CVE-2021-39910

Removed by vendor...

CVE-2021-39910

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature...

CVE-2021-39910: Improper Neutralization of Input During Web Page Generation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature...

GitLab Cross-Site Scripting Vulnerability (CNVD-2022-05444)

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.A cross-site scripting vulnerability exists in GitLab CE/EE, which stems from t...

Clickjacking

swagger-ui is vulnerable to Clickjacking. It was possible to perform a clickjacking attack due to the lack of validation in the SwaggerUI function allowing a remote attacker to exploit and hijack victim click actions...

@egomobile/http-server (>=0.18.0, <=0.23.0), @lyra-network/openapi-dev-tool (>=9.0.0, <=9.5.0) +1 more potentially affected by unknown CVE via swagger-ui-dist (>=4.0.0-beta.2, <=4.1.2)

swagger-ui-dist NPM version =4.0.0-beta.2, =0.18.0, =9.0.0, =1.3.0-moderate-vulnerability, =24.7.0-moderate-vulnerability Source cves: unknown CVE Source advisory: OSV:GHSA-QRMM-W75W-3WPX...

@goodrequest/express-joi-to-swagger (0.2.0), swagger-editor (>=4.0.0-beta.0, <=4.0.0-beta.2) potentially affected by unknown CVE via swagger-ui (>=4.0.0-beta.2, <=4.1.0)

swagger-ui NPM version =4.0.0-beta.2, =4.0.0-beta.0, =4.0.0-beta.2 Source cves: unknown CVE Source advisory: OSV:GHSA-QRMM-W75W-3WPX...

GHSA-QRMM-W75W-3WPX Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

GitLab 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features.A cross-site scripting vulnerability exists in GitLab CE/EE, which stems from t...

Acronis: XSS in Acronis Cloud Manager Admin Portal

Hello, Hope you are doing well. I wanted to report the following security vulnerability: The Acronis Cloud Manager Admin Portal default swagger UI is vulnerable to cross site scripting. I have the API running locally on my machine. I have attached screenshots of the XSS The URL is:...

swagger-ui-browserify (>=2.1.4-a, <=2.2.3) potentially affected by CVE-2021-20086 via jquery-bbq (1.0.0)

jquery-bbq NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jquery-bbq and may be impacted: - swagger-ui-browserify =2.1.4-a, =2.2.3 Source cves: CVE-2021-20086 Source advisory: OSV:GHSA-7W8J-85WM-6XFQ...

GitLab: Stored XSS in repository file viewer

Summary There exists XSS in swagger-ui version used in GitLab open API viewer. The XSS exists due to the old version of DOMpurify used in swagger-ui that allows an attacker can inject any HTML elements with any attributes except script tag on the page. The XSS in POC requires 1 click anywhere on...

The vulnerability of the Cascading Style Sheets (CSS) component of the Swagger UI tool for creating interactive documentation allows a attacker to perform a cross-site scripting attack.

The vulnerability of the Cascading Style Sheets CSS component of the Swagger UI tool for creating interactive documentation is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform a cross-site scripting attack...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 2.2.1 or later...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by unknown CVE via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W992-2GMJ-9XXJ...

GHSA-W992-2GMJ-9XXJ Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 2.2.1 or later...

GHSA-22Q9-HQM5-MHMC Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html i...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html i...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by unknown CVE via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-22Q9-HQM5-MHMC...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using tags in the method descriptions. Recommendation Upgrade to version 2.2.1 or later...