CVE-2022-23641 Denial of Service in Discourse

Discourse is an open source discussion platform. In versions prior to 2.8.1 in the stable branch, 2.9.0.beta2 in the beta branch, and 2.9.0.beta2 in the tests-passed branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse, which stems from a problem with the software's parsing of URL streams. A denial-of-service attack can be triggered by a user...

PT-2022-16154 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.1 Discourse version 2.9.0.beta2 Description: The issue allows users to trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job triggers an infinite loop, which caus...

Discourse 2.8.0.beta3 Security Update

A new Discourse update includes three security fixes. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

CVE-2021-32764

Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is...

CVE-2021-32764 YouTube Onebox susceptible to XSS

Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is...

Discourse < 2.5.0.beta4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Cross-site Scripting (XSS)

onebox is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of various parameters, allowing XSS attacks to occur...

Discourse: Stored XSS in posts because of absence of oembed variables values escaping

Hello! Steps to reproduce: 1. Paste this payload URL in the post: http://89.223.28.48/oembedvideo.html?uncache 2. Save the post and you will see the XSS will fire. F151922 The vulnerability exists because of absence of oembed variables values escaping. There is the oembed link in the payload page...

Discourse: XSS vulnerability on Audio and Video parsers

Just like in the XSS vulnerability on Image parser, there is the same vulnerability on Audio https://github.com/discourse/onebox/blob/394409ca319cc1a1cd31fefa50c9468c990531a3/lib/onebox/engine/audioonebox.rb and Video...