Rafael dos Santos Silva

3 exploits Active since Nov 2021
CVE-2021-41271 WRITEUP MEDIUM WRITEUP
Discourse < 2.7.9 - Exposure of Sensitive Information via Error Response Caching
Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.
CVSS 4.8
CVE-2021-43794 WRITEUP MEDIUM WRITEUP
Discourse < 2.7.11 - Cache Poisoning Denial of Service for Anonymous Users
Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.
CVSS 5.3
CVE-2024-54142 WRITEUP CRITICAL WRITEUP
discourse-ai - Cross-Site Scripting via Shared Bot Conversation HTML Entities
Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations into posts, if the conversation had HTML entities those could leak into the Discourse application when a user visited a post with a onebox to said conversation. This issue has been addressed in commit `92f122c`. Users are advised to update. Users unable to update may remove all groups from `ai bot public sharing allowed groups` site setting.
CVSS 9.0