3688 matches found
CVE-2023-49098
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939...
CVE-2023-49098 Reaction data for user notifications exposed in Discourse-reactions
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939...
CVE-2023-49098 Reaction data for user notifications exposed in Discourse-reactions
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939...
CVE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...
CVE-2023-48297
Discourse vulnerability CVE-2023-48297 affects the message serializer that expands chat mentions (@all/@here). The implementation can generate a very large array of users, enabling a denial of service as stated in the CVE description. The issue was patched in Discourse versions 3.1.4 and in the b...
CVE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...
CVE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...
PT-2024-13672 · Discourse · Discourse-Reactions
Name of the Vulnerable Software and Affected Versions: Discourse-reactions plugin affected versions not specified Description: The Discourse-reactions plugin allows users to add reactions to posts. However, it has an issue where data about a user's reaction notifications could be exposed...
Discourse Resource Management Error Vulnerability
Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A resource management error vulnerability exists in Discourse, which stems from an unimposed size limit on client-side editable fields, and can be exploited by an...
Discourse Access Control Vulnerability
Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a security vulnerability that can be exploited by an attacker to access a secure upload URL associated with a post...
Discourse Access Control Error Vulnerability
Discourse is an open source community discussion platform. The platform includes features such as communities, email, and chat rooms. An access control error vulnerability exists in versions prior to Discourse-reactions 2c26939, which stems from allowing users to add their eaction to a post, wher...
PT-2024-13578 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.4 Discourse version beta 3.2.0.beta5 and earlier Description: Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here, which can lead...
CVE-2023-49098: Improper Access Control
Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939...
CVE-2024-21655: Uncontrolled Resource Consumption
Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4...
CVE-2023-48297: Uncontrolled Resource Consumption
Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...
PT-2024-13673
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.1.4 Discourse versions prior to 3.2.0.beta4 Description Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users...
PT-2024-19002 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.4 Discourse versions prior to 3.2.0.beta4 Description: Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to...
CVE-2023-49099: Improper Access Control
Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accessed by guest users even when login is required. This vulnerability has been patched in 3.2.0.beta4 and 3.1.4...
Discourse < 3.1.3, 3.2.x < 3.2.0.beta3 Multiple Vulnerabilities
Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...
