606 matches found
CVE-2015-1368
Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...
CVE-2015-1368
Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...
CVE-2015-1368
Ansible Tower (aka Ansible UI) prior to version 2.0.5 is affected by multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary script or HTML via input parameters in the API: (1) order_by to credentials/, (2) inventories/, (3) projects/, or (4) use...
SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower
SEC Consult Vulnerability Lab Security Advisory 20150113-1 ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.2 fixed version: =2.0.5 impact: high homepage:...
Ansible Tower 2.0.2 - Multiple Vulnerabilities
Ansible Tower versions 2.0.2 and below suffer from cross site scripting, privilege escalation, and missing vulnerabilities. ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version:...
Multiple Cross-Site Scripting Vulnerabilities in Ansible Tower
Ansible is simple configuration management, deployment, task execution, and multi-node authoring framework. Ansible Tower has multiple cross-site scripting vulnerabilities because it fails to properly filter user-supplied input. An attacker could potentially exploit these vulnerabilities to execu...
Ansible Tower 2.0.2 XSS / Privilege Escalation / Authentication Missing
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.5 impact: high homepage: http://www.ansible.com/tower found: 2014-10-1...
Ansible Tower 2.0.2 - Multiple Vulnerabilities
Ansible Tower 2.0.2 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.5 impact: high homepage...
Ansible Tower Authentication Bypass Vulnerability
Ansible is simple configuration management, deployment, task execution, and multi-node authoring framework. Ansible Tower suffers from an authentication bypass vulnerability that can be exploited by an attacker to bypass authentication mechanisms and obtain sensitive information...
Ansible Tower 'is_superuser' Parameter Remote Elevation of Privilege Vulnerability
Ansible is simple configuration management, deployment, task execution, and multi-node authoring framework. A remote elevation of privilege vulnerability exists in the Ansible Tower 'issuperuser' parameter, which can be exploited by an attacker to create a super administrator account and gain...
Ansible Tower 2.0.2 - Multiple Vulnerabilities
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.5 impact: high homepage: http://www.ansible.com/tower found: 2014-10-1...
CVE-2014-5818
The Tiny Tower aka com.mobage.ww.a560.tinytowerandroid application 1.7.0.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Information disclosure
The Tiny Tower aka com.mobage.ww.a560.tinytowerandroid application 1.7.0.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5818
CVE-2014-5818 affects the Android app Tiny Tower (com.mobage.ww.a560.tinytower_android) v1.7.0.8. The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. Root cause:...
Tower Toppler 0.99.1 Display Variable Local Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7028/info It has been reported that a buffer overflow exists in Tower Toppler. A local user may be able to exploit this issue to execute code with the privileges of the toppler program. !/usr/bin/perl [email protected]...
Tower Toppler 0.96 HOME Environment Variable Local Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8132/info A problem with the software may make elevation of privileges possible. It has been reported that a buffer overflow exists in Tower Toppler. A local user may be able to exploit this issue to execute code with the...
Verizon Releases First Transparency Report, Says Government Requests INcreasing
After months of public calls from privacy advocates and security experts, Verizon on Wednesday released its first transparency report, revealing that it received more than 164,000 subpoenas and between 1,000 and 2,000 National Security Letters in 2013. The report, which covers Verizon’s landline,...
NSA Director Alexander Asked About Cell Location Collection
Did we hear the next shoe to drop in the NSA surveillance saga? Yesterday before a hearing of the Senate Intelligence Committee, Sen. Ron Wyden, D-Oregon, asked some pointed questions of NSA director Gen. Keith Alexander regarding whether the agency collects cell tower location data in addition t...
