CVE-2021-43794

MEDIUM Year: 2021
CVSS v3 Score
5.3
Medium
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-610
View all →

Vulnerability Description

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Related Vulnerabilities

CVE-2018-12381

MEDIUM
CVSS:5.3(Medium)

Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. *Note: this issue only aff...

CWE-6102018

CVE-2021-26711

MEDIUM
CVSS:5.3(Medium)

A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/default.htm turl paramet...

CWE-6102021

CVE-2021-29965

MEDIUM
CVSS:5.3(Medium)

A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that ...

CWE-6102021

CVE-2022-43423

MEDIUM
CVSS:5.3(Medium)

Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able...

CWE-6102022

CVE-2022-43428

MEDIUM
CVSS:5.3(Medium)

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes ...

CWE-6102022

CVE-2018-12475

MEDIUM
CVSS:5.4(Medium)

A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against...

CWE-6102018