Discourse < 3.0.5 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Discourse Resource Management Error Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A resource management error vulnerability exists in Discourse version 3.1.0beta5, which stems from the fact that creating or updating a request can result in a denial of servi...

Discourse authorization issue vulnerabilities

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. Discourse suffers from an authorization issue vulnerability that stems from allowing attackers to bypass topic title validation. Affected products and versions:...

PT-2023-25709 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the version containing commit 52b003d915 Description: Discourse is an open source discussion platform. A request to create or update a custom sidebar section can cause a denial of service. Recommendations: For...

CVE-2023-36473

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

Design/Logic Flaw

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

CVE-2023-36473 CSP nonce reuse vulnerability in Discourse

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

CVE-2023-36473 CSP nonce reuse vulnerability in Discourse

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

CVE-2023-36473

Discourse (open-source discussion platform) has a CSP nonce reuse vulnerability (CVE-2023-36473) that could allow XSS by bypassing Content Security Policy if nonce reuse occurs. The issue is described as unexploited currently, with remediation present: the vulnerability is patched in the latest t...

CVE-2023-36473 CSP nonce reuse vulnerability in Discourse

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

CVE-2023-36473: Improper Neutralization of Input During Web Page Generation

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

PT-2023-3566 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: The issue is related to insufficient input validation when processing topic titles, allowing a remote attacker to impact the integrity and availability ...

Discourse < 3.0.4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

Discourse 3.1.x < 3.1.0.beta5 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

CVE-2023-32301

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the stable branch and...

CVE-2023-32061

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerability and hide subsequent comments from other...

CVE-2023-34250

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created but not the actual content thereof in...

CVE-2023-31142

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of t...

Design/Logic Flaw

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created but not the actual content thereof in...

Design/Logic Flaw

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the stable branch and...