311 matches found
CVE-2017-18381
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
CVE-2017-18381
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
Design/Logic Flaw
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem...
Default credentials
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
CVE-2017-18381
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials...
CVE-2017-18381
CVE-2017-18381 concerns Open edX installations prior to 2017-01-10, where the installation process exposed a MongoDB instance to external connections using default credentials. This creates a risk of unauthorized access to the database. The connected Red Hat and other vulnerability records corrob...
CVE-2017-18380
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name...
CVE-2017-18380
CVE-2017-18380 affects edx-platform (pre-2017-08-03). The issue allows an attacker to trigger password-reset emails where the reset link uses an attacker-controlled domain name, enabling potential phishing or credential harvesting vectors. Documented impact: ability to cause user-facing reset mes...
PT-2019-8316 · Edx +1 · Open Edx +1
Name of the Vulnerable Software and Affected Versions: Open edX versions prior to 2017-01-10 Description: The installation process exposes a MongoDB instance to external connections with default credentials. This issue may allow unauthorized access to the database. Recommendations: For versions...
CVE-2016-10765
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address...
CVE-2016-10766
edx-platform before 2016-06-06 allows CSRF...
CVE-2016-10766
edx-platform before 2016-06-06 allows CSRF...
CVE-2016-10765
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address...
Cross site request forgery (csrf)
edx-platform before 2016-06-06 allows CSRF...
Code injection
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address...
CVE-2015-6960
edx-platform before 2015-09-17 allows XSS via a team name...
Cross site scripting
edx-platform before 2015-09-17 allows XSS via a team name...
Design/Logic Flaw
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses...
Code injection
edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files...
CVE-2016-10766
CVE-2016-10766 affects edx-platform prior to 2016-06-06 and is a cross-site request forgery (CSRF) vulnerability. According to the sources, the issue is a CSRF flaw in edx-platform before the specified date. CVSSv3.1 base score is 8.8 (HIGH) with NETWORK attack vector, LOW attack complexity, no p...