discourse vulnerabilities (Bitnami)
287 vulnerabilities.
discourseBitnamiDiscourse has race condition when adding users to a group DM4.3 MediumdiscourseBitnamiCross-site Scripting (XSS) via topic titles when CSP disabled in Discourse4.3 MediumdiscourseBitnamiPartial denial of service via inline oneboxes in Discourse4.3 MediumdiscourseBitnamiPotential bypass of chat permissions in Discourse4.3 MediumdiscourseBitnamiAnonymous cache poisoning via XHR requests in Discourse8.2 HighdiscourseBitnamiUsers can see other user's tagged PMs in Discourse2.2 LowdiscourseBitnamiHTMLi(XSS without CSP) via Onebox urls in Discourse6.5 MediumdiscourseBitnamiStored DOM-based XSS (without CSP) via video placeholders in Discourse6.5 MediumdiscourseBitnamiAnonymous cache poisoning via request headers in Discourse8.2 HighdiscourseBitnamiBypass of Discourse Connect using other login paths if enabled in Discourse5.3 MediumdiscourseBitnamiModerators can view Screened emails even when the “moderators view emails” option is disabled in Discourse2.2 LowdiscourseBitnamiMagnific lightbox susceptible to Cross-site Scripting in Discourse6.8 MediumdiscourseBitnamiPotential Backup file leaked via Nginx in Discourse7.5 HighdiscourseBitnamiAnonymous cache poisoning via XHR requests in Discourse8.2 HighdiscourseBitnamiCross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse6.5 MediumdiscourseBitnamiDenial of service by the absence of restrictions on replies to posts in Discourse7.5 HighdiscourseBitnamiPrevent topic list filtering by hidden tags for unauthorized users in Discourse5.3 MediumdiscourseBitnamiBypass of email address validation via encoded email addresses in Discourse8.2 HighdiscourseBitnamiDiscourse allows iframe injection though default site setting6.1 MediumdiscourseBitnamiDiscourse vulnerable to DoS via Tag Group4.9 MediumdiscourseBitnamiDiscourse has an XSS via Onebox system6.3 MediumdiscourseBitnamiDenial of service via Watched Words in Discourse4.9 MediumdiscourseBitnamiDiscourse vulnerable to Server-Side Request Forgery via FastImage6.4 MediumdiscourseBitnamiDiscourse doesn't limit reviewable user serializer payload2.4 LowdiscourseBitnamiDiscourse missing authorization checks for suspending admins/moderators4.9 MediumdiscourseBitnamiDiscourse vulnerable to stored-dom XSS via Facebook Oneboxes4.2 MediumdiscourseBitnamiDiscourse vulnerable to DoS through Onebox7.5 HighdiscourseBitnamiDenial of service through invites in Discourse6.5 MediumdiscourseBitnamiDenial of service via Staff Actions in Discourse6.5 MediumdiscourseBitnamiDisclosure of the existence of secret categories with custom backgrounds in Discourse5.3 MediumdiscourseBitnamiDisclosure of the existence of secret subcategories in Discourse5.3 MediumdiscourseBitnamiNo rate limits on POST /uploads endpoint in Discourse5.3 MediumdiscourseBitnamiDiscourse improperly sanitized user input leads to XSS6.3 MediumdiscourseBitnamiDiscourse secure uploads accessible to guests even when login is required3.1 LowdiscourseBitnamiInsufficient control of custom field value sizes4.3 MediumdiscourseBitnamiDiscourse vulnerable to unlimited mentioned users in message serializer8.6 HighdiscourseBitnamiDiscourse SSRF vulnerability in Embedding3.4 LowdiscourseBitnamiDiscourse DoS through Onebox favicon URL7.5 HighdiscourseBitnamiHTML injection in oneboxed links5.3 MediumdiscourseBitnamiBypassing height value allowed in some theme components4.3 MediumdiscourseBitnamiUnread bookmark reminder notifications that the user cannot access can be seen3.3 LowdiscourseBitnamiDiscourse vulnerable to DoS via Regexp Injection in Full Name4.3 MediumdiscourseBitnamiUnauthenticated access to new private chat messages in Discourse7.5 HighdiscourseBitnamiPrevent unauthorized access to summary details in Discourse5.3 MediumdiscourseBitnamiMalicious requests can fill up the log files resulting in a deinal of service in Discourse7.5 HighdiscourseBitnamiExposure of poll options and votes to unauthorized users in Discourse3.7 LowdiscourseBitnamiCross-site Scripting via email preview when CSP disabled in Discourse8.0 HighdiscourseBitnamiArbitrary keys can be added to a topic's custom fields by any user in Discourse4.9 MediumdiscourseBitnamiDiscourse DoS via SvgSprite cache6.5 MediumdiscourseBitnamiDiscourse DoS via remote theme assets4.9 Medium- Show moreLoading…