CVE-2016-10766: Cross-Site Request Forgery (CSRF)

edx-platform before 2016-06-06 allows CSRF...

CVE-2015-6960: Improper Neutralization of Input During Web Page Generation

edx-platform before 2015-09-17 allows XSS via a team name...

CVE-2015-5601: Unrestricted Upload of File with Dangerous Type

edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files...

PT-2019-7562

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2016-06-06 Description The issue allows for Cross-Site Request Forgery CSRF attacks. CSRF is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user ...

PT-2019-7200

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-08-17 Description The issue allows for XSS in the Studio listing of courses. Recommendations For versions prior to 2015-08-17, update to a version released after 2015-08-17 to resolve the issue...

PT-2019-7197

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-07-20 Description The issue allows code execution by privileged users due to the course import endpoint mishandling .tar.gz files. This affects the course import endpoint, which is vulnerable to code...

PT-2019-7561

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2016-06-10 Description The issue allows account activation with a spoofed e-mail address. Recommendations For versions prior to 2016-06-10, update to a version released after 2016-06-10 to resolve the issue...

PT-2019-7204

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-09-17 Description The issue allows for XSS via a team name. Recommendations For versions prior to 2015-09-17, update to a version released after 2015-09-17 to resolve the issue...

JetAudio jetCast Server 2.0 Buffer Overflow

Title: JetAudio jetCast Server 2.0 'Log Directory' Local SEH Alphanumeric Encoded Buffer Overflow Date: May 13th, 2019 Author: Connor McGarr https://connormcgarr.github.io Vendor Homepage: http://www.jetaudio.com/ Software Link:...

WinRAR 5.61 - '.lng' Denial of Service

Exploit Title: WinRAR 5.61 - Denial of Service Author: Kağan Çapar Discovery Date: 2019-02-20 Software Link: https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe Vendor Homepage : https://www.win-rar.com Tested Version: 5.61 32 Bit Tested on OS: Windows 10 Education 64 Bit Step...

10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH) (DEP Bypass) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: 10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow SEHDEP Bypass Vulnerable Software: 10-Strike Network Inventory Explorer 8.54 Vendor Homepage:...

edX Account Impersonation Vulnerability

edX is an online course system. configuration Repo is one of the configuration file templates. A security vulnerability exists in the Ansible edxapp role of Configuration Repo in edX. A remote attacker could exploit this vulnerability to impersonate an edX account...

Design/Logic Flaw

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORSORIGINALLOWALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not...

CVE-2015-2186

The CVE-2015-2186 entry concerns the Ansible edxapp role in the edX Configuration Repo. The vulnerability arises from using the string literal "False" instead of a boolean False for CORS_ORIGIN_ALLOW_ALL, enabling remote sites to spoof edX accounts. The issue affected the edX configuration but wa...

CVE-2015-2186

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORSORIGINALLOWALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not...

CVE-2015-2186: Improper Input Validation

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORSORIGINALLOWALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not...

PT-2018-4362

Name of the Vulnerable Software and Affected Versions edx Configuration Repo affected versions not specified Description The issue allows remote websites to spoof edX accounts by leveraging the use of the string literal "False" instead of a boolean False for the CORS ORIGIN ALLOW ALL setting...

Open edX edx-platform Information Disclosure Vulnerability

Open edX edx-platform is a free and open source course management system CMS created by Harvard University and the Massachusetts Institute of Technology Harvard and MIT. A security vulnerability exists in versions of Open edX edx-platform prior to 2015-08-25. An attacker could exploit the...

Information disclosure

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...