CVE-2017-20290

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

CVE-2017-20290

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

CVE-2017-20290

Discourse versions 1.9.0.beta2 before 1.9.0.beta13 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue exists because the email parameter of the /email/unsubscribed endpoint is rendered unescaped via html_safe in the unsubscribed.html.erb file. Unauthenticated attack...

EUVD-2017-19027

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

CVE-2017-20290 Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

VulnCheck KEV: CVE-2017-20290

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

PT-2026-121377

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

CVE-2017-20290: Improper Neutralization of Input During Web Page Generation

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb...

Discourse cross-site scripting vulnerability

Versions 1.9.0.beta2 through 1.9.0.beta13 of Discourse contain a cross-site scripting vulnerability. This arises from the lack of validation on the /email/unsubscribed email parameter; the unsubscribed.html.erb file uses htmlsafe without proper escaping. As a result, it may be exploited for...

Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)

The CAPTCHA of the extension can be bypassed which may result in automated creation of various newsletter subscribers. It is possible to provide arbitrary subscription UIDs to the deleteAction of the extension resulting in all newsletter subscribers to be unsubscribed. Insufficient access checks ...

talk.devuan.org XSS vulnerability

Vulnerable URL: https://talk.devuan.org/email/[email protected]%27%22%3E%3Csvg/onload=alert/openbugbounty/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknow...

discourse.appsoluut.com XSS vulnerability

Vulnerable URL: https://discourse.appsoluut.com/email/[email protected]%27%22%3E%3Csvg/onload=alert/openbugbounty/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...

Nextcloud: Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe

Hello, The mentioned URL contains a form that, when supplied correct user emails, unsubscribes users from the newsletters they're subscribed to. If the user is not subscribed, the form returns a message that says that the user is not subscribed if this is the case. Regards...