CVE-2024-53266

MEDIUM Year: 2024
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-79
View all →

Vulnerability Description

Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to upgrade. Users unable to upgrade should ensure CSP is enabled.

Related Vulnerabilities

CVE-2010-3243

MEDIUM
CVSS:4.3(Medium)

Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint...

CWE-792010

CVE-2016-7823

MEDIUM
CVSS:4.3(Medium)

Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-792016

CVE-2018-1136

MEDIUM
CVSS:4.3(Medium)

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is ...

CWE-792018

CVE-2018-21095

MEDIUM
CVSS:4.3(Medium)

Certain NETGEAR devices are affected by stored XSS. This affects SRR60 before 2.2.1.210 and SRS60 before 2.2.1.210.

CWE-792018

CVE-2018-5172

MEDIUM
CVSS:4.3(Medium)

The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site ...

CWE-792018

CVE-2018-6051

MEDIUM
CVSS:4.3(Medium)

XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a cra...

CWE-792018