CVE-2023-23622 Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users

Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or...

PT-2023-21570 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta3 Description: The issue allows attackers to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using an IPv4-mapped IPv6 address. Recommendations: For versions...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a code issue vulnerability that stems from the lack of cross-site request forgery protection...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A cross-site scripting vulnerability exists in Discourse. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...

PT-2023-21571 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta3 Description: Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user-provided URLs were being passed to FastImage without SSRF...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse. An attacker logged in as an administrator could make multiple requests for backups, which would exhaust all connection...

PT-2023-19082 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 of the stable branch Discourse versions prior to 3.1.0.beta2 of the beta and tests-passed branches Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and...

PT-2023-20443 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 3.1.0.beta2 through 3.1.0.beta3 Description: Discourse is an open-source discussion platform. Editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. Recommendations...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A code issue vulnerability exists in Discourse. An attacker exploits this vulnerability to bypass server-side request forgery SSRF protection using IPv4-mapped IPv6...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A cross-site scripting vulnerability exists in Discourse. An attacker could exploit this vulnerability to conduct cross-site scripting attacks...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from an information disclosure vulnerability that stems from the fact that the number of topics displayed by tabs counts only the unread regular topic limit...

PT-2023-21565 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.2 of the stable branch Discourse versions prior to 3.1.0.beta3 of the beta and tests-passed branches Description: The issue allows an administrator to request backups multiple times, consuming all database...

Discourse 3.1.x < 3.1.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescriptio...

CVE-2023-23935

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

Design/Logic Flaw

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

CVE-2023-23935 Presence of restricted personal Discourse messages may be leaked if tagged with a tag

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

CVE-2023-23935

Discourse (open-source messaging platform) contains a tag-count leakage vulnerability. In versions up to 3.0.1 on stable and up to 3.1.0.beta2 on beta/tests-passed, the count displayed for a tag sums all personal messages regardless of user visibility. This allows users to infer whether a sensiti...

CVE-2023-23935 Presence of restricted personal Discourse messages may be leaked if tagged with a tag

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, e-mail and chat rooms. Discourse suffers from an information disclosure vulnerability that stems from the fact that any user can technically poll sensitive tags to determine if a new...

The vulnerability of the Discourse mailing list management software, related to the use of the regular expression c, which has inefficient computational complexity, allows a hacker to trigger a service failure.

The vulnerability of the Discourse mailing list management software is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow a remote attacker to cause service failures...