Discourse Cross-Site Scripting Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from incorrectly escaping user input, which could lead to cross-site scripting attacks...

PT-2023-29429 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.1 stable and 3.2.0.beta2 Description: Discourse is an open source platform for community discussion. The issue allows new chat messages to be read by making an unauthenticated POST request to MessageBus. There...

Discourse Cross-Site Scripting Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as community, email, and chat rooms. A cross-site scripting vulnerability exists in dicourse-calendar, which stems from improper escaping of event titles and could lead to cross-site scripting XSS...

The vulnerability of the application programming interface of the Discourse-jira plugin for the Discourse mailing list management software allows a attacker to execute an SSRF attack.

The vulnerability of the application programming interface of the Discourse-jira plugin for the Discourse mailing list management software is related to the implementation of an incorrect control flow. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

CVE-2023-44384

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discoursejiraverboselog site setting. A moderator user cou...

Server side request forgery (ssrf)

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discoursejiraverboselog site setting. A moderator user cou...

CVE-2023-44384 Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discoursejiraverboselog site setting. A moderator user cou...

CVE-2023-44384 Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discoursejiraverboselog site setting. A moderator user cou...

CVE-2023-44384 Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the discoursejiraverboselog site setting. A moderator user cou...

CVE-2023-44384

The CVE-2023-44384 entry concerns the Discourse-jira plugin for Discourse. According to connected sources (Red Hat advisory, NVD/NVD-derived summaries, and other feeds), exploitation stems from an SSRF via the Jira URL when the discourse_jira_verbose_log site setting is enabled. An administrator ...

Discourse Code Issue Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A security vulnerability exists in Discourse Discourse-jira, which originated from a vulnerability that allows an attacker to conduct a server request forgery SSRF attack by...

CVE-2023-43657

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

Cross site scripting

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

CVE-2023-43657 Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

CVE-2023-43657

Summary: CVE-2023-43657 affects the discourse-encrypt plugin for Discourse. The issue is an improper escaping of encrypted topic titles that can lead to cross-site scripting (XSS) when CSP headers are disabled (a non-default configuration). The problem is addressed by commit 9c75810af9, included ...

CVE-2023-43657 Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

CVE-2023-43657 Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

PT-2023-28903 · Discourse · Discourse-Encrypt

Name of the Vulnerable Software and Affected Versions: discourse-encrypt plugin affected versions not specified Description: The discourse-encrypt plugin provides a secure communication channel through Discourse. However, improper escaping of encrypted topic titles could lead to a cross-site...

Discourse Cross-Site Scripting Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A cross-site scripting vulnerability exists in Discourse discourse-crypt, which stems from a cross-site scripting XSS vulnerability that can be caused when a site disables the...

Discourse < 3.1.1 Multiple DoS Vulnerabilities

Discourse is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...