CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a...

CVE-2024-26145

CVE-2024-26145 relates to the Discourse Calendar feature. The vulnerability allows uninvited users to gain access to private events by crafting a request to update their attendance within the dynamic calendar in the first post of a topic. The underlying issue is resolved by the commit dfc4fa15f34...

CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a...

CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a...

CVE-2023-46241

The CVE-2023-46241 entry concerns the discourse-microsoft-auth plugin for Discourse, which allows Microsoft-based authentication and can enable account takeovers when sites are configured to non-single-tenant accounts. The issue is linked to authentication handling within the plugin and has been ...

CVE-2023-46241 Potential account take over due to unverified emails from Microsoft Identity Platform

discourse-microsoft-auth is a plugin that enables authentication via Microsoft. On sites with the discourse-microsoft-auth plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application's account type to any options other than...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as community, email, and chat rooms. A security vulnerability exists in Discourse Calendar version 2201b254 and later versions. An attacker exploiting the vulnerability could access private events...

Discourse Code Issue Vulnerability

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A security vulnerability exists in Discourse discourse-ai that stems from vulnerability to server-side request forgery SSRF attacks...

PT-2024-21299 · Discourse · Discourse Calendar

Name of the Vulnerable Software and Affected Versions: Discourse Calendar affected versions not specified Description: The issue allows uninvited users to gain access to private events by crafting a request to update their attendance. This is related to the dynamic calendar feature in the first...

PT-2024-20003 · Discourse · Discourse Ai

Name of the Vulnerable Software and Affected Versions: discourse-ai versions prior to commit 94ba0dadc2cf38e8f81c3936974c167219878edd Description: The discourse-ai plugin for the open-source discussion platform Discourse is affected by an issue where interactions with different AI services are...

PT-2024-13342 · Discourse · Discourse-Microsoft-Auth

Name of the Vulnerable Software and Affected Versions: discourse-microsoft-auth plugin affected versions not specified Description: The discourse-microsoft-auth plugin enables authentication via Microsoft. On sites with this plugin enabled, an attack can potentially take control of a victim's...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse discourse-microsoft-auth 9543d188 and prior versions, which can be exploited by an attack to compromise a victim's Discourse...

Discourse < 3.1.5, 3.2.x < 3.2.0.beta5 XSS Vulnerability

Discourse is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Discourse < 3.1.4, 3.2.x < 3.2.0.beta4 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Discourse Information Disclosure Vulnerability (CNVD-2024-09870)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. An information disclosure vulnerability exists in Discourse discourse-group-membership-ip-block, which originates from sending all group customization fields to the...

Discourse cross-site scripting vulnerability (CNVD-2024-09871)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. Discourse suffers from a cross-site scripting vulnerability that originates from improperly cleaned user input, which can be exploited by an attacker to execute...

CVE-2024-24755

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom...

CVE-2024-24755 discourse-group-membership-ip-block is exposing potentially sensitive custom fields

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom...

CVE-2024-24755

The CVE-2024-24755 entry concerns the Discourse plugin discourse-group-membership-ip-block. The connected sources describe a information-disclosure vulnerability where the plugin sends all group custom fields to the client, including fields from other plugins that are expected to remain secret. A...

PT-2024-20533 · Discourse · Discourse-Group-Membership-Ip-Block

Name of the Vulnerable Software and Affected Versions: discourse-group-membership-ip-block affected versions not specified Description: The discourse-group-membership-ip-block plugin sends all group custom fields to the client, including fields from other plugins that may be expected to remain...