CVE-2023-36466 Topic Title Validation Skipped When Changing Category in Discourse

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...

CVE-2023-36473

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

Design/Logic Flaw

Discourse is an open source discussion platform. A CSP Content Security Policy nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass...

CVE-2023-36473

Discourse (open-source discussion platform) has a CSP nonce reuse vulnerability (CVE-2023-36473) that could allow XSS by bypassing Content Security Policy if nonce reuse occurs. The issue is described as unexploited currently, with remediation present: the vulnerability is patched in the latest t...

Introducing Discuss ? the Akamai Developer Discussion Forum

...

CVE-2023-32301

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, multiple duplicate topics could be created if topic embedding is enabled. This issue is patched in version 3.0.4 of the stable branch and...

CVE-2023-34250 Discourse vulnerable to exposure of number of topics recently created in private categories

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, an attacker could use the new topics dismissal endpoint to reveal the number of topics recently created but not the actual content thereof in...

CVE-2023-34250

Discourse is affected by CVE-2023-34250. Affected versions: stable before 3.0.4 and beta/tests-passed before 3.1.0.beta5. The issue allows an attacker using the new topics dismissal endpoint to reveal the number of topics recently created in private categories without access to their content. The...

CVE-2023-32301

Discourse prior to versions 3.0.4 (stable) and 3.1.0.beta5 (beta/tests-passed) were affected by a flaw that could allow creation of multiple duplicate topics when topic embedding is enabled. The underlying issue is fixed in Discourse 3.0.4 (stable) and 3.1.0.beta5 (beta/tests-passed). A workaroun...

CVE-2023-32061

Discourse prior to v3.0.4 (stable) and v3.1.0.beta5 (beta/tests-passed) is vulnerable to iframe tag restriction bypass, allowing an attacker to hide subsequent comments. Root cause: lack of restrictions on the iframe tag in topic creation. Patched in v3.0.4 (stable) and v3.1.0.beta5 (beta/tests-p...

CVE-2023-31142

CVE-2023-31142 affects Discourse (open source discussion platform). Prior to Discourse 3.0.4 on the stable branch and 3.1.0.beta5 on the beta/tests-passed branches, sites that had modified their general category permissions could have those permissions reset to the default. The issue is fixed in ...

CVE-2023-31142 Discourse's general category permissions could be set back to default

Discourse is an open source discussion platform. Prior to version 3.0.4 of the stable branch and version 3.1.0.beta5 of the beta and tests-passed branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of t...

CVE-2023-3150

A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file posts\managepost.php. The manipulation of the argument id leads to sql injection. The attack can be launched...

CVE-2023-3150

A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file posts\managepost.php. The manipulation of the argument id leads to sql injection. The attack can be launched...

CVE-2023-3152

A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\viewpost.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

Sql injection

A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file posts\managepost.php. The manipulation of the argument id leads to sql injection. The attack can be launched...

Sql injection

A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user\manageuser.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The...

CVE-2023-3152

The CVE-2023-3152 entry concerns SourceCodester Online Discussion Forum Site 1.0 with a SQL injection vulnerability in admin\posts\view_post.php. The issue allows remote exploitation and, per the description, an exploit has been disclosed publicly (VDB-231021). No additional technical details (af...

CVE-2023-3152 SourceCodester Online Discussion Forum Site view_post.php sql injection

A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\viewpost.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

CVE-2023-3151

CVE-2023-3151 affects SourceCodester Online Discussion Forum Site 1.0. The issue is a SQL injection in the logic handling the parameter id in the file manage_user.php (path variants seen as user/manage_user.php). The underlying root cause is manipulation of the id argument that allows arbitrary S...