CVE-2022-24804

CVE-2022-24804 affects Discourse where, in stable versions before 2.8.3 and beta versions before 2.9.0.beta4, the name of a group with restricted visibility can be leaked to any user who can see a category that uses that group for permissions. The underlying issue is an information disclosure in ...

CVE-2022-24804 Private group name exposure in discourse

Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user...

CVE-2022-24782

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...

Upcoming Speaking Events

This is a current list of where and when I am scheduled to speak: I’m participating in an online panel discussion on “Ukraine and Russia: The Online War,” hosted by UMass Amherst, at 5:00 PM Eastern on March 31, 2022. I’m speaking at Future Summits in Antwerp, Belgium on May 18, 2022. I’m speakin...

Is Hacktivism Good or Bad? How Could It Affect Your Business?

By Owais Sultan When the term hacktivism is discussed the first thing that comes to our mind is the Anonymous collective.… This is a post from HackRead.com Read the original post: Is Hacktivism Good or Bad? How Could It Affect Your Business?...

CVE-2021-3575

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg...

CVE-2022-21677

CVE-2022-21677 affects Discourse prior to versions 2.7.13 and 2.8.0.beta11, where the group advanced search option could reveal restricted group visibility or members visibility. The root cause is that search did not respect the configured visibility levels. The issue results in information discl...

CVE-2022-21678

Discourse suffers an information disclosure vulnerability: before specific patch levels, bios (or profile bios) of users with private profiles were exposed in the page meta data, exposing private user information. Affected software: Discourse. Affected versions include prior to 2.8.0.beta11 in th...

CVE-2022-21678 User's bio visible even if profile is restricted in Discourse

Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the tests-passed branch, version 2.8.0.beta11 in the beta branch, and version 2.7.13 in the stable branch, the bios of users who made their profiles private were still visible in the tags on their users' pages. The...

CVE-2022-21642

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...

Design/Logic Flaw

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...

CVE-2022-21642

CVE-2022-21642 affects Discourse (open source community platform). In affected versions, when composing a message from a topic, the composer’s user suggestions reveal whisper participants, constituting information disclosure. The issue has been fixed in stable version 2.7.13 and in beta version 2...

CVE-2022-21642 Exposure of whisper participants in discourse

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...

CVE-2021-43850

Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the /message-bus/diagnostics path. The impact of this vulnerability is greater on multisite Discourse instances where multiple forums are served from a singl...

CVE-2021-43850 Denial of Service in discourse

Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the /message-bus/diagnostics path. The impact of this vulnerability is greater on multisite Discourse instances where multiple forums are served from a singl...

Simple Forum-Discussion System SQL Injection Vulnerability

Simple Forum-Discussion System is a simple forum/discussion system. SQL injection vulnerability exists in Simple Forum-Discussion System, which originates in various components such as manage topic.php, manage user.php and ajax.php. Lack of validation of externally entered SQL statements. An...

CVE-2021-45252

Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are managetopic.php, manageuser.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability...

Sql injection

Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are managetopic.php, manageuser.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability...

CVE-2021-45252

CVE-2021-45252 affects Simple Forum-Discussion System 1.0 with SQL injection vulnerabilities in the manage_topic.php, manage_user.php, and ajax.php components. Root cause: lack of input validation allowing arbitrary SQL execution, enabling an attacker to retrieve potentially all database data. Im...

CVE-2021-45252

Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are managetopic.php, manageuser.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability...