CVE-2022-36068

Discourse vulnerability CVE-2022-36068 affects versions prior to 2.8.9 (stable) and prior to 2.9.0.beta10 (beta/tests-passed). A moderator could create new themes and edit existing themes via the API when not allowed. Patch is available in 2.8.9 (stable) and 2.9.0.beta10 (beta/tests-passed). Ther...

CVE-2022-36068 Discourse moderators can edit themes via the API

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in...

CVE-2022-36066

CVE-2022-36066 affects Discourse prior to versions 2.8.9 (stable) and 2.9.0.beta10 (beta/tests-passed). The flaw lets admins upload a malicious Zip or Gzip Tar archive that writes files at arbitrary locations, enabling remote code execution. Root cause is improper validation of uploaded files, al...

CVE-2022-36066 Discourse vulnerable to RCE via admins uploading maliciously zipped file

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution...

CVE-2022-36066 Discourse vulnerable to RCE via admins uploading maliciously zipped file

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution...

CVE-2022-36066 Discourse vulnerable to RCE via admins uploading maliciously zipped file

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution...

PT-2022-24828 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.9.0.beta5 through 2.9.0.beta9 Description: The issue arises when an incomplete quote generates a JavaScript error, potentially crashing the current page in the browser. This occurs in certain cases and is related to how t...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A file upload vulnerability exists in versions of Discourse prior to 2.8.9 and prior to 2.9.0.beta10, which stems from a lack of valid validation of uploaded files by the...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email, and chat rooms. A security vulnerability exists in Discourse versions prior to 2.8.9, 2.9.0.beta9, and 2.9.0.beta9, which stems from a JavaScript error generated by an incomplete...

PT-2022-23154 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.9 Discourse versions prior to 2.9.0.beta10 Description: The issue allows admins to upload maliciously crafted Zip or Gzip Tar archives, enabling them to write files at arbitrary locations and trigger remote cod...

Discourse 安全漏洞

Discourse is an open source community discussion platform. An access control error vulnerability exists in versions of Discourse prior to 2.8.9 and prior to 2.9.0.beta10. The vulnerability stems from improper access control of the API, which could be exploited to create new topics and edit existi...

PT-2022-24824 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.9 Discourse versions prior to 2.9.0.beta10 Description: A malicious actor can add large payloads of text into the Location and Website fields of a user profile, causing issues for other users when loading that...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. versions of Discourse prior to 2.8.9, and prior to 2.9.0.beta10, contain an input validation error vulnerability that could be exploited by an attacker to add large text load...

CVE-2022-36057

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting XSS attack. Version 0.9 contains a patch for this issue...

Cross site scripting

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting XSS attack. Version 0.9 contains a patch for this issue...

CVE-2022-36057 Discourse-Chat Cross-Site Scripting issue for channel names and descriptions

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting XSS attack. Version 0.9 contains a patch for this issue...

CVE-2022-36057 Discourse-Chat Cross-Site Scripting issue for channel names and descriptions

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting XSS attack. Version 0.9 contains a patch for this issue...

CVE-2022-36057 Discourse-Chat Cross-Site Scripting issue for channel names and descriptions

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting XSS attack. Version 0.9 contains a patch for this issue...

CVE-2022-36057

The CVE-2022-36057 issue affects Discourse-Chat, a plugin for Discourse. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by an administrator being able to insert HTML into chat titles and descriptions for channel names. The publicly reported details indicate that versions prior to 0...

Discourse-Chat 安全漏洞

Discourse-Chat is a free open source chat plugin for Discourse open source internet forum software. A security vulnerability exists in versions of Discourse-Chat prior to 0.9, which originated from a cross-site scripting XSS attack by an administrator user inserting HTML in the chat title and...