Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-17495)

Summary IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. By using the relative path...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - Swagger UI (CVE-2019-17495)

Summary A Security Vulnerability affects IBM Cloud Private - Swagger UI Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based...

CVE-2016-1000229

swagger-ui has XSS in key names...

Design/Logic Flaw

swagger-ui has XSS in key names...

PT-2019-7509

Name of the Vulnerable Software and Affected Versions swagger-ui affected versions not specified Description The issue is related to Cross-Site Scripting XSS in key names. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

GHSA-C427-HJC3-WRFW Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by CVE-2019-17495 via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Design/Logic Flaw

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

CVE-2019-17495 is a CSS injection flaw in Swagger UI prior to 3.23.11 using the Relative Path Overwrite (RPO) technique that can lead to exfiltration of sensitive data (e.g., CSRF tokens) via CSS-based input field values. Concrete details across connected docs show multiple IBM advisories referen...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Swagger UI Injection Vulnerability

Swagger UI is an open source tool that supports visualizing API resources and being able to interact with them. An injection vulnerability exists in Swagger UI versions prior to 3.23.11, which can be exploited by an attacker to disclose information e.g., cross-site requests to forge token values...

CVE-2019-17495: Cross-Site Request Forgery (CSRF)

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Reverse Tabnapping

swagger-ui is vulnerable to reverse tabnabbing. The anchor tags uses target='blank' which would allow attackers to access window.opener for the original page to perform phising attacks...

Cross-Site Scripting (XSS)

swagger-ui is vulnerable to cross-site scripting XSS. URLs used in the OAuth auth flow are not sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

api-browser (>=0.0.1, <=0.0.3), koa2-swagger-ui (2.2.1) +2 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.13.3)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: OSV:GHSA-X9P2-FXQ6-2M5F...

Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

GHSA-X9P2-FXQ6-2M5F Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...