PT-2024-21299 · Discourse · Discourse Calendar

Name of the Vulnerable Software and Affected Versions: Discourse Calendar affected versions not specified Description: The issue allows uninvited users to gain access to private events by crafting a request to update their attendance. This is related to the dynamic calendar feature in the first...

CVE-2023-46241: Incorrect Authorization

discourse-microsoft-auth is a plugin that enables authentication via Microsoft. On sites with the discourse-microsoft-auth plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application's account type to any options other than...

Discourse < 3.1.5, 3.2.x < 3.2.0.beta5 XSS Vulnerability

Discourse is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Discourse < 3.1.4, 3.2.x < 3.2.0.beta4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Discourse Information Disclosure Vulnerability (CNVD-2024-09870)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. An information disclosure vulnerability exists in Discourse discourse-group-membership-ip-block, which originates from sending all group customization fields to the...

Discourse cross-site scripting vulnerability (CNVD-2024-09871)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a cross-site scripting vulnerability that originates from improperly cleaned user input, which can be exploited by an attacker to execute...

CVE-2024-24755

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom...

CVE-2024-24755 discourse-group-membership-ip-block is exposing potentially sensitive custom fields

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom...

CVE-2024-24755

The CVE-2024-24755 entry concerns the Discourse plugin discourse-group-membership-ip-block. The connected sources describe a information-disclosure vulnerability where the plugin sends all group custom fields to the client, including fields from other plugins that are expected to remain secret. A...

CVE-2024-24755

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom...

PT-2024-20533 · Discourse · Discourse-Group-Membership-Ip-Block

Name of the Vulnerable Software and Affected Versions: discourse-group-membership-ip-block affected versions not specified Description: The discourse-group-membership-ip-block plugin sends all group custom fields to the client, including fields from other plugins that may be expected to remain...

Discourse Information Leakage Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. An information disclosure vulnerability exists in Discourse discourse-group-membership-ip-block, which originates from sending all group customization fields to the...

CVE-2024-24755: Exposure of Sensitive Information to an Unauthorized Actor

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom...

BIT-DISCOURSE-2021-41082

Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users wer...

CVE-2024-23834

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...

Design/Logic Flaw

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...

CVE-2024-23834 Discourse improperly sanitized user input leads to XSS

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...

CVE-2024-23834 Discourse improperly sanitized user input leads to XSS

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...

CVE-2024-23834

Discourse (open-source discussion platform) has an XSS vulnerability when user input is not properly sanitized and Content Security Policy is disabled. The issue affects instances where CSP is not enabled and allows unsafe-inline; it is fixed in Discourse 3.1.5 and 3.2.0.beta5. To remediate, enab...

CVE-2024-23834 Discourse improperly sanitized user input leads to XSS

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...