CVE-2015-1481

Ansible Tower aka Ansible UI before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account...

Design/Logic Flaw

Ansible Tower aka Ansible UI before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account...

CVE-2015-1481

CVE-2015-1481 affects Ansible Tower (aka Ansible UI) prior to 2.0.5. The described vulnerability allows remote organization administrators to gain privileges by creating a superuser account. This mode of privilege escalation is documented in multiple connected sources referencing the same issue. ...

CVE-2015-1481

Ansible Tower aka Ansible UI before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account...

CVE-2015-1482

Ansible Tower aka Ansible UI before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/...

CVE-2015-1482

Ansible Tower (aka Ansible UI) before 2.0.5 is vulnerable to an authentication bypass via a websocket connection to socket.io/1/, enabling remote attackers to obtain sensitive information. Root cause: missing/weak auth on the Socket.IO endpoint. Affected product and version: Ansible Tower prior t...

PT-2015-5318

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to "socket.io/1/". Recommendations For versions prior to 2.0.5, update to...

CVE-2015-1482: Exposure of Sensitive Information to an Unauthorized Actor

Ansible Tower aka Ansible UI before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/...

CVE-2015-1481: Undefined Security Weakness

Ansible Tower aka Ansible UI before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account...

PT-2015-5317

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote organization administrators to gain privileges by creating a superuser account. Recommendations For versions prior to 2.0.5, update to version 2.0.5 or later to resolve...

CVE-2015-1368

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...

CVE-2015-1368

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...

CVE-2015-1368

Ansible Tower (aka Ansible UI) prior to version 2.0.5 is affected by multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary script or HTML via input parameters in the API: (1) order_by to credentials/, (2) inventories/, (3) projects/, or (4) use...

PT-2015-5243

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the order by parameter to various endpoints such as "credentials/", "inventories/", "projects/...

CVE-2015-1368: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Ansible Tower aka Ansible UI before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 orderby parameter to credentials/, 2 inventories/, 3 projects/, or 4 users/3/permissions/ in api/v1/ or the 5 nextrun parameter to...

SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower

SEC Consult Vulnerability Lab Security Advisory 20150113-1 ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.2 fixed version: =2.0.5 impact: high homepage:...

Ansible Tower 2.0.2 - Multiple Vulnerabilities

Ansible Tower versions 2.0.2 and below suffer from cross site scripting, privilege escalation, and missing vulnerabilities. ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version:...

Ansible Tower Authentication Bypass Vulnerability

Ansible is simple configuration management, deployment, task execution, and multi-node authoring framework. Ansible Tower suffers from an authentication bypass vulnerability that can be exploited by an attacker to bypass authentication mechanisms and obtain sensitive information...

Multiple Cross-Site Scripting Vulnerabilities in Ansible Tower

Ansible is simple configuration management, deployment, task execution, and multi-node authoring framework. Ansible Tower has multiple cross-site scripting vulnerabilities because it fails to properly filter user-supplied input. An attacker could potentially exploit these vulnerabilities to execu...