630 matches found
Malicious code in tailchat-service-swagger-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acf09d7e9f52a0406ff87b349906e6278f766537755abbd90395b2179ccd36fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-9802
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The...
CVE-2024-9802
The CVE-2024-9802 entry concerns the Zowe API Mediation Layer’s conformance validation endpoint, which is publicly accessible. Public responses may reveal service details (endpoints, swagger) and potentially indicate the running version and whether a service is active. This information exposure i...
CVE-2024-9802 Conformance validation endpoint discloses detail about service to unauthenticated users
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The...
PT-2024-39847 · Open Mainframe +2 · Zowe +3
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The conformance validation endpoint is publicly accessible, allowing anyone to verify the conformance of onboarded services. The response from this...
Cross-site Scripting (XSS)
github.com/gotify/server is vulnerable to Cross-site Scripting XSS. The vulnerability is due to outdated Swagger UI, which uses a vulnerable version of DOMPurify, allowing an attacker to execute arbitrary JavaScript through external Swagger config files...
Information Disclosure Vulnerability in Swagger KingDBConnector of Beijing Asia Control Technology Development Co.
Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise founded in 1997 as a software platform for industrial automation and informatization. An information disclosure vulnerability exists in Swagger KingDBConnector of Beijing Asia Control Technology Development Co. Ltd,...
GO-2023-1471 Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server
Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server...
CVE-2024-7314
anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on...
PT-2024-38260
Name of the Vulnerable Software and Affected Versions anji-plus AJ-Report versions = 1.4.0 Description The issue allows a remote and unauthenticated attacker to bypass authentication by appending ";swagger-ui" to HTTP requests, potentially executing arbitrary Java on the victim server. This is du...
CVE-2024-7314: Authentication Bypass Using an Alternate Path or Channel
anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on...
AJ-Report 安全漏洞
AJ-Report is an open source visual design tool from anji-plus. A security vulnerability exists in AJ-Report versions prior to 1.4.1, which originates from a remote, unauthenticated attacker who can attach swagger-ui to an HTTP request to bypass authentication and execute arbitrary Java on the...
Malicious code in Be.Vlaanderеn.Bаsisregisters.AspNetCore.Swagger (NuGet)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-4153 Malicious code in Be.Vlaanderеn.Bаsisregisters.AspNetCore.Swagger (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaanderеn.Bаsisregіsters.AspNеtCore.Swagger (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaandеren.Basisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-4163 Malicious code in Be.Vlaandеren.Basisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in Be.Vlaaոdеren.Bаsisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Ionity GmbH: HTML injection in swagger UI
A vulnerability was discovered in the Swagger UI that allowed for HTML injection. This vulnerability existed because the application failed to properly sanitize user-supplied input before rendering it in the HTML context. An attacker could have exploited this issue to execute arbitrary scripts in...
Security Bulletin: B2B API of IBM Sterling B2B Integrator is vulnerable to information disclosure due to Springfox Swagger (CVE-2019-17495)
Summary IBM Sterling B2B Integrator uses Springfox Swagger. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. ...