Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

GHSA-X9P2-FXQ6-2M5F Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

api-browser (>=0.0.1, <=0.0.3), koa2-swagger-ui (2.2.1) +2 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.13.3)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: GHSA-X9P2-FXQ6-2M5F...

api-browser (>=0.0.1, <=0.0.3), koa2-swagger-ui (2.2.1) +2 more potentially affected by unknown CVE via swagger-ui (>=3.0.5, <=3.13.3)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: unknown CVE Source advisory: OSV:GHSA-X9P2-FXQ6-2M5F...

PT-2019-20079

Name of the Vulnerable Software and Affected Versions swagger-ui versions prior to 3.18.0 Description The issue allows attackers to access window.opener for the original page, which can be used for phishing attacks, as it exploits the target=' blank' attribute in anchor tags. Recommendations...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 2.2.1 or later...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using tags in the method descriptions. Recommendation Upgrade to version 2.2.1 or later. References - GitHub...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.0.13 or later. References - GitHu...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.20.9 or later. References - GitHub PR - Snyk...

Reverse Tabnapping

Overview Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

Zomato: Reflected XSS on developers.zomato.com

There is a vulnerability in https://developers.zomato.com/documentation due to an old version of Swagger UI Step to reproduce: - Create an endpoint containing : json "swagger":"2.0","info":"description":"This is a sample server Petstore server. You can find out more about Swagger at...

Cross-site Scripting (XSS)

swagger-ui is vulnerable to cross-site scripting XSS attacks. The library does not sanitize href links, allowing a malicious user to inject and execute arbitrary Javascript through these links...

Cross-site Scripting (XSS)

github.com/kubernetes/kubernetes is vulnerable to cross-site scripting XSS. This is because url query param from swagger-UI is not properly handled...

swagger-ui cross-site scripting vulnerability

swagger-ui is a set of API online documentation generation and testing tools . A cross-site scripting vulnerability exists in swagger-ui because the program fails to adequately filter user-submitted input. A remote attacker can exploit this vulnerability to execute arbitrary code in a browser...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...