CVE-2023-38507

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...

Design/Logic Flaw

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

CVE-2023-41043

Discourse DoS CVE-2023-41043 affects the Discourse platform prior to 3.1.1 (stable) and 3.2.0.beta1 (beta/tests-passed). A malicious admin could generate extremely large icons sprites that are cached per server process, potentially triggering DoS downtime on multisite deployments. The issue is fi...

CVE-2023-41043 Discourse DoS via SvgSprite cache

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...

CVE-2023-41042

CVE-2023-41042 affects the open‑source forum software Discourse. Prior to Discourse 3.1.1 (stable) and 3.2.0.beta1 (beta/tests-passed), importing a remote theme could load assets into memory without enforcing limits on file size or number of files. This could enable a DoS condition described acro...

CVE-2023-40588 Discourse DoS via 2FA and Security Key Names

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...

CVE-2023-40588

CVE-2023-40588 affects Discourse (open-source discussion platform). A malicious user could add a 2FA or security key with a crafted name, causing a denial-of-service for other users. Affected versions: prior to 3.1.1 on the stable branch and 3.2.0.beta1 on the beta/tests-passed branches. Mitigati...

CVE-2023-38706

Discourse (open‑source forum software) contains a DoS vulnerability (CVE-2023-38706) where a malicious user can create an unlimited number of drafts with very long draft keys, exhausting server resources. Affected are stable branch < 3.1.1 and beta/tests-passed branches

CVE-2023-38706 Discourse vulnerable to DoS via drafts

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

Design/Logic Flaw

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

[SECURITY] Fedora 39 Update: chromium-116.0.5845.179-1.fc39

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 39 Update: firefox-117.0-1.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

[SECURITY] Fedora 37 Update: firefox-117.0.1-1.fc37

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Discourse Security Breach

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in versions prior to Discourse 3.1.1. An attacker exploiting this vulnerability could perform a denial-of-service attack...

OpenRefine SQL Injection Vulnerability

OpenRefine is a Java-based open source tool. The product is mainly used for loading data, analyzing data and cleaning data. OpenRefine suffers from a SQL injection vulnerability. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...