CVE-2021-41163 RCE via malicious SNS subscription payload

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribeurl values. This issue is patched in the latest stable, beta and tests-passed versions of...

CVE-2021-41163

Discourse (open source discussion platform) contains a flaw in the handling of subscribe_url values that allows remote code execution when processing crafted requests. The issue originates from insufficient validation, enabling an attacker to trigger RCE via crafted inputs, with impact described ...

Discourse 注入漏洞

Discourse is an open source community discussion platform that includes community, email, and chat room features. The platform includes community, email, and chat room features.An injection vulnerability exists in Discourse, which stems from a lack of validation in the user-controllable...

PT-2021-23140 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.7.8 and earlier Description: Discourse is an open source platform for community discussion. In affected versions, maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation i...

CVE-2021-41140

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to updat...

CVE-2021-41140

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to updat...

CVE-2021-41140

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to updat...

Design/Logic Flaw

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to updat...

CVE-2021-41140

CVE-2021-41140 affects the Discourse-reactions plugin for Discourse. The issue allows reactions selected by a user on secure topics and private messages to be visible to others. It specifically concerns versions prior to 0.2. A fix is available in version 0.2 of discourse-reaction; as a workaroun...

CVE-2021-41140 Reactions leak for secure category topics and private messages

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to updat...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse has a security vulnerability that could be exploited by attackers to add their reactions to posts...

PT-2021-23123 · Discourse · Discourse-Reactions

Name of the Vulnerable Software and Affected Versions: Discourse-reactions versions prior to 0.2 Description: The issue affects the Discourse-reactions plugin, allowing reactions to secure topics and private messages to be visible. This affects the confidentiality of user interactions within the...

Discourse Cross-Site Scripting Vulnerability (CNVD-2021-100592)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse suffers from a cross-site scripting vulnerability that can be exploited by attackers to conduct XSS attacks...

CVE-2021-41095

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

CVE-2021-41095

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

CVE-2021-41095

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

Cross site scripting

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

CVE-2021-41095

CVE-2021-41095 affects Discourse: XSS in error messages that reflect user input, triggered only when a site blocks watched HTML-tag words and the default Content Security Policy is modified. Affected versions include Discourse stable ≤2.7.7, beta ≤2.8.0.beta6, and tests-passed ≤2.8.0.beta6. Root ...

CVE-2021-41095 XSS via blocked watched word in error message

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse suffers from a cross-site scripting vulnerability that can be exploited by attackers to conduct XSS attacks...