CVE-2015-1481

CVE-2015-1481 affects Ansible Tower (aka Ansible UI) prior to 2.0.5. The described vulnerability allows remote organization administrators to gain privileges by creating a superuser account. This mode of privilege escalation is documented in multiple connected sources referencing the same issue. ...

CVE-2015-1482

Ansible Tower (aka Ansible UI) before 2.0.5 is vulnerable to an authentication bypass via a websocket connection to socket.io/1/, enabling remote attackers to obtain sensitive information. Root cause: missing/weak auth on the Socket.IO endpoint. Affected product and version: Ansible Tower prior t...

CVE-2015-1481: Undefined Security Weakness

Ansible Tower aka Ansible UI before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account...

CVE-2015-1368: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...