Page 19 of 125 results (0.009 seconds)

CVSS: 9.1EPSS: 1%CPEs: 10EXPL: 0

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds. Discourse es una plataforma de debate de código abierto. • https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835 https://github.com/discourse/discourse/pull/18421 https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmv • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0

Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate. Discourse versiones hasta 2.8.7, permite a administradores enviar invitaciones a direcciones de correo electrónico arbitrarias a un ritmo ilimitado • https://github.com/discourse/discourse/security/advisories/GHSA-q2rg-m477-8wg7 https://github.com/discourse/discourse/tags https://www.enisa.europa.eu/topics/threat-risk-management/vulnerability-disclosure •

CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0

Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email. • https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0 https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrf • CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error responses to be cached by Discourse's default NGINX proxy configuration. A corrected NGINX configuration is included in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/discourse/discourse/commit/7af25544c3940c4d046c51f4cfac9c72a06d4f50 https://github.com/discourse/discourse/security/advisories/GHSA-4ff8-3j78-w6pp • CWE-404: Improper Resource Shutdown or Release •

CVSS: 5.7EPSS: 0%CPEs: 6EXPL: 0

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite has been configured to add the user that accepts the invite into restricted groups. Once a user has been incorrectly added to a restricted group, the user may then be able to view content which that are restricted to the respective group. Users are advised to upgrade to the current stable releases. • https://github.com/discourse/discourse/security/advisories/GHSA-rvp8-459h-282r • CWE-281: Improper Preservation of Permissions •