Discourse discourse

• CVE-2023-41043 Medium 6.5 Discourse DoS via SvgSprite cache 0.6%
• CVE-2023-41042 Medium 4.9 Discourse DoS via remote theme assets 0.6%
• CVE-2023-40588 Medium 6.5 Discourse DoS via 2FA and Security Key Names 0.6%
• CVE-2023-38706 Medium 6.5 Discourse vulnerable to DoS via drafts 0.8%
• CVE-2023-38685 Medium 4.3 Discourse's restricted tag information visible to unauthenticated users 0.5%
• CVE-2023-38684 Medium 5.3 Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions 0.6%
• CVE-2023-38498 Medium 4.3 Discourse vulnerable to DoS via defer queue 0.7%
• CVE-2023-37906 Medium 4.3 Discourse vulnerable to DoS via post edit reason 0.5%
• CVE-2023-37904 Low 2.6 Discourse Race Condition in Accept Invite 0.3%
• CVE-2023-37467 Medium 6.8 Discourse CSP nonce reuse vulnerability for anonymous users 0.4%
• CVE-2023-36818 Medium 6.5 Denial of service via User Custom Sidebar Section Unlimited Link Creation in discourse 0.7%
• CVE-2023-36466 Low 3.5 Topic Title Validation Skipped When Changing Category in Discourse 0.4%
• CVE-2023-36473 Medium 6.8 CSP nonce reuse vulnerability in Discourse 0.4%
• CVE-2023-34250 Medium 4.8 Discourse vulnerable to exposure of number of topics recently created in private categories 0.4%
• CVE-2023-32301 Low 3.1 Discourse's canonical url not being used for topic embeddings 0.4%
• CVE-2023-32061 Medium 5.4 Discourse Topic Creation Page Allows iFrame Tag without Restrictions 0.4%
• CVE-2023-31142 Low 2.0 Discourse's general category permissions could be set back to default 0.3%
• CVE-2023-30606 Medium 4.2 Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse 0.4%
• CVE-2023-30538 Medium 5.4 Stored Cross-site Scripting via improper sanitization of svg files in Discourse 0.4%
• CVE-2023-29196 Medium 4.2 HTML injection via topic embedding in Discourse 0.3%
• CVE-2023-28440 Low 2.7 Denial of service via admin theme import route in Discourse 0.7%
• CVE-2023-28112 Medium 5.9 Discourse's SSRF protection missing for some FastImage requests 0.6%
• CVE-2023-28111 Medium 5.7 Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses 0.6%
• CVE-2023-28107 Medium 4.5 Discourse vulnerable to multisite DoS by spamming backups 0.7%
• CVE-2023-25172 Medium 4.4 Discourse vulnerable to Cross-site Scripting - user name displayed on post 0.5%
• CVE-2023-26040 Medium 6.5 Discourse chat messages susceptible to Cross-site Scripting through chat excerpts 0.4%
• CVE-2023-23622 Medium 4.3 Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users 0.5%
• CVE-2023-23935 Low 3.5 Presence of restricted personal Discourse messages may be leaked if tagged with a tag 0.5%
• CVE-2023-25819 Medium 5.3 Discourse tags with no visibility are leaking into og:article:tag 0.5%
• CVE-2023-25167 Medium 6.5 Regular expression denial of service via installing themes via git in discourse 0.6%
• CVE-2023-23615 Medium 5.3 Malicious users in Discourse can create spam topics as any user due to improper access control 0.5%
• CVE-2023-23624 Medium 4.3 Discourse's exclude_tags param could leak which topics had a specific hidden tag 0.6%
• CVE-2023-23621 High 8.6 Discourse vulnerable to ReDoS in user agent parsing 0.9%
• CVE-2023-22740 Medium 4.3 Discourse vulnerable to Allocation of Resources Without Limits via Chat drafts 0.7%
• CVE-2023-23616 Low 3.5 Discourse membership requests lack character limit 0.7%
• CVE-2023-23620 Medium 5.3 Discourse restricted tag routes leak topic information 0.7%
• CVE-2023-22739 Medium 6.5 Discourse subject to Allocation of Resources Without Limits or Throttling 0.9%
• CVE-2023-22468 High 8.8 Discourse vulnerable to Cross-site Scripting in local oneboxes 0.5%
• CVE-2023-22455 Medium 6.8 Discourse vulnerable to Cross-site Scripting through tag descriptions 0.5%
• CVE-2023-22454 High 8.0 Discourse vulnerable to Cross-site Scripting through pending post titles descriptions 0.6%
• CVE-2023-22453 Medium 5.3 Discourse vulnerable to exposure of user post counts per topic to unauthorized users 0.6%
• CVE-2022-46177 Medium 5.7 Discourse password reset link can lead to in account takeover if user changes to a new email 0.7%
• CVE-2022-23546 Medium 5.5 Discourse vulnerable to private topic leak via email#send_digest 0.3%
• CVE-2022-46168 Low 3.5 Group SMTP user emails are exposed in CC email header 0.6%
• CVE-2022-23548 Medium 6.5 Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, parsing posts can be susceptible t 0.8%
• CVE-2022-23549 Medium 5.7 Discourse vulnerable to bypass of post max_length using HTML comments 0.6%
• CVE-2022-46159 Medium 4.3 Any authenticated Discourse user can create an unlisted topic 0.7%
• CVE-2022-46150 Medium 4.3 Discourse may allow exposure of hidden tags in the subject of notification emails 0.6%
• CVE-2022-46148 High 7.1 Discourse allows self-XSS through malicious composer message 0.5%
• CVE-2022-41921 Low 3.5 Discourse chat messages should have a maximum character limit 0.6%