1124 matches found
Design/Logic Flaw
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...
CVE-2023-28440
CVE-2023-28440 affects Discourse: an admin-authenticated request can trigger a long-running operation, leading to a denial of service (availability impact) in affected builds. Public records identify the vulnerability as a Denial of Service via the admin theme import route, with mitigation by upg...
CVE-2023-28440 Denial of service via admin theme import route in Discourse
Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untruste...
Webinar: Tips from MSSPs to MSSPs – Building a Profitable vCISO Practice
In today's fast-paced and ever-changing digital landscape, businesses of all sizes face a myriad of cybersecurity threats. Putting in place the right people, technological tools and services, MSSPs are in a great position to ensure their customers' cyber resilience. The growing need of SMEs and...
CVE-2023-28426
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: GHSA-xrqq-wqh4-5hg2. Reason: Further investigation showed that this CVE was assigned in error. Notes: See https://github.com/darylldoyle/svg-sanitizer/issues/88 for a technical discussion...
CVE-2023-25172
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled o...
Cross site scripting
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, a maliciously crafted URL can be included in a user's full name field to to carry out cross-site scripting attacks on sites with a disabled o...
CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...
CVE-2023-28111 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, attackers are able to bypass Discourse's server-side request forgery SSRF protection for private IPv4 addresses by using a IPv4-mapped IPv6 address. The issue is patched in the...
CVE-2023-28107
CVE-2023-28107 affects Discourse. Prior to Discourse 3.0.2 (stable) and 3.1.0.beta3 (beta/tests-passed), an administrator could trigger repeated backup requests, exhausting DB connections and potentially impacting multisite clusters. Patches are available in 3.0.2 (stable) and 3.1.0.beta3 (beta/t...
CVE-2023-23622
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or...
CVE-2023-26040
Discourse (open-source discussion platform) vulnerable in the tests-passed branch between versions 3.1.0.beta2 and 3.1.0.beta3, where editing or replying to a chat message containing malicious content could lead to cross-site scripting (XSS). The issue is patched in version 3.1.0.beta3 of the tes...
CVE-2023-23622 Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or...
CVE-2023-23622 Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users
Discourse is an open-source discussion platform. Prior to version 3.0.1 of the stable branch and version 3.1.0.beta2 of the beta and tests-passed branches, the count of topics displayed for a tag is a count of all regular topics regardless of whether the topic is in a read restricted category or...
CVE-2023-23622
Discourse (CVE-2023-23622) vulnerability: prior to Discourse 3.0.1 Stable and 3.1.0.beta2 for Beta/tests-passed, the topic count displayed for a tag could reveal presence of read-restricted topics. The cause is counting all regular topics regardless of category access, enabling potential informat...
S4x23 Review Part 2: Evolving Energy Cybersecurity
In this second report on S4x23 held last February, this article introduces the discussion on cyber security in the energy industry, which was one of the topics that attracted attention...
Formidable Forms < 6.1 - IP Spoofing
The plugin uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections. 1. In WordPress's Settings Discussion page, add your IP address to the Disallowed Comment Keys field. This will block form submissio...
Design/Logic Flaw
Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...
CVE-2023-25819 Discourse tags with no visibility are leaking into og:article:tag
Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the tests-passed or beta branches = 3.1.0.beta2. The issue is patched in the latest beta and tests-passed version of Discourse...
CVE-2023-25819
Discourse vulnerability CVE-2023-25819: metadata leakage where normally private tags are exposed in og:article and related metadata for sites running the tests-passed or beta branches >= 3.1.0.beta2. The issue affects Discourse and is patched in the latest beta and tests-passed releases. Root ...