

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some links can inject arbitrary HTML tags when rendered through our Onebox engine. The issue is patched in version 3.1.3 of the...

CVE-2023-46130

CVE-2023-46130 affects Discourse prior to 3.1.3 (stable) and 3.2.0.beta3 (beta/tests-passed) where certain theme components (svgbob and mermaid) allow SVGs with unlimited height attributes, potentially impacting the availability of subsequent replies in a topic. The issue is patched in Discourse ...

CVE-2023-46130 Bypassing height value allowed in some theme components

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

CVE-2023-46130 Bypassing height value allowed in some theme components

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

CVE-2023-46130 Bypassing height value allowed in some theme components

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

CVE-2023-45816 Unread bookmark reminder notifications that the user cannot access can be seen

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkabl...

CVE-2023-45816 Unread bookmark reminder notifications that the user cannot access can be seen

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkabl...

CVE-2023-45816

Discourse prior to version 3.1.3 (stable) and 3.2.0.beta3 (beta/tests-passed) contains a logic edge case where a bookmark reminder is sent and an unread notification is generated even when the user cannot access the underlying bookmarkable resource (post, topic, chat message). The issue is resolv...

CVE-2023-45816 Unread bookmark reminder notifications that the user cannot access can be seen

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkabl...

CVE-2023-45806 Discourse vulnerable to DoS via Regexp Injection in Full Name

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, if a user has been quoted and uses a | in their full name, they might be able to trigger a bug that generates a lot of duplicat...

CVE-2023-45806

Discourse is affected by CVE-2023-45806. Before versions 3.1.3 (stable) and 3.2.0.beta3 (beta/tests-passed), if a quoted user has a full name containing a ‘|’, updating the name can trigger a bug that generates a large amount of duplicate content across posts that mention the user. The issue is f...

CVE-2023-45806 Discourse vulnerable to DoS via Regexp Injection in Full Name

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, if a user has been quoted and uses a | in their full name, they might be able to trigger a bug that generates a lot of duplicat...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse versions 3.1.0 through 3.1.2, which originates from potentially exhausting Redis memory by creating a website with an unusually...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from a special case that prevents users from accessing the underlying resources...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from the fact that if a user's full name uses "|" and the user is quoted, updating the user's...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from a theme component that allows users to add svg images with an unlimited "height"...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from the fact that certain links can be injected with arbitrary HTML tags when rendered by the...

PT-2023-30322 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.3 Discourse version 3.2.0.beta3 and earlier of the beta and tests-passed branches Description: Discourse is an open source platform for community discussion. The issue allows some links to inject arbitrary HTML...

PT-2023-29863 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.3 Discourse versions prior to 3.2.0.beta3 Description: Discourse is an open source platform for community discussion. The issue affects the availability of subsequent replies in a topic when users can add svgs...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse prior to version 3.1.3, which stems from the fact that the embedding functionality is susceptible to server-side request forgery...