CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32764 – YouTube Onebox susceptible to XSS
https://notcve.org/view.php?id=CVE-2021-32764
Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks. • https://github.com/discourse/discourse/security/advisories/GHSA-9x4c-29xg-56hw • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 2EXPL: 2CVE-2021-3138 – Discourse 2.7.0 2FA Bypass
https://notcve.org/view.php?id=CVE-2021-3138
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. En Discourse versiones 2.7.0 hasta beta1, una omisión del límite de velocidad conlleva a una omisión del requisito de 2FA para determinadas formularios Discourse version 2.7.0 suffers from a 2FA bypass via a rate limiting bypass vulnerability. • https://github.com/Mesh3l911/CVE-2021-3138 http://packetstormsecurity.com/files/162256/Discourse-2.7.0-2FA-Bypass.html https://github.com/Mesh3l911/Disource https://github.com/discourse/discourse/releases • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15515
https://notcve.org/view.php?id=CVE-2019-15515
Discourse 2.3.2 sends the CSRF token in the query string. Discourse 2.3.2 envía el token CSRF en la cadena de consulta. • https://github.com/discourse/discourse/pull/8026 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1020018
https://notcve.org/view.php?id=CVE-2019-1020018
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link. Discourse en versiones anteriores a la 2.3.0 y 2.4.x en versiones anteriores a la 2.4.0.beta3 carece de una pantalla de confirmación cuando se inicia sesión mediante un enlace de correo electrónico. • https://github.com/discourse/discourse/commit/52387be4a44cdeaca5421ee955ba1343e836bade https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-1020017
https://notcve.org/view.php?id=CVE-2019-1020017
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP. Discourse en versiones anteriores a la 2.3.0 y 2.4.x en versiones anteriores a la 2.4.0.beta3, carece de una pantalla de confirmación cuando se inicia sesión mediante un usuario de la api OTP. • https://github.com/discourse/discourse/commit/b8340c6c8e50a71ff1bca9654b9126ca5a84ce9a https://github.com/discourse/discourse/commit/e6e47f2fb22764c92aaa90445c7bf203192fba11 •