CVE-2021-37693 Re-use of email tokens in Discourse

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email...

An expert discussion on XDR

Discover why industry veteran and former Gartner analyst, Greg Young, believes that XDR is the most exciting thing that has happened in cybersecurity in the last 20 years...

CVE-2021-32788

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal...

Design/Logic Flaw

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal...

CVE-2021-32788

Discourse prior to version 2.7.7 contains two security bugs where the post creator of a whisper post can be revealed to non-staff users. 1) A staff member who creates a whisper post in a personal message could be exposed to non-staff participants even though the post is hidden from them. 2) If a ...

Friday Squid Blogging: The Evolution of Squid

Good video about the evolutionary history of squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

An Expert Discussion on Zero Trust

Zero Trust is the key strategy moving forward to secure the always changing hybrid workplace. Listen in as two of our industry experts discuss how risk insights are key component of Zero Trust security...

Moderate: mailman:2.1 security update

Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: arbitrary content injection via the options login page CVE-2020-12108 mailman: arbitrary content injection via the private archive login page CVE-2020-15011 For more details about the security issues,...

RLSA-2021:1751 Moderate: mailman:2.1 security update

Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: arbitrary content injection via the options login page CVE-2020-12108 mailman: arbitrary content injection via the private archive login page CVE-2020-15011 For more details about the security issues,...

CVE-2020-28141

The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page...

Design/Logic Flaw

The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page...

CVE-2020-28141

CVE-2020-28141 affects Online Discussion Forum 1.0. The vulnerability is a reflected/stored XSS in the message body: an authenticated attacker can send messages containing JavaScript to other users, which executes when those users view the messages page. Sources in the connected documents confirm...

CVE-2020-28141

The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page...

PT-2021-11448

Name of the Vulnerable Software and Affected Versions: Online Discussion Forum version 1.0 Description: The messaging subsystem is susceptible to a cross-site scripting XSS issue in the message body, allowing an authenticated user to send messages containing javascript code that executes when the...

Online Discussion Forum 跨站脚本漏洞

Sourcecodester Online Discussion Forum Site is an application of Sourcecodester. An online discussion forum. A security vulnerability exists in Online Discussion Forum 1.0, which can be exploited by an attacker to send a message to any user on the system...

CVE-2020-28141: Improper Neutralization of Input During Web Page Generation

The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page...

Threat Source newsletter (March 11, 2021) — Featuring new SolarWinds roundtable

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. We have a special edition of the Threat Source newsletter to bring you this week, because we’re premiering a new video for you right now! Below, you’ll find a full roundtable we put together discussing the SolarWinds supply chain...

ExpressionEngine: Stored XSS filter bypass on discussion forum. "URL" tag.

A vulnerability was identified and fixed that could have allowed attackers to bypass the XSS filter in the discussion forum, enabling arbitrary JavaScript execution in the victim's browser...

ExpressionEngine: Stored XSS filter bypass on discussion forum.

A vulnerability was identified and fixed that could have allowed attackers to bypass the XSS filter in the discussion forum, enabling arbitrary JavaScript execution in the victim's browser...

The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect its web page structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code in the user’s browser by creating a...