Vulnerabilidades em discourse

323 resultados
Análise Vexday

Com 278 CVEs catalogadas e nenhuma entrada confirmada no catálogo KEV da CISA, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão de ameaças imediatas em comparação ao universo típico de produtos monitorados. Ainda assim, 31 vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descobertas recentes que exige acompanhamento contínuo. A falha mais prevalente é CWE-200 (exposição de informações sensíveis), padrão que tende a se manifestar em plataformas de comunicação e pode facilitar reconhecimento por parte de atacantes. A CVE mais perigosa ativa atualmente é CVE-2024-53991, com escore EPSS de 0,2543 — o mais alto observado no conjunto —, e entre as cinco vulnerabilidades críticas catalogadas quatro já contam com prova de conceito pública, o que eleva o risco de exploração para equipes que ainda não aplicaram as correções correspondentes.

CVE-2024-37299MEDIUMDiscourse vulnerable to DoS via Tag GroupEPSS 0.6%CVE-2022-39378MEDIUMDisplaying user badges can leak topic titles to users that have no access to the topicEPSS 0.6%CVE-2024-24827MEDIUMNo rate limits on POST /uploads endpoint in DiscourseEPSS 0.6%CVE-2023-43658HIGHImproper escaping of user input in discourse-calendarEPSS 0.6%CVE-2024-35227HIGHDiscourse vulnerable to DoS through OneboxEPSS 0.6%CVE-2023-23624MEDIUMDiscourse's exclude_tags param could leak which topics had a specific hidden tagEPSS 0.6%CVE-2026-55674CRITICALDiscourse: Cache poisoning/XSS via color scheme cookiesEPSS 0.6%CVE-2022-46150MEDIUMDiscourse may allow exposure of hidden tags in the subject of notification emailsEPSS 0.6%CVE-2023-43657HIGHImproper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configurationEPSS 0.6%CVE-2026-72721MEDIUMDiscourse: Onebox Domain Blocklist Bypass via Case-Sensitive ComparisonEPSS 0.6%CVE-2021-41095MEDIUMXSS via blocked watched word in error messageEPSS 0.6%CVE-2022-31095MEDIUMExposure of Sensitive Information in discourse-chatEPSS 0.6%CVE-2023-28112MEDIUMDiscourse's SSRF protection missing for some FastImage requestsEPSS 0.6%CVE-2022-41921LOWDiscourse chat messages should have a maximum character limitEPSS 0.6%CVE-2024-27085MEDIUMDenial of service through invites in DiscourseEPSS 0.6%CVE-2022-46168LOWGroup SMTP user emails are exposed in CC email headerEPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2024-21655MEDIUMInsufficient control of custom field value sizesEPSS 0.6%CVE-2022-39385MEDIUMUsers erroneously and transparently added to private messages in DiscourseEPSS 0.6%CVE-2024-27100MEDIUMDenial of service via Staff Actions in DiscourseEPSS 0.6%