290 matches found
CVE-2023-38706 Discourse vulnerable to DoS via drafts
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...
CVE-2023-38706 Discourse vulnerable to DoS via drafts
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...
Discourse Security Breach
Discourse is an open source community discussion platform. The platform includes features such as communities, e-mail and chat rooms. A security vulnerability exists in Discourse, which stems from a vulnerability that allows an attacker to create an unlimited number of drafts by using a long draf...
UBUNTU-CVE-2023-4875
Null pointer dereference when composing from a specially crafted draft message in Mutt 1.5.2 2.2.12...
HackerOne: 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.
Vulnerability description not provided...
WordPress Plugin Shortcodes Ultimate 信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...
CVE-2023-0772
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protecte...
CVE-2023-0749
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones...
SUSE CVE-2015-5332
Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service disk consumption by leveraging the guest role and entering drafts with the editor-autosave feature...
OWM Weather < 5.6.12 - Post Duplication via CSRF
The plugin does not have CSRF check when duplicating posts which will be duplicated as drafts, which could allow attackers to make logged in admin perform such action via a CSRF attack and fill up the post table...
CVE-2023-22740
Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 beta tests-passed are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the...
CVE-2023-22740 Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts
Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 beta tests-passed are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the...
CVE-2023-22740
Discourse: A DoS vulnerability due to Allocation of Resources Without Limits via chat drafts. Affected: Discourse versions prior to 3.1.0.beta1 (beta); root cause: unlimited-length chat drafts leading to server load.
CVE-2023-22740 Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts
Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 beta tests-passed are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the...
CVE-2023-22740 Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts
Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 beta tests-passed are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the...
PT-2023-18681 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta1 Description: Discourse is an open source platform for community discussion. The issue concerns the allocation of resources without limits, allowing users to create chat drafts of an unlimited length. Th...
PT-2023-18680 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 Discourse version 3.1.0.beta2 and earlier Description: Discourse is an open source platform for community discussion. The issue is related to Allocation of Resources Without Limits or Throttling, where a...
PT-2022-27764 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions 2.8.10 and prior Discourse versions 2.9.0.beta11 and prior Description: Discourse is an open-source messaging platform. Users composing malicious messages and navigating to the drafts page could self-XSS. This issue can lea...
CVE-2022-46148 Discourse allows self-XSS through malicious composer message
Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...