CVE-2026-109131

The Ansible Automation Platform UI (based on upstream ansible-ui ) is vulnerable to stored cross-site scripting (XSS) due to an unsafe handling of URL schemes in the Hub collection module documentation renderer. Specifically, the formatPartURL function in DocumentationParsers.tsx renders document...

CVE-2026-106033 Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2015-1482

Ansible Tower (aka Ansible UI) before 2.0.5 is vulnerable to an authentication bypass via a websocket connection to socket.io/1/, enabling remote attackers to obtain sensitive information. Root cause: missing/weak auth on the Socket.IO endpoint. Affected product and version: Ansible Tower prior t...

CVE-2015-1481

CVE-2015-1481 affects Ansible Tower (aka Ansible UI) prior to 2.0.5. The described vulnerability allows remote organization administrators to gain privileges by creating a superuser account. This mode of privilege escalation is documented in multiple connected sources referencing the same issue. ...

CVE-2015-1481: Undefined Security Weakness

Ansible Tower aka Ansible UI before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account...

CVE-2015-1368: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...