Filters
Software
Discourse DiscourseDenial of service by the absence of restrictions on replies to posts in Discourse
7.5
First published (updated )
Discourse DiscourseBypass of email address validation via encoded email addresses in Discourse
8.2
First published (updated )
Discourse DiscourseDiscourse vulnerable to DoS via Tag Group
7.5
First published (updated )
Discourse DiscourseDiscourse vulnerable to unlimited mentioned users in message serializer
8.6
First published (updated )
Discourse DiscourseDiscourse DoS through Onebox favicon URL
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse Discourse CalendarImproper escaping of user input in discourse-calendar
8
First published (updated )
Discourse DiscourseUnauthenticated access to new private chat messages in Discourse
7.5
First published (updated )
Discourse DiscourseMalicious requests can fill up the log files resulting in a deinal of service in Discourse
7.5
First published (updated )
Discourse DiscourseCross-site Scripting via email preview when CSP disabled in Discourse
8
First published (updated )
Discourse Discourse-encryptImproper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration
7.2
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse DiscourseDiscourse vulnerable to ossible DDoS due to unbounded limits in various controller actions
7.5
First published (updated )
Discourse DiscourseDenial of service via User Custom Sidebar Section Unlimited Link Creation in discourse
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse DiscourseDiscourse vulnerable to Cross-site Scripting in local oneboxes
8.8
First published (updated )
Discourse DiscourseDiscourse vulnerable to Cross-site Scripting through pending post titles descriptions
8
First published (updated )
Discourse DiscourseDiscourse password reset link can lead to in account takeover if user changes to a new email
8.1
First published (updated )
Discourse DiscourseDiscourse allows self-XSS through malicious composer message
7.1
First published (updated )
Discourse DiscoursePossible Server-Side Request Forgery (SSRF) in webhooks
7.6
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse DiscourseDiscourse user account takeover via email and invite link
8.9
First published (updated )
Discourse DiscourseDiscourse moderators can edit themes via the API
7.2
First published (updated )
Discourse DiscourseDiscourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimit…
7.2
First published (updated )
Discourse DiscourseEmail activation route can be abused by spammers in Discourse
7.5
First published (updated )
Discourse DiscourseUser can bypass approval when invited to Discourse
8.8
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse Rails MultisiteSecure/signed cookies share secrets between sites in rails_multisite
8.8
First published (updated )
Discourse DiscoursePrivate message title and participating users leaked in discourse
7.5
First published (updated )
Discourse DiscourseRe-use of email tokens in Discourse
7.5
First published (updated )
Discourse DiscourseXSS via d-popover and d-html-popover attribute
7.4
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Discourse DiscourseIn Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for c…
7.5
First published (updated )
Discourse DiscourseDiscourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via …
7.5
First published (updated )