api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by CVE-2019-17495 via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by CVE-2019-17495 via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: CVE-2019-17495 Source advisory: GHSA-C427-HJC3-WRFW...

com.gitblit.fathom:fathom-integration-test (>=0.7.0, <=0.8.1), com.gitblit.fathom:fathom-rest-swagger (>=0.7.0, <=0.8.1) potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.2)

org.webjars:swagger-ui MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.gitblit.fathom:fathom-integration-test =0.7.0, =0.7.0, =0.8.1 Source cves: CVE-2019-17495 Source advisory:...

com.danhaywood.mavendeps:isiswebapp (>=0.0.1, <=0.0.2), org.apache.isis.core:isis-core-viewer-restfulobjects-server (>=1.11.0, <=1.14.0) +1 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.3)

org.webjars:swagger-ui MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.danhaywood.mavendeps:isiswebapp =0.0.1, =1.11.0, =1.14.0 - org.incode.mavendeps:isiswebapp 1.14.0 Source cves:...

org.rouplex:rouplex-deployment-service-provider-jersey (>=1.0.0, <=1.0.1), org.rouplex:rouplex-deployment-webapp (>=1.0.0, <=1.0.1) +2 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.2.5)

org.webjars:swagger-ui MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.rouplex:rouplex-deployment-service-provider-jersey =1.0.0, =1.0.0, =1.0.0, =1.0.4 - tv.cntt:xitrum2.11 3.28.1...

Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Design/Logic Flaw

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

@activeledger/activecore (>=2.0.0-rc5, <=2.0.0-rc.8.0.6), @aktr/node-module-a (1.0.1) +189 more potentially affected by CVE-2019-17495 via swagger-ui (>=2.0.2, <=3.20.7)

swagger-ui NPM version =2.0.2, =2.0.0-rc5, =1.4.0, =0.0.4, =1.0.2, =7.0.0, =1.3.0, =3.0.0-alpha.0, =0.7.2, =3.0.1, =2.0.0, =0.0.1, =0.2.1 and more Source cves: CVE-2019-17495 Source advisory: MEND:CVE-2019-17495...

CVE-2019-17495

CVE-2019-17495 is a CSS injection flaw in Swagger UI prior to 3.23.11 using the Relative Path Overwrite (RPO) technique that can lead to exfiltration of sensitive data (e.g., CSRF tokens) via CSS-based input field values. Concrete details across connected docs show multiple IBM advisories referen...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: MEND:CVE-2019-17495...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Swagger UI Injection Vulnerability

Swagger UI is an open source tool that supports visualizing API resources and being able to interact with them. An injection vulnerability exists in Swagger UI versions prior to 3.23.11, which can be exploited by an attacker to disclose information e.g., cross-site requests to forge token values...

PT-2019-5682

Name of the Vulnerable Software and Affected Versions Swagger UI versions prior to 3.23.11 Description The issue is related to a Cascading Style Sheets CSS injection vulnerability in Swagger UI. This vulnerability can be exploited by a remote attacker to perform a cross-site scripting attack. The...

CVE-2019-17495: Cross-Site Request Forgery (CSRF)

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Reverse Tabnapping

swagger-ui is vulnerable to reverse tabnabbing. The anchor tags uses target='blank' which would allow attackers to access window.opener for the original page to perform phising attacks...

Cross-Site Scripting (XSS)

swagger-ui is vulnerable to cross-site scripting XSS. URLs used in the OAuth auth flow are not sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...