CVE-2016-1000233

CVE-2016-1000233 is a Swagger-UI cross-site scripting vulnerability described in the connected IBM bulletin. The issue arises when a Content-Type: application/javascript header is included while Swagger-UI processes a URL query string parameter, allowing a remote attacker to inject and execute ma...

CVE-2017-1000233

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session. Affected versions: prior to 6.1.6 and prior to 7.0.3. Remediation: upgrade to OpenProject 6.1.6 or newer, or 7.0.3 or new...