EUVD-2019-2063

Malware in sbrugna...

Code injection

Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP...

CVE-2019-1020017

CVE-2019-1020017 affects Discourse prior to 2.3.0 and 2.4.x prior to 2.4.0.beta3, where logging in via a user-api OTP lacks a confirmation screen. The vulnerability originates from improper flow gating during OTP-based login, enabling potential unintended access without explicit user confirmation...