Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tion setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-496x-2jqf-hp7g - https://github.com/kiwitcms/Kiwi/commit/3759fb68aed36315cdde9fc573b2fe7c11544985 - https://huntr.dev/bounties/32a873c8-f605-4aae-9272-d80985ef2b73
CVE ID: CVE-2023-22452 State: PUBLISHED Published: 2023-01-02T19:17:59.571Z Last Updated: 2025-03-10T21:33:37.198Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Kenny2github Products: kenny2automate Problem Types: CWE-20 Description: kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could chan
ho has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kenny2github/kenny2automate/security/advisories/GHSA-73j8-xrcr-q6j7 - https://github.com/Kenny2github/ken
s://github.com/Kenny2github/kenny2automate/security/advisories/GHSA-73j8-xrcr-q6j7 - https://github.com/Kenny2github/kenny2automate/commit/a947d7ce408687b587c7e6dfd6026f7c4ee31ac2
CVE ID: CVE-2023-22453 State: PUBLISHED Published: 2023-01-05T19:53:34.180Z Last Updated: 2025-03-10T21:31:52.286Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, the number of times a user posted in an arbitrary topic is exposed to unauthorized users through the `/u/username.json` endpoint. The issue is patched in version 2.8.14 and 3.0.0.beta16. There is no known workaround. Additional Analyst Notes: - CVE Program Container: - C
in version 2.8.14 and 3.0.0.beta16. There is no known workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-xx97-6494-p2rv - https://github.com/discourse/discourse/commit/cbcf8a064b4889a19c991641e09c399bfa1ef2ad
CVE ID: CVE-2023-22454 State: PUBLISHED Published: 2023-01-05T19:58:36.355Z Last Updated: 2025-03-10T21:31:46.858Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has the "require moderator approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or d
tor approval of all new topics" setting set. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. A patch is available in versions 2.8.14 and 3.0.0.beta16. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-ggq4-4qxc-c462 - https://github.com/discourse/discourse/commit/c0e2d7badac276d82a4056a994b48d68a8993a12
CVE ID: CVE-2023-22455 State: PUBLISHED Published: 2023-01-05T20:02:40.608Z Last Updated: 2025-03-10T21:31:40.480Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, tag descriptions, which can be updated by moderators, can be used for cross-site scripting attacks. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a p
hich have modified or disabled Discourse’s default Content Security Policy. Versions 2.8.14 and 3.0.0.beta16 contain a patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-5rq6-466r-6mr9 - https://github.com/discourse/discourse/commit/692329896ac64d8581947e977202c243eef3b5a2
CVE ID: CVE-2023-22456 State: PUBLISHED Published: 2023-01-03T18:29:51.262Z Last Updated: 2025-03-10T21:33:20.040Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: viewvc Products: viewvc Problem Types: CWE-79 Description: ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 and 1.1.29. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream,
sted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.2 (if they are using a 1.2.x version of ViewVC) or 1.1.29 (if they are using a 1.1.x version). ViewVC 1.0.x is no longer supported, so users of that release lineage should implement a workaround. Users can edit their ViewVC EZT view templates to manually HTML-escape changed paths during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`. For mos
e set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`. For most users, that means that references to `[changes.path]` will become `[format "html"][changes.path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else changed path names will be doubly escaped.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/viewvc/viewvc/security/advisories/GHSA-j4mx-f97j-gc5g - https://github.com/viewvc/viewvc/issues/311 - https://github.com/viewvc/viewvc/releases/tag/1.1.29 - https://github.com/viewvc/viewvc/releases/tag/1.2.2
CVE ID: CVE-2023-22457 State: PUBLISHED Published: 2023-01-04T14:24:39.871Z Last Updated: 2025-03-10T21:33:09.143Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki-contrib Products: application-ckeditor Problem Types: CWE-352 Description: CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a
ming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
the CKEditor integration to a fixed version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki-contrib/application-ckeditor/security/advisories/GHSA-6mjp-2rm6-9g85 - https://github.com/xwiki-contrib/application-ckeditor/commit/6b1053164386aefc526df7512bc664918aa6849b - https://jira.xwiki.org/browse/CKEDITOR-475
CVE ID: CVE-2023-22458 State: PUBLISHED Published: 2023-01-20T18:19:24.166Z Last Updated: 2025-03-10T21:21:32.072Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-190 Description: Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerab
rsions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprj - https://github.com/redis/redis/commit/16f408b1a0121cacd44cbf8aee275d69dc627f02 - https://github.com/redis/redis/releases/tag/6.2.9 - https://github.com/redis/redis/releases/tag/7.0.8
CVE ID: CVE-2023-22460 State: PUBLISHED Published: 2023-01-04T14:53:19.877Z Last Updated: 2025-03-11T13:34:55.463Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ipld Products: go-ipld-prime Problem Types: CWE-20 Description: go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be
as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes. This only impacts uses of the `json` codec. `dag-json` is not impacted. Use of `json` as a decoder is not impacted. This issue is fixed in v0.19.0. As a workaround, one may prefer the `dag-json` codec, which has the ability to encode bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92 - https://github.com/ipld/go-ipld-prime/pull/472 - https://github.com/ipld/go-ipld-prime/releases/tag/v0.19.0
