CVE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

CVE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

Discourse 安全漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse that stems from allowing users to view topics with hidden labels with knowledge of the...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability. An attacker exploiting this vulnerability could execute arbitrary JavaScript on a user...

PT-2024-32809

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version Description An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with Content Security...

Discourse 资源管理错误漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email, and chat rooms. Discourse suffers from a Resource Management Error vulnerability that stems from the fact that an attacker can create a post with many...

Discourse 授权问题漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from an authorization issue vulnerability that stems from the presence of maliciously crafted email addresses that allow an...

PT-2024-30658

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version Description Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the...

PT-2024-31550

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed version Description Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue...

CVE-2024-47772: Improper Neutralization of Input During Web Page Generation

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of...

CVE-2024-45297: Improper Privilege Management

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

CVE-2024-45051: Improper Authentication

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

CVE-2024-43789: Uncontrolled Resource Consumption

Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them all at once. This can potentially reduce the availability of a Discourse instance. This problem has been patched in the latest version of Discourse. All users...

CVE-2024-45303

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

CVE-2024-45303

CVE-2024-45303 concerns the Discourse Calendar plugin, which allows dynamic calendars in topic first posts. The root issue is that rendering of event names can be exploited for cross-site scripting (XSS) when a site has modified or disabled Discourse’s default Content Security Policy. The vulnera...

CVE-2024-45303

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

Discourse Calendar 跨站脚本漏洞

Discourse Calendar is an open source calendar plugin for Discourse. A cross-site scripting vulnerability exists in versions of Discourse Calendar prior to 0.5, which stems from a problem with the dynamic calendar functionality that may be vulnerable to XSS attacks when rendering event names. This...