Discourse
Page 3 of 4 — Discourse CVEs from a corpus of 309, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41043 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-41042 | Medium | 4.9 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-40588 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-38706 | Medium | 6.5 | 2023-09-15 | Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branche… |
CVE-2023-38685 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-38684 | Medium | 5.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-38498 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37906 | Medium | 4.3 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37904 | Low | 2.6 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branche… |
CVE-2023-37467 | Medium | 6.8 | 2023-07-28 | Discourse is an open source discussion platform. Prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce… |
CVE-2023-36818 | Medium | 6.5 | 2023-07-14 | Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This… |
CVE-2023-36466 | Low | 3.5 | 2023-07-14 | Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for t… |
CVE-2023-36473 | Medium | 6.8 | 2023-07-13 | Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. Th… |
CVE-2023-34250 | Medium | 4.8 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-32301 | Low | 3.1 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-32061 | Medium | 5.4 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-31142 | Low | 2.0 | 2023-06-13 | Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branche… |
CVE-2023-30611 | Medium | 4.3 | 2023-04-19 | Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versions data about what r… |
CVE-2023-30606 | Medium | 4.2 | 2023-04-18 | Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary methods on the `SiteSe… |
CVE-2023-30538 | Medium | 5.4 | 2023-04-18 | Discourse is an open source platform for community discussion. Due to the improper sanitization of SVG files, an attacker can execute arbitrary JavaScript on t… |
CVE-2023-29196 | Medium | 4.2 | 2023-04-18 | Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must… |
CVE-2023-28440 | Low | 2.7 | 2023-04-18 | Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a… |
CVE-2023-28112 | Medium | 5.9 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, some user provided URLs were being pas… |
CVE-2023-28111 | Medium | 5.7 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse… |
CVE-2023-28107 | Medium | 4.5 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.2 of the `stable` branch and version 3.1.0.beta3 of the `beta` and `tests-passed` branche… |
CVE-2023-25172 | Medium | 4.4 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branche… |
CVE-2023-26040 | Medium | 6.5 | 2023-03-17 | Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the `tests-passed` branch, editing or responding to a chat mes… |
CVE-2023-23622 | Medium | 4.3 | 2023-03-17 | Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `tests-passed` branche… |
CVE-2023-23935 | Low | 3.5 | 2023-03-16 | Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the `stable` branch and versions 3.1.0.beta2 and prior on the `beta` and `tests-… |
CVE-2023-25169 | Low | 3.1 | 2023-03-06 | discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic t… |
CVE-2023-25819 | Medium | 5.3 | 2023-03-04 | Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests… |
CVE-2023-25167 | Medium | 6.5 | 2023-02-08 | Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully craft… |
CVE-2023-23615 | Medium | 5.3 | 2023-02-03 | Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or conte… |
CVE-2023-23624 | Medium | 4.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23621 | High | 8.6 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2023-23620 | Medium | 5.3 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the c… |
CVE-2023-23616 | Low | 3.5 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when… |
CVE-2023-22740 | Medium | 4.3 | 2023-01-27 | Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources W… |
CVE-2023-22739 | Medium | 6.5 | 2023-01-26 | Discourse is an open source platform for community discussion. Versions prior to 3.0.1 (stable), 3.1.0.beta2 (beta), and 3.1.0.beta2 (tests-passed) are subject… |
CVE-2023-22468 | High | 8.8 | 2023-01-26 | Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulne… |
CVE-2023-22455 | Medium | 6.8 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22454 | High | 8.0 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2023-22453 | Medium | 5.3 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-46177 | Medium | 5.7 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-23549 | Medium | 5.7 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-23548 | Medium | 6.5 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2022-23546 | Medium | 5.5 | 2023-01-05 | In version 2.9.0.beta14 of Discourse, an open-source discussion platform, maliciously embedded urls can leak an admin's digest of recent topics, possibly expos… |
CVE-2022-46168 | Low | 3.5 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` bra… |
CVE-2022-46180 | Medium | 5.0 | 2023-01-04 | Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users o… |
CVE-2022-46159 | Medium | 4.3 | 2022-12-02 | Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests… |
