EDX Open edX 跨站脚本漏洞

EDX Open edX is an online learning management system from EDX Corporation, USA. A security vulnerability exists in EDX Open edX versions prior to 2022-06-06. The vulnerability is exploited to conduct a cross-site scripting attack via the "next" parameter in the deregistration URL...

CVE-2021-39248

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion...

CVE-2021-39248

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion...

CVE-2021-39248

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion...

Design/Logic Flaw

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion...

CVE-2021-39248

Open edX Open edX platform (Lilac.1) is affected by a cross-site scripting (XSS) vulnerability in common/static/common/js/discussion/utils.js triggered by crafted LaTeX content within a discussion. Root cause is improper handling/validation of LaTeX content in discussion posts, allowing injected ...

CVE-2021-39248

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion...

EDX Open edX 跨站脚本漏洞

EDX Open edX is an online learning management system from the U.S.-based edX EDX. Open edX suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side co...

Open edX Input Validation Error Vulnerability

Open edX is an online learning management system from edX Corporation in the United States. An input validation error vulnerability exists in Studio in Open edX Ironwood version 2.5, which can be exploited by an attacker to execute arbitrary code...

Open edX cross-site scripting vulnerability (CNVD-2020-33666)

Open edX is an online learning management system from edX Corporation in the United States. A cross-site scripting vulnerability exists in Studio in Open edX Ironwood version 2.5, which stems from the lack of proper validation of client-side data in the WEB application and can be exploited by an...

Open edX injection vulnerability (CNVD-2020-33667)

Open edX is an online learning management system from edX Corporation in the United States. An injection vulnerability exists in Studio in Open edX Ironwood version 2.5, which can be exploited by attackers to execute arbitrary code with the help of specially crafted files...

CVE-2020-13145

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

CVE-2020-13144

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem buttonAdvanced tabCustom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code...

CVE-2020-13145

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

CVE-2020-13146

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

CVE-2020-13144

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem buttonAdvanced tabCustom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code...

CVE-2020-13146

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

Code injection

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem buttonAdvanced tabCustom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code...

Input validation

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

Cross site scripting

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...