discourse vulnerabilities (Bitnami)
287 vulnerabilities.
discourseBitnamiDisplaying user badges can leak topic titles to users that have no access to the topic5.3 MediumdiscourseBitnamiDiscourse user account takeover via email and invite link8.9 HighdiscourseBitnamiPossible Server-Side Request Forgery (SSRF) in webhooks7.6 HighdiscourseBitnamiDiscourse vulnerable to incomplete quote causing a topic to crash in the browser6.5 MediumdiscourseBitnamiDiscourse user profile location and website fields were not sufficiently length-limited4.3 MediumdiscourseBitnamiDiscourse moderators can edit themes via the API7.2 HighdiscourseBitnamiDiscourse vulnerable to RCE via admins uploading maliciously zipped file9.1 CriticaldiscourseBitnamiDiscourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an...7.2 HighdiscourseBitnamiEmail activation route can be abused by spammers in Discourse6.5 MediumdiscourseBitnamiCache poisoning via maliciously-formed request in Discourse5.3 MediumdiscourseBitnamiInvites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse5.7 MediumdiscourseBitnamiBanner topic data is exposed on login-required Discourse sites5.3 MediumdiscourseBitnamiInvite bypasses user approval in Discourse2.6 LowdiscourseBitnamiCategory group permissions leaked in Discourse5.3 MediumdiscourseBitnamiAnonymous user cache poisoning in discourse5.3 MediumdiscourseBitnamiPrivate group name exposure in discourse5.3 MediumdiscourseBitnamiSecure category names leaked via user activity export in Discourse4.3 MediumdiscourseBitnamiDenial of Service in Discourse6.5 MediumdiscourseBitnamiGroup advanced search option may leak group and group's members visibility4.3 MediumdiscourseBitnamiUser can bypass approval when invited to Discourse4.3 MediumdiscourseBitnamiUser's bio visible even if profile is restricted in Discourse4.3 MediumdiscourseBitnamiExposure of whisper participants in discourse4.3 MediumdiscourseBitnamiDenial of Service in discourse6.8 MediumdiscourseBitnamiBypass of Poll voting limits in Discourse4.3 MediumdiscourseBitnamiAnonymous user cache poisoning via development-mode header in Discourse5.3 MediumdiscourseBitnamiNotifications leak in Discourse4.3 MediumdiscourseBitnamiCache poisoning via maliciously-formed request in discourse4.8 MediumdiscourseBitnamiRCE via malicious SNS subscription payload10.0 CriticaldiscourseBitnamiXSS via blocked watched word in error message4.2 MediumdiscourseBitnamiServer Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email...5.3 MediumdiscourseBitnamiCross-site scripting via category name in Discourse4.4 MediumdiscourseBitnamiInformation exposure in Discourse4.3 MediumdiscourseBitnamiRe-use of email tokens in Discourse5.3 MediumdiscourseBitnamiXSS via d-popover and d-html-popover attribute7.4 HighdiscourseBitnamiPost creator of a whisper post can be revealed to non-staff users in Discourse4.3 MediumdiscourseBitnamiYouTube Onebox susceptible to XSS8.1 HighdiscourseBitnamiIn Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement...7.5 High