Lucene search

Cross-site scripting in Swagger-UI

🗓️ 15 Oct 2019 19:05:27Reported by GoogleType

osv🔗 osv.dev👁 129 Views

Cross-site scripting vulnerability in Swagger-UI allows CSS injection via RPO technique for exfiltration of input field values like CSRF toke

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM StoredIQ InstaScan (CVE-2019-17495)	10 Jul 202014:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to CSS injection due to Swagger UI (CVE-2019-17495)	15 Jun 202305:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-17495)	10 May 202017:38	–	ibm
IBM Security Bulletins	Security Bulletin: Swagger Vulnerability in WebSphere Application Server Liberty shipped with Cloud Pak System (CVE-2019-17495)	7 Jul 202013:14	–	ibm
IBM Security Bulletins	Security Bulletin: Novalink is impacted by Swagger vulnerability affects WebSphere Application Server Liberty	27 Jul 202019:39	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM StoredIQ (CVE-2019-17495)	11 Jul 202013:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2019-17495)	19 Mar 202019:26	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Swagger UI (CVE-2019-17495)	30 Dec 201916:34	–	ibm
IBM Security Bulletins	Security Bulletin: B2B API of IBM Sterling B2B Integrator is vulnerable to information disclosure due to Springfox Swagger (CVE-2019-17495)	30 May 202415:24	–	ibm
IBM Security Bulletins	Security Bulletin: Swagger vulnerability affects WebSphere Application Server Liberty (CVE-2019-17495)	20 Jan 202018:11	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-17495
github	www.github.com/swagger-api/swagger-ui
github	www.github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
github	www.github.com/tarantula-team/CSS-injection-in-Swagger-UI
lists	www.lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91@%3Ccommits.airflow.apache.org%3E
lists	www.lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf@%3Ccommits.airflow.apache.org%3E
lists	www.lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96@%3Ccommits.airflow.apache.org%3E
lists	www.lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f@%3Ccommits.airflow.apache.org%3E
lists	www.lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f@%3Ccommits.airflow.apache.org%3E
oracle	www.oracle.com/security-alerts/cpuApr2021.html

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

15 Oct 2019 19:27Current

3.8Low risk

Vulners AI Score3.8

EPSS0.022