CVE-2023-37906 Discourse vulnerable to DoS via post edit reason

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of th...

CVE-2023-37906 Discourse vulnerable to DoS via post edit reason

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of th...

CVE-2023-37906

CVE-2023-37906 affects the Discourse open source platform. Prior to version 3.0.6 (stable) and 3.1.0.beta7 (beta/tests-passed) , a malicious user could edit a post in a topic with a crafted edit reason to trigger a DoS. The vulnerability is patched in 3.0.6 (stable) and 3.1.0.beta7 (beta/tests-pa...

CVE-2023-37906 Discourse vulnerable to DoS via post edit reason

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason. The issue is patched in version 3.0.6 of th...

CVE-2023-37904 Discourse Race Condition in Accept Invite

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version...

CVE-2023-37904

Discourse vulnerability CVE-2023-37904 describes a race condition in the invite-accept flow of the Discourse platform. Affected versions are prior to 3.0.6 (stable) and 3.1.0.beta7 (beta/tests-passed); these could allow more users than permitted to be created via invite links. The issue is patche...

CVE-2023-37904 Discourse Race Condition in Accept Invite

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version...

CVE-2023-37904 Discourse Race Condition in Accept Invite

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version...

CVE-2023-37467 Discourse CSP nonce reuse vulnerability for anonymous users

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP Content Security Policy nonce reuse vulnerability was discovered could allow cross-site scripting XSS attacks to bypass CSP protection for anonymous i.e. unauthenticated user...

CVE-2023-37467

Summary (CVE-2023-37467): Discourse prior to version 3.1.0.beta7 (beta/tests-passed branches) contains a CSP nonce reuse vulnerability that could allow cross-site scripting to bypass CSP protections for anonymous users. There are no known XSS vectors reported yet, and the vulnerability does not a...

CVE-2023-37467 Discourse CSP nonce reuse vulnerability for anonymous users

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP Content Security Policy nonce reuse vulnerability was discovered could allow cross-site scripting XSS attacks to bypass CSP protection for anonymous i.e. unauthenticated user...

CVE-2023-37467 Discourse CSP nonce reuse vulnerability for anonymous users

Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the beta and tests-passed branches, a CSP Content Security Policy nonce reuse vulnerability was discovered could allow cross-site scripting XSS attacks to bypass CSP protection for anonymous i.e. unauthenticated user...

Discourse Information Leakage Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. An information disclosure vulnerability exists in Discourse, which stems from the fact that information about restricted visibility topic tags could be accessed by an...

Discourse security vulnerabilities

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. Discourse suffers from a security vulnerability that stems from the ability of a malicious user to edit posts in a thread and trigger a DoS with a carefully crafted...

Discourse competition conditions vulnerabilities

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a competitive conditions issue vulnerability that arises from the ability to create more users than allowed via an invitation link...

Discourse security vulnerabilities

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse that stems from the fact that in multiple controller operations, Discourse accepts limiting parameters but does not impose any...

CVE-2023-38684: Allocation of Resources Without Limits or Throttling

Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, in multiple controller actions, Discourse accepts limit params but does not impose any upper bound on the values being accepted. Without an...

PT-2023-26175

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.0.6 of the stable branch Discourse versions prior to 3.1.0.beta7 of the beta and tests-passed branches Description Discourse is an open source discussion platform. A malicious user can edit a post in a topic and...

Discourse security vulnerabilities

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse that originates from a malicious user being able to prevent a delayed queue from proceeding quickly on sites hosted in the same...

PT-2023-25979 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta7 Description: A Content Security Policy CSP nonce reuse issue was discovered that could allow cross-site scripting XSS attacks to bypass CSP protection for anonymous users. Although there are no known XS...