0-0Eth0

**Name of the Vulnerable Software and Affected Versions** Discourse Calendar versions prior to 0.4 **Description** The issue allows event invitees created in private categories or private messages to be retrieved by anyone, even if they are not logged in. This is a problem with the Discourse Calendar plugin for the open-source discussion platform Discourse. There is no known workaround, but putting the site behind `login required` can disallow the use of this endpoint by anonymous users. However, logged-in users can still get the list of invitees in private topics. **Recommendations** For versions prior to 0.4, update to version 0.4 of the discourse-calendar plugin to resolve the issue. As a temporary workaround, consider putting the site behind `login required` to disallow the use of the vulnerable endpoint by anonymous users.

**Name of the Vulnerable Software and Affected Versions** Discourse Calendar (affected versions not specified) **Description** The issue allows uninvited users to gain access to private events by crafting a request to update their attendance. This is related to the dynamic calendar feature in the first post of a topic on Discourse. **Recommendations** As a temporary workaround, consider using post visibility to limit access until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 3.1.3 Discourse versions prior to 3.2.0.beta3 **Description** Discourse is an open source platform for community discussion. The issue affects the availability of subsequent replies in a topic when users can add svgs with unlimited `height` attributes. This is possible in some theme components, specifically the svgbob or the mermaid theme component. Most Discourse instances are unaffected. **Recommendations** For versions prior to 3.1.3, update to version 3.1.3 or later. For versions prior to 3.2.0.beta3, update to version 3.2.0.beta3 or later. As a temporary workaround, consider disabling or removing the relevant theme components, specifically the svgbob or the mermaid theme component.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 3.0.4 Discourse versions prior to 3.1.0.beta5 **Description** The issue is related to the lack of restrictions on the iFrame tag, which makes it easy for an attacker to exploit and hide subsequent comments from other users. **Recommendations** For versions prior to 3.0.4, update to version 3.0.4 or later. For versions prior to 3.1.0.beta5, update to version 3.1.0.beta5 or later.

**Name of the Vulnerable Software and Affected Versions** Discourse Mermaid (discourse-mermaid-theme-component) version 1.0.0 **Description** The issue allows users who can create posts to inject arbitrary HTML on that post, using the Mermaid syntax in Discourse, open-source forum software. **Recommendations** For version 1.0.0, update the theme component to version 1.1.0 through the admin UI to resolve the issue. As a temporary workaround, consider disabling the discourse-mermaid-theme-component until the update is applied.