CVE-2024-31219

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

CVE-2024-31219 Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

CVE-2024-31219 Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

CVE-2024-31219

CVE-2024-31219 affects the Discourse-reactions plugin. When whispers are enabled via whispers_allowed_groups and users react on whispers in public topics, the contents of the whisper and the reaction data are exposed on the /u/:username/activity/reactions endpoint. The vulnerability is described ...

CVE-2024-31219

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via "whispersallowedgroups" and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the...

CVE-2024-31219 Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

Malicious code in discourse-markdown-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d15650dd9d3ef6040ce65c2e6b3207c96240af179ecbc7061ed5064205df4673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1257 Malicious code in discourse-markdown-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d15650dd9d3ef6040ce65c2e6b3207c96240af179ecbc7061ed5064205df4673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discourse-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2024bbd933a9c01975b023ff2dd84531dde77e3956d38d5b582374451fa995d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in discourse-i18n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in discourse-markdown-it

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-1256 Malicious code in discourse-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2024bbd933a9c01975b023ff2dd84531dde77e3956d38d5b582374451fa995d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-23860 · Discourse · Discourse-Reactions

Name of the Vulnerable Software and Affected Versions: Discourse-reactions plugin affected versions not specified Description: The issue concerns the Discourse-reactions plugin, which allows users to add reactions to posts. When whispers are enabled on a site via the whispers allowed groups...

Discourse security vulnerabilities

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. An information disclosure vulnerability exists in Discourse-reactions, which stems from the application's inadequate protection of sensitive information and can be...

CVE-2024-31219: Exposure of Sensitive Information to an Unauthorized Actor

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispersallowedgroups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reaction...

BIT-DISCOURSE-2024-24748 Disclosure of the existence of secret subcategories in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are...

BIT-DISCOURSE-2024-24827 No rate limits on POST /uploads endpoint in Discourse

Discourse is an open source platform for community discussion. Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process. Do note that the impact varies from site to...

BIT-DISCOURSE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

BIT-DISCOURSE-2024-27100 Denial of service via Staff Actions in Discourse

Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could...

BIT-DISCOURSE-2024-28242 Disclosure of the existence of secret categories with custom backgrounds in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable ...