298 matches found
CVE-2019-20512
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
CVE-2019-20512
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
Cross site scripting
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
CVE-2019-20512
The CVE-2019-20512 entry concerns Open edX Ironwood.1, where a reflected XSS flaw is triggered via the course_id parameter in the support/certificates flow. The affected component appears to be the web application handling course resources in Open edX Ironwood.1; the root cause is input from a us...
CVE-2019-20512
Open edX Ironwood.1 allows support/certificates?courseid= reflected XSS...
Open edX platform security feature issue vulnerability
The Open edX platform is an open source course management system CMS. The system can be used for MOOCs Massive Open Online Courses as well as smaller courses and training modules. A security feature issue vulnerability exists in the installation process in versions of Open edX prior to 2017-01-10...
Open edX platform cross-site scripting vulnerability
The Open edX platform is an open source course management system CMS. The system can be used for MOOCs Massive Open Online Courses as well as smaller courses and training modules. A cross-site scripting vulnerability exists in versions of Open edX platform prior to 2018-07-18. The vulnerability...
CVE-2017-18381
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
CVE-2017-18381
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
Design/Logic Flaw
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem...
Default credentials
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
CVE-2017-18381
CVE-2017-18381 concerns Open edX installations prior to 2017-01-10, where the installation process exposed a MongoDB instance to external connections using default credentials. This creates a risk of unauthorized access to the database. The connected Red Hat and other vulnerability records corrob...
CVE-2017-18381
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
CVE-2017-18380
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name...
CVE-2017-18380
CVE-2017-18380 affects edx-platform (pre-2017-08-03). The issue allows an attacker to trigger password-reset emails where the reset link uses an attacker-controlled domain name, enabling potential phishing or credential harvesting vectors. Documented impact: ability to cause user-facing reset mes...
PT-2019-8316 · Edx +1 · Open Edx +1
Name of the Vulnerable Software and Affected Versions: Open edX versions prior to 2017-01-10 Description: The installation process exposes a MongoDB instance to external connections with default credentials. This issue may allow unauthorized access to the database. Recommendations: For versions...
CVE-2016-10766
edx-platform before 2016-06-06 allows CSRF...
CVE-2016-10765
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address...