Discourse Security Problems

Integer Overflow
	/c/-2147483648	GET /c/-2147483648
	/c/-2147483649	GET /c/-2147483649
	/c/4294967295	GET /c/4294967295
	/login/	POST /login/ [username=Joey password=vega redirect=2147483647 ]
	/login/	POST /login/ [username=4294967295 password=vega redirect=1 ]

Page Fingerprint Differential Detected - Possible Local File Include
	/google.com/search	GET /google.com/search?\"q\"=/./
	/latest	GET /latest?no_definitions=/./&page=1
	/latest	GET /latest?no_definitions=true&page=/./
	/login/	POST /login/ [username=Joey password=vega redirect=/./ ]
	/login/	POST /login/ [username=/./ password=vega redirect=1 ]
	/site_customizations/	GET /site_customizations/?target=desktop&v=06d23e99cfef901308bedefb5d78d9e1&__ws=/./
	/site_customizations	GET /site_customizations/?target=/./&v=06d23e99cfef901308bedefb5d78d9e1&__ws=www.[...].pl
	/site_customizations/	GET /site_customizations/?target=desktop&v=/./&__ws=www.[...].pl

Page Fingerprint Differential Detected - Possible XPath Injection
	/latest	GET /latest?no_definitions=true&page=e"%20or%201%20eq%201%20or%20"a"%20=%20"a
		<!DOCTYPE html>
			<html lang="pl_PL" class="desktop-view not-mobile-device  anon">
				<head>
					<meta charset="utf-8">
					<title>[...]</title>
					<meta name="description" content="[...]">
					<meta name="author" content="">
		<meta name="generator" content="Discourse 1.7.0.beta2 - https://github.com/discourse/discourse version 04...

Possible Social Insurance Number Detected
	/google.com/search GET /google.com/search?\"q\"=1"%20src=-->">'>'"
		107374183
		107374183
	/latest	GET /latest?no_definitions=true&page=1"%20onMouseOver=-->">'>'"
		107374183
		107374183
	/login/	POST /login/ [username=Joey AND 1=2 -- password=vega redirect=1 ]
		107374183
	/site_customizations/	GET /site_customizations/?target=desktop&v=06d23e99cfef901308bedefb5d78d9e1&__ws=/./
		107374183
		107374183
	/user_avatar/	GET /user_avatar/
		107374183
		107374183
	/users/admins/	GET /users/admins/
		107374183
		107374183
	/users/Admins/	GET /users/Admins/
		107374183
		107374183
	/users/system	GET /users/system
		107374183

Possible Social Security Number Detected
	GET /t/o-kategorii-bazy-danych/30/2147483648
		107374183

Session Cookie Without Secure Flag
	/login	GET /login
		_forum_session=M2JvOXE2OUM2UnlmZjdyWUVOa044czU5V2VIV1czdjVSb0xMZG9uTDVpVXFteEk3dnR6WExDYzRYNXUzWmFvdkN1RlUyRkdYV3RnSXpuQVVPODlZMkE9PS0tMU5FbTBlOVd0OWduOFdubFlzWUhVdz09--e36a81993a9d4a21c5797e15773a61cd052d4740; path=/; HttpOnly


Shell Injection
	/latest	GET /latest?no_definitions=true&page=1'true'
	/login/	POST /login/ [username=Joey password=vega"`true`" redirect=1 ]
	/login/	POST /login/ [username=Joey"`true`" password=vega redirect=1 ]
	/site_customizations/	GET /site_customizations/?target=desktop&v=06d23e99cfef901308bedefb5d78d9e1&__ws=www.[...].pl`true`
	/site_customizations/	GET /site_customizations/?target=desktop&v=06d23e99cfef901308bedefb5d78d9e1&__ws=www.[...].pl'true'

SQL Injection
	https://www.[...].pl/google.com/search	GET /google.com/search?q=1'"
	https://www.[...].pl/google.com/search	GET /google.com/search?\"q\"='%20AND%201=2%20--%20
	https://www.[...].pl/latest	GET /latest?no_definitions=true&page=1-0
	https://www.[...].pl/latest	GET /latest?no_definitions=true'"&page=1
	https://www.[...].pl/login	POST /login/ [username=Joey password=vega' AND 1=2 -- redirect=1 ]
		<html><body>You are being <a href="https://www.[...].pl1">redirected</a>.</body></html>
	https://www.[...].pl/login
		<html><body>You are being <a href="https://www.[...].pl1">redirected</a>.</body></html>
	https://www.[...].pl/login	POST /login/ [username=Joey password=vega redirect=1" AND 1=2 -- ]
	https://www.[...].pl/site_customizations	GET /site_customizations/?target=desktop&v='%20AND%201=2%20--%20&__ws=www.[...].pl
	https://www.[...].pl/site_customizations	GET /site_customizations/?target=desktop'"&v=06d23e99cfef901308bedefb5d78d9e1&__ws=www.[...].pl
	https://www.[...].pl/site_customizations	GET /site_customizations/?target=desktop&v=06d23e99cfef901308bedefb5d78d9e1&__ws=1%20AND%201=2%20--%20
		<!DOCTYPE html>
			<html lang="pl_PL">
				<head>
					<meta charset="utf-8">
					<title>[...]</title>
					<meta name="description" content="">
					<meta name="author" content="">
		<meta name="generator" content="Discourse 1.7.0.beta2 - https://github.com/discourse/discourse version 04331638661e5a67a1b431b3e74ead70a9c0db23">
		<link rel="icon" type="image/png" href="/uploads/default/original/1X...

Local Filesystem Paths Found
	/latest.rss	GET /latest.rss

Possible XML Injection
	/google.com/search?q=vega>'>"><vega></vega>	GET /google.com/search?q=vega>'>">
	/latest?no_definitions=true&page=vega>'>"><vega></vega>	GET /latest?no_definitions=true&page=vega>'>">
	/latest?no_definitions=vega>'>"><vega></vega>&page=1	GET /latest?no_definitions=vega>'>">&page=1
	/login/	POST /login/ [username=Joey password=vega>'>"> redirect=1 ]
	/login/	POST /login/ [username=vega>'>"> password=vega redirect=1 ]

Character Set Not Specified
	/assets/	GET /assets/
		/assets/

Possible AJAX code detected
	/assets/ember_jquery-c9524b48466ee05bcf3f9ddaf05405387eb17017e61e90e76628f989db37eb4e.js
		\s*$/g;oe.extend({htmlPrefilter:function(e){return e.replace(Be,"<$1></$2>")},clone:function(e,t,r){var n,i,o,a,s=e.cloneNode(!0),u=oe.contains(e.ownerDocument,e);if(!(ne.noCloneChecked||1!==e.nodeTy...

X-Frame-Options Header Not Set
	/assets/	GET /assets/
		/assets/