CVE ID: CVE-2023-22461 State: PUBLISHED Published: 2023-01-04T14:57:04.902Z Last Updated: 2025-03-10T21:33:03.572Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: mattkrick Products: sanitize-svg Problem Types: CWE-79, CWE-80 Description: The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed i
vg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mattkrick/sanitize-svg/security/advisories/GHSA-h857-2g56-468g - https://github.com/mattkrick/sanitize-svg/commit/b107e453ede7b58adcccae74a3e474c012eec85d
CVE ID: CVE-2023-22462 State: PUBLISHED Published: 2023-03-02T00:06:59.876Z Last Updated: 2025-02-13T16:43:52.162Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: grafana Products: grafana Problem Types: CWE-79 Description: Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle
rability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4. Additional Analyst Notes: - C
JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjf - https://github.com/grafana/grafana/commit/db83d5f398caffe35c5846cfa7727d1a2a414165 - https://grafana.com/blog/2023/02/28/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-0594-cve-2023-0507-and-cve-2023-22462/ - https://security.netapp.com/advisory/ntap-20230413-0004/
CVE ID: CVE-2023-22463 State: PUBLISHED Published: 2023-01-04T15:04:18.195Z Last Updated: 2025-03-10T21:32:56.890Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: KubeOperator Products: KubePi Problem Types: CWE-798 Description: KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, al
e administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/KubeOperator/KubePi/security/advisories/GHSA-vjhf-8vqx-vqpq - https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fc
i/security/advisories/GHSA-vjhf-8vqx-vqpq - https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b - https://github.com/KubeOperator/KubePi/blob/da784f5532ea2495b92708cacb32703bff3a45a3/internal/api/v1/session/session.go#L35 - https://github.com/KubeOperator/KubePi/releases/tag/v1.6.3
CVE ID: CVE-2023-22464 State: PUBLISHED Published: 2023-01-04T15:12:50.980Z Last Updated: 2025-03-10T21:32:51.391Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: viewvc Products: viewvc Problem Types: CWE-80, CWE-79 Description: ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, wou
ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.3 (if they are using a 1.2.x version of ViewVC) or 1.1.30 (if they are using a 1.1.x version). ViewVC 1.0.x is no longer supported, so users of that release lineage should implement one of the following workarounds. Users can edit their ViewVC EZT view templates to manually HTML-escape changed path "copyfrom paths" during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[form
endering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`. For most users, that means that references to `[changes.copy_path]` will become `[format "html"][changes.copy_path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else "copyfrom path" names will be doubly escaped.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/viewvc/viewvc/security/advisories/GHSA-jvpj-293q-q53h - https://github.com/viewvc/viewvc/issues/311 - https://github.com/viewvc/viewvc/releases/tag/1.1.30 - https://github.com/viewvc/view
hub.com/viewvc/viewvc/issues/311 - https://github.com/viewvc/viewvc/releases/tag/1.1.30 - https://github.com/viewvc/viewvc/releases/tag/1.2.3
CVE ID: CVE-2023-22465 State: PUBLISHED Published: 2023-01-04T15:30:04.129Z Last Updated: 2025-03-10T21:32:44.734Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: http4s Products: http4s Problem Types: CWE-20 Description: Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use t
itly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f
CVE ID: CVE-2023-22466 State: PUBLISHED Published: 2023-01-04T21:47:09.400Z Last Updated: 2025-03-10T21:32:32.950Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: tokio-rs Products: tokio Problem Types: CWE-665 Description: Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associa
e`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7 - https://github.com/tokio-rs/tok
eferences: - https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7 - https://github.com/tokio-rs/tokio/pull/5336 - https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1 - https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients
CVE ID: CVE-2023-22467 State: PUBLISHED Published: 2023-01-04T21:52:14.329Z Last Updated: 2025-02-13T16:43:52.699Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: moment Products: luxon Problem Types: CWE-1333 Description: Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears
ers. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc - https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g - https://github.com/moment/moment/pull/6015#issuecomment-1152961973 - https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf - https://lists.fedoraproject.org/archives/list/package-announce@lists.fed
mmit/5ab3bf64a10da929a437629cdb2f059bb83212bf - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LIVOASKBQH7FEUI5RWM3SOHR6VK7ZZR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44I3WAJKYXDLOVYRGMHAUXMIV4SPFXDZ/
CVE ID: CVE-2023-22468 State: PUBLISHED Published: 2023-01-26T08:31:00.485Z Last Updated: 2025-03-10T21:19:31.635Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests-passed), are vulnerable to cross-site Scripting. A maliciously crafted URL can be included in a post to carry out cross-site scripting attacks on sites with disabled or overly permissive CSP (Content Security Policy). Discourse's default CSP prevents this vulnerability. This vulnerability is patche