Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331 results · page 7 of 7
Apr 11, 2022Discourse is an open source platform for community discussion.CVE-2022-24804 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permissions setting.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022Discourse is an open source discussion platform.CVE-2022-24782 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the `main` branch of Discourse's GitHub repository and is anticipated to be part of future releases.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Discourse is an open source discussion platform.CVE-2022-23641 · Other software · discourse · reported by GitHubMedium 6.5
Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.beta2 of the `tests-passed` branch. As a workaround, disable onebox in admin panel completely or specify allow list of domains that will be oneboxed.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022Nimforum is a lightweight alternative to Discourse written in Nim.CVE-2022-23602 · Other software · Nim-lang · reported by GitHubHigh 7.7
Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum's post "preview" endpoint. Even if NimForum is running as a non-critical user, the forum.json secrets can be stolen. Version 2.2.0 of NimForum includes patches for this vulnerability. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
- Product
- Docutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022Discourse is an open source discussion platform.CVE-2022-21677 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a group's visibility and the group's members visibility can be configured such that it is restricted to logged on users, members of the group or staff users. A vulnerability has been discovered in versions prior to 2.7.13 and 2.8.0.beta11 where the group advanced search option does not respect the group's visibility and members visibility level. As such, a group with restricted visibility or members visibility can be revealed through search with the right search option. This issue is patched in `stable` version 2.7.13, `beta` version 2.8.0.beta11, and `tests-passed` version 2.8.0.beta11 versions of Discourse. There are no workarounds aside from upgrading.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Discourse is an open source discussion platform.CVE-2022-21684 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with `must_approve_users` enabled is going to be automatically logged in, bypassing the check that does not allow unapproved users to sign in. They will be able to do everything an approved user can do. If they logout, they cannot log back in. This issue is patched in the `stable` version 2.7.13, `beta` version 2.8.0.beta11, and `tests-passed` version 2.8.0.beta11. One may disable invites as a workaround. Administrators can increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Discourse is an open source discussion platform.CVE-2022-21678 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2022Discourse is an open source platform for community discussion.CVE-2022-21642 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022Discourse is an open source platform for community discussion.CVE-2021-43850 · Other software · discourse · reported by GitHubMedium 6.8
Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_diagnostics` path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the `/message-bus/_diagnostics` path. The problem has been patched. Please upgrade to 2.8.0.beta10 or 2.7.12. No workarounds for this issue exist.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021message_bus is a messaging bus for Ruby processes and web clients.CVE-2021-43840 · Other software · discourse · reported by GitHubMedium 4.4
message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. This issue has been patched in version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.
- Product
- message_bus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021discourse-footnote is a library providing footnotes for posts in Discourse.CVE-2021-43827 · Other software · discourse · reported by GitHubMedium 4.3
discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.
- Product
- discourse-footnote
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021Discourse is an open source discussion platform.CVE-2021-43794 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021Discourse is an open source discussion platform.CVE-2021-43793 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021Discourse is an open source discussion platform.CVE-2021-43792 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021Discourse is a platform for community discussion.CVE-2021-41271 · Other software · discourse · reported by GitHubMedium 4.8
Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021rails_multisite provides multi-db support for Rails applications.CVE-2021-41263 · Other software · discourse · reported by GitHubHigh 8.3
rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application. The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.
- Product
- rails_multisite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Discourse is an open source platform for community discussion.CVE-2021-41163 · Other software · discourse · reported by GitHubCritical 10
Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. To workaround the issue without updating, requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post.CVE-2021-41140 · Other software · discourse · reported by GitHubMedium 5.3
Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.
- Product
- discourse-reactions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021Discourse is an open source discussion platform.CVE-2021-41095 · Other software · discourse · reported by GitHubMedium 4.2
Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `tests-passed` branch. Rendering of some error messages that contain user input can be susceptible to XSS attacks. This vulnerability only affects sites which have blocked watched words that contain HTML tags, modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. As a workaround, avoid modifying or disabling Discourse’s default Content Security Policy, and blocking watched words containing HTML tags.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function.CVE-2020-24327 · Other software · Discourse · reported by MITREMedium 5.3
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2021Discourse is a platform for community discussion.CVE-2021-41082 · Other software · discourse · reported by GitHubHigh 7.5
Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021Discourse is an open source platform for community discussion.CVE-2021-39161 · Other software · discourse · reported by GitHubMedium 4.4
Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021Discourse is an open-source platform for community discussion.CVE-2021-37703 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2021Discourse is an open-source platform for community discussion.CVE-2021-37693 · Other software · discourse · reported by GitHubMedium 5.3
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021Discourse is an open source discussion platform.CVE-2021-37633 · Other software · discourse · reported by GitHubHigh 7.4
Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable` 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2021Discourse is an open source discussion platform.CVE-2021-32788 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2021Discourse is an open-source discussion platform.CVE-2021-32764 · Other software · discourse · reported by GitHubHigh 8.1
Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6, `beta` version 2.8.0.beta3, and `tests-passed` version 2.8.0.beta3. As a workaround, ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2021In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.CVE-2021-3138 · Other software · Discourse · reported by MITREHigh 7.5
In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 26, 2019Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-15515 · Other software · Discourse · reported by MITREMedium 6.5
Discourse 2.3.2 sends the CSRF token in the query string.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2019Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.CVE-2019-1020018 · Other software · Discourse · reported by josh@bress.netHigh 7.3
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2019Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.CVE-2019-1020017 · Other software · Discourse · reported by josh@bress.netMedium 5.3
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.
- Product
- Discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.