CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 5CVE-2015-1481 – Ansible Tower 2.0.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-1481
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account. Ansible Tower (también conocido como la UI de Ansible) anterior a 2.0.5 permite a administradores de organizaciones remotos ganar privilegios mediante la creación de una cuenta de superusuario. • https://www.exploit-db.com/exploits/35786 http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html http://seclists.org/fulldisclosure/2015/Jan/52 http://www.exploit-db.com/exploits/35786 http://www.securityfocus.com/archive/1/534464/100/0/threaded https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 5CVE-2015-1482 – Ansible Tower 2.0.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-1482
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/. Ansible Tower (también conocido como la UI de Ansible) anterior a 2.0.5 permite a atacantes remotos evadir la autenticación y obtener información sensible a través de una conexión de socket web en socket.io/1/. • https://www.exploit-db.com/exploits/35786 http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html http://seclists.org/fulldisclosure/2015/Jan/52 http://www.exploit-db.com/exploits/35786 http://www.securityfocus.com/archive/1/534464/100/0/threaded https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 4CVE-2015-1368 – Ansible Tower 2.0.2 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-1368
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/. Múltiples vulnearbilidades de XSS en Ansible Tower (también conocido como Ansible UI) anterior a 2.0.5 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través (1) del parámetro order_by en credentials/, (2) inventories/, (3) projects/, o (4) users/3/permissions/ en api/v1/ o (5) del parámetro next_run en api/v1/schedules/. • https://www.exploit-db.com/exploits/35786 http://osvdb.org/show/osvdb/116961 http://osvdb.org/show/osvdb/116962 http://osvdb.org/show/osvdb/116963 http://osvdb.org/show/osvdb/116964 http://osvdb.org/show/osvdb/116965 http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html http://seclists.org/fulldisclosure/2015/Jan/52 http://www.exploit-db.com/exploits/35786 http://www.securityfocus.com/archive/1/534464/100&#x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •