CVE-2021-41163

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribeurl values. This issue is patched in the latest stable, beta and tests-passed versions of...

CVE-2021-41095

CVE-2021-41095 affects Discourse: XSS in error messages that reflect user input, triggered only when a site blocks watched HTML-tag words and the default Content Security Policy is modified. Affected versions include Discourse stable ≤2.7.7, beta ≤2.8.0.beta6, and tests-passed ≤2.8.0.beta6. Root ...

PT-2021-23075 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest commit Description: Discourse is a platform for community discussion. In affected versions, any private message that includes a group had its title and participating user exposed to users that do not hav...

PT-2021-22418 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue allows category names to be used for Cross-site scripting XSS attacks. This is mitigated by Discourse's default Content Security Policy, and...