PT-2022-20670 · Online Discussion Forum Site +1 · Online Discussion Forum Site

Name of the Vulnerable Software and Affected Versions: Online Discussion Forum Site 1 affected versions not specified Description: The issue allows unauthenticated attackers to arbitrarily create or update user accounts due to a problem in the save users function. Recommendations: At the moment,...

PT-2022-20987 · Unknown · Online Discussion Forum Site

Name of the Vulnerable Software and Affected Versions: Online Discussion Forum Site version 1.0 Description: The issue is related to Cross Site Scripting XSS via the "/odfs/classes/Master.php?f=save category" API endpoint, specifically affecting the name variable. This allows for potential...

PT-2022-20671 · Online Discussion Forum Site +1 · Online Discussion Forum Site

Name of the Vulnerable Software and Affected Versions: Online Discussion Forum Site 1 affected versions not specified Description: An issue in the delete post function allows unauthenticated attackers to arbitrarily delete posts. Recommendations: At the moment, there is no information about a new...

CVE-2022-31060

Discourse banner topic data exposure affects versions prior to 2.8.4 (stable) and prior to 2.9.0.beta5 (beta/tests-passed). The vulnerability exposes banner topic data on login-required sites. Fixes are in Discourse 2.8.4 (stable) and 2.9.0.beta5 (beta/tests-passed); as a workaround, banners can ...

CVE-2022-31060 Banner topic data is exposed on login-required Discourse sites

Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...

Leaking Military Secrets on Gaming Discussion Boards

People are leaking classified military information on discussion boards for the video game War Thunder to win arguments--repeatedly...

CVE-2022-31025

CVE-2022-31025 affects Discourse; prior to versions 2.8.4 (stable) and 2.9.0beta5 (beta/tests-passed) an SSO-based invite could bypass must_approve_users, causing invites by staff to be auto-approved. A fix is available: Discourse 2.8.4 on stable and 2.9.0.beta5 on beta/tests-passed. Workarounds ...

CVE-2022-31025 Invite bypasses user approval in Discourse

Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the stable branch and 2.9.0beta5 on the beta and tests-passed branches, inviting users on sites that use single sign-on could bypass the mustapproveusers check and invites by staff are always approved...

CVE-2022-31025 Invite bypasses user approval in Discourse

Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the stable branch and 2.9.0beta5 on the beta and tests-passed branches, inviting users on sites that use single sign-on could bypass the mustapproveusers check and invites by staff are always approved...

Rating by BestWebSoft < 1.6 - Rating Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating Under Settings - Discussion, uncheck "Comment must be manually approved" Install and Enable Rating BestWebSoft plugin Change "Enable...

SimpleGeo python-oauth2 does not check the nonce allowing replay attacks

The Server.verifyrequest function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL. The vulnerability does not appear to be patched according to the following discussion...

Online Discussion Forum Site 1.0 SQL Injection

Exploit Title: Online Discussion Forum Site 1.0 - 'id' Blind SQL Injection Date: 15/05/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html Version: 1.0...

CVE-2022-24824

Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous i.e. not logged in users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issu...

Design/Logic Flaw

Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should...

CVE-2022-24850

CVE-2022-24850 affects Discourse. The issue allows a user with access to a category to view a category’s group permissions (i.e., whether a group has read/write) that should only be visible to managers. Root cause details are not explicitly enumerated in the provided documents, but the vulnerabil...

CVE-2022-24850 Category group permissions leaked in Discourse

Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should...

CVE-2022-24850 Category group permissions leaked in Discourse

Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should...

CVE-2022-24824

CVE-2022-24824 affects the Discourse platform. An attacker can poison the cache for anonymous users, causing them to see the crawler view instead of the HTML page, resulting in a partial denial-of-service. Technical details in connected sources confirm the vulnerability is in the cache handling f...

CVE-2022-24824 Anonymous user cache poisoning in discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous i.e. not logged in users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issu...

Design/Logic Flaw

Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user...