Discourse 3.1.x < 3.1.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse. An attacker logged in as an administrator could make multiple requests for backups, which would exhaust all connection...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A code issue vulnerability exists in Discourse. An attacker exploits this vulnerability to bypass server-side request forgery SSRF protection using IPv4-mapped IPv6...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A cross-site scripting vulnerability exists in Discourse. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...

PT-2023-20443 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 3.1.0.beta2 through 3.1.0.beta3 Description: Discourse is an open-source discussion platform. Editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. Recommendations...

PT-2023-19082 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 of the stable branch Discourse versions prior to 3.1.0.beta2 of the beta and tests-passed branches Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a code issue vulnerability that stems from the lack of cross-site request forgery protection...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from an information disclosure vulnerability that stems from the fact that the number of topics displayed by tabs counts only the unread regular topic limit...

CVE-2023-23935

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

Design/Logic Flaw

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

CVE-2023-23935 Presence of restricted personal Discourse messages may be leaked if tagged with a tag

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

CVE-2023-23935 Presence of restricted personal Discourse messages may be leaked if tagged with a tag

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

CVE-2023-23935

Discourse (open-source messaging platform) contains a tag-count leakage vulnerability. In versions up to 3.0.1 on stable and up to 3.1.0.beta2 on beta/tests-passed, the count displayed for a tag sums all personal messages regardless of user visibility. This allows users to infer whether a sensiti...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, e-mail and chat rooms. Discourse suffers from an information disclosure vulnerability that stems from the fact that any user can technically poll sensitive tags to determine if a new...

The vulnerability of the Discourse mailing list management software, related to the use of the regular expression c, which has inefficient computational complexity, allows a hacker to trigger a service failure.

The vulnerability of the Discourse mailing list management software is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a remote attacker to cause service failures...

CVE-2023-25169

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...

CVE-2023-25169

CVE-2023-25169 affects the Discourse Yearly Review plugin. In affected versions, a user appearing in a yearly review topic that is later anonymised may still have data linked to the original account. The issue has been patched in commit b3ab33bbf7 and is included in the latest plugin version. Mit...

CVE-2023-25169 Yearly Review Plugin leaking anonymised users data in discourse-yearly-review

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...

CVE-2023-25169 Yearly Review Plugin leaking anonymised users data in discourse-yearly-review

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...

CVE-2023-25169 Yearly Review Plugin leaking anonymised users data in discourse-yearly-review

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...