194 matches found
CVE-2020-13145
CVE-2020-13145 affects Open edX Studio (Ironwood 2.5). The vulnerability arises from allowing SVG file uploads via the Content > File Uploads screen, where uploaded SVGs can contain JavaScript and trigger Stored XSS. Multiple connected sources corroborate the same description, noting lack of p...
CVE-2020-13145
Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...
CVE-2020-13146
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...
CVE-2020-13146
Open edX Ironwood 2.5 Studio is affected by a CSV injection vulnerability. The issue arises when an added cohort in Course > Instructor > Cohorts may contain a formula that is exported through Course > Data Downloads > Reports > Download profile info, allowing injection in exported...
CVE-2020-13144
Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem buttonAdvanced tabCustom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code...
CVE-2020-13144
CVE-2020-13144 affects Open edX Ironwood 2.5 Studio. When CodeJail is not enforced, an authenticated user can navigate to Create New course > New section > New subsection > New unit > Add new component > Problem > Advanced > Custom Python evaluated code, edit a problem and ex...
CVE-2019-20513
Open edX Ironwood.1 allows support/certificates?user= reflected XSS...
CVE-2019-20513
Open edX Ironwood.1 allows support/certificates?user= reflected XSS...
Cross site scripting
Open edX Ironwood.1 allows support/certificates?user= reflected XSS...
CVE-2019-20513
Open edX Ironwood.1 allows support/certificates?user= reflected XSS...
CVE-2019-20513
Open edX Ironwood.1 is affected by a reflected XSS in the certificates flow, triggered by the parameter user in the URL (…?user=…). The issue arises from insufficient input validation in the web application, allowing an attacker-supplied payload to be reflected in the client context. Impact is sc...
CVE-2019-20512
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
CVE-2019-20512
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
Cross site scripting
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
CVE-2019-20512
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
CVE-2019-20512
The CVE-2019-20512 entry concerns Open edX Ironwood.1, where a reflected XSS flaw is triggered via the course_id parameter in the support/certificates flow. The affected component appears to be the web application handling course resources in Open edX Ironwood.1; the root cause is input from a us...
Open edX platform security feature issue vulnerability
The Open edX platform is an open source course management system CMS. The system can be used for MOOCs Massive Open Online Courses as well as smaller courses and training modules. A security feature issue vulnerability exists in the installation process in versions of Open edX prior to 2017-01-10...
Open edX platform cross-site scripting vulnerability
The Open edX platform is an open source course management system CMS. The system can be used for MOOCs Massive Open Online Courses as well as smaller courses and training modules. A cross-site scripting vulnerability exists in versions of Open edX platform prior to 2018-07-18. The vulnerability...