CVE-2022-46162 | High | 8.8 | 2022-11-30 | discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discou… |
CVE-2022-46150 | Medium | 4.3 | 2022-11-29 | Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branc… |
CVE-2022-46148 | High | 7.1 | 2022-11-29 | Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `test… |
CVE-2022-41944 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. In stable versions prior to 2.8.12 and beta or tests-passed versions prior to 2.9.0.beta.13, under certain con… |
CVE-2022-41921 | Low | 3.5 | 2022-11-28 | Discourse is an open-source discussion platform. Prior to version 2.9.0.beta13, users can post chat messages of an unlimited length, which can cause a denial o… |
CVE-2022-41913 | Medium | 4.3 | 2022-11-14 | Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members o… |
CVE-2022-39385 | Medium | 6.5 | 2022-11-14 | Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message… |
CVE-2022-39378 | Medium | 5.3 | 2022-11-02 | Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restr… |
CVE-2022-39356 | High | 8.9 | 2022-11-02 | Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin use… |
CVE-2022-39241 | High | 7.6 | 2022-11-02 | Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts o… |
CVE-2022-39355 | Critical | 9.1 | 2022-10-26 | Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerab… |
CVE-2022-39279 | Medium | 4.3 | 2022-10-06 | discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and… |
CVE-2022-39270 | Medium | 5.4 | 2022-10-06 | DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have suffici… |
CVE-2022-39232 | Medium | 6.5 | 2022-09-29 | Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaSc… |
CVE-2022-39226 | Medium | 4.3 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36068 | High | 7.2 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36066 | Critical | 9.1 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36057 | Medium | 5.4 | 2022-09-06 | Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users in… |
CVE-2022-37458 | High | 7.2 | 2022-09-02 | Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate. |
CVE-2022-31184 | Medium | 6.5 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been incl… |
CVE-2022-31182 | Medium | 5.3 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error responses to be cac… |
CVE-2022-31096 | Medium | 5.7 | 2022-06-27 | Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the in… |
CVE-2022-31095 | Medium | 4.3 | 2022-06-21 | discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker… |
CVE-2022-31060 | Medium | 5.3 | 2022-06-14 | Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branc… |
CVE-2022-31059 | Medium | 6.5 | 2022-06-14 | Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be suscep… |
CVE-2022-31025 | Low | 2.6 | 2022-06-07 | Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` br… |
CVE-2022-24866 | Medium | 4.3 | 2022-04-26 | Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer… |
CVE-2022-24850 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category… |
CVE-2022-24824 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users… |
CVE-2022-24804 | Medium | 5.3 | 2022-04-11 | Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups… |
CVE-2022-24782 | Medium | 4.3 | 2022-03-24 | Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 a… |
CVE-2022-23641 | Medium | 6.5 | 2022-02-15 | Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `t… |
CVE-2022-21677 | Medium | 4.3 | 2022-01-14 | Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members… |
CVE-2022-21684 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some us… |
CVE-2022-21678 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and ver… |
CVE-2022-21642 | Medium | 4.3 | 2022-01-05 | Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals w… |
CVE-2021-43850 | Medium | 6.8 | 2022-01-04 | Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_… |
CVE-2021-43840 | Medium | 4.4 | 2021-12-17 | message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled… |
CVE-2021-43827 | Medium | 4.3 | 2021-12-14 | discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footno… |
CVE-2021-43794 | Medium | 5.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the… |
CVE-2021-43793 | Medium | 4.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-opt… |
CVE-2021-43792 | Medium | 4.3 | 2021-12-01 | Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the fol… |
CVE-2021-41271 | Medium | 4.8 | 2021-11-15 | Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate… |
CVE-2021-41263 | High | 8.3 | 2021-11-15 | rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite… |
CVE-2021-41163 | Critical | 10.0 | 2021-10-20 | Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resu… |
CVE-2021-41140 | Medium | 5.3 | 2021-10-19 | Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to… |
CVE-2021-41095 | Medium | 4.2 | 2021-09-27 | Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, vers… |
CVE-2020-24327 | Medium | 5.3 | 2021-09-23 | Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload p… |
CVE-2021-41082 | High | 7.5 | 2021-09-20 | Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed t… |
CVE-2021-39161 | Medium | 4.4 | 2021-08-26 | Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is m… |