@activeledger/activecore (>=2.0.0-rc5 <=2.0.0-rc.8.0.6), @aktr/node-module-a (=1.0.1) +195 more potentially affected by unknown CVE via swagger-ui (>=2.0.17 <=3.13.3)

swagger-ui NPM version =2.0.17, =2.0.0-rc5, =1.4.0, =0.0.4, =1.0.2, =7.0.0, =1.3.0, =3.0.0-alpha.0, =0.7.2, =3.0.1, =2.0.0, =0.0.1, =0.2.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-X9P2-FXQ6-2M5F...

Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

GHSA-X9P2-FXQ6-2M5F Reverse Tabnapping in swagger-ui

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 2.2.1 or later...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using tags in the method descriptions. Recommendation Upgrade to version 2.2.1 or later. References - GitHub...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.0.13 or later. References - GitHu...

Cross-Site Scripting

Overview Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.20.9 or later. References - GitHub PR - Snyk...

Reverse Tabnapping

Overview Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks. Recommendation Upgrade to version 3.18.0 or later...

com.datasift.dropwizard:dropwizard-extra-scala (>=0.6.0-2 <=0.6.2-6), com.github.kongchen:swagger-maven-plugin (=1.0) +34 more potentially affected by unknown CVE via com.fasterxml.jackson.module:jackson-module-scala (>=2.0.0 <=2.1.2)

com.fasterxml.jackson.module:jackson-module-scala MAVEN version =2.0.0, =0.6.0-2, =1.1, =0.2.4, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.2.2 - com.wordnik:swagger-jersey-jaxrs2.10.0 =1.2.2 and more Source cves: unknown CVE Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONMODULE-174825...

Simplifying API Pentesting With Swagger Files

The post Simplifying API Pentesting With Swagger Files appeared first on Rhino Security Labs...

be.fluid-it.tools.swagger:swagger-ng-module-codegen (>=0.1-1 <=0.1-5), ch.docksnet.codegen:decoupledspringmvc-swagger-codegen (=0.0.2) +15 more potentially affected by CVE-2017-1000207 +1 more via io.swagger:swagger-codegen (>=2.1.1 <=2.2.1)

io.swagger:swagger-codegen MAVEN version =2.1.1, =0.1-1, =1.1, =2.1.3, =2.1.1, =1.0, =1.6.0, =0.4.2, =0.4.2, =0.4.2, =0.5.0-beta-1 and more Source cves: CVE-2017-1000207, CVE-2017-1000208 Source advisory: OSV:GHSA-Q7PF-QR96-2VQ5...

be.fluid-it.tools.swagger:swagger-ng-module-codegen (>=0.1-1 <=0.1-5), ch.docksnet.codegen:decoupledspringmvc-swagger-codegen (=0.0.2) +163 more potentially affected by CVE-2017-1000207 +1 more via io.swagger:swagger-parser (>=1.0.0 <=1.0.30)

io.swagger:swagger-parser MAVEN version =1.0.0, =0.1-1, =1.0.2, =1.0.2, =1.1.0, =1.0.2, =1.0.2, =1.2.0, =1.0.2, =0.0.1, =0.0.1, =1.1, =1.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2017-1000207, CVE-2017-1000208 Source advisory: OSV:GHSA-Q7PF-QR96-2VQ5https://vulners...

GHSA-Q7PF-QR96-2VQ5 Deserialization of Untrusted Data in swagger-parser

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

Deserialization of Untrusted Data in swagger-parser

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

be.fluid-it.tools.swagger:swagger-ng-module-codegen (>=0.1-1 <=0.1-5), ch.docksnet.codegen:decoupledspringmvc-swagger-codegen (=0.0.2) +163 more potentially affected by CVE-2017-1000207 +1 more via io.swagger:swagger-parser (>=1.0.0 <=1.0.30)

io.swagger:swagger-parser MAVEN version =1.0.0, =0.1-1, =1.0.2, =1.0.2, =1.1.0, =1.0.2, =1.0.2, =1.2.0, =1.0.2, =0.0.1, =0.0.1, =1.1, =1.0.0, =2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2017-1000207, CVE-2017-1000208 Source advisory: OSV:GHSA-VGVF-9JH3-FG75https://vulners...

GHSA-VGVF-9JH3-FG75 Deserialization of Untrusted Data in swagger-codegen

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

be.fluid-it.tools.swagger:swagger-ng-module-codegen (>=0.1-1 <=0.1-5), ch.docksnet.codegen:decoupledspringmvc-swagger-codegen (=0.0.2) +15 more potentially affected by CVE-2017-1000207 +1 more via io.swagger:swagger-codegen (>=2.1.1 <=2.2.1)

io.swagger:swagger-codegen MAVEN version =2.1.1, =0.1-1, =1.1, =2.1.3, =2.1.1, =1.0, =1.6.0, =0.4.2, =0.4.2, =0.4.2, =0.5.0-beta-1 and more Source cves: CVE-2017-1000207, CVE-2017-1000208 Source advisory: OSV:GHSA-VGVF-9JH3-FG75...

Deserialization of Untrusted Data in swagger-codegen

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

org.apache.camel:camel-atmosphere-websocket (=2.16.0), org.apache.camel:camel-example-cxf-tomcat (=2.16.0) +8 more potentially affected by CVE-2015-5348 via org.apache.camel:camel-servlet (=2.16.0)

org.apache.camel:camel-servlet MAVEN version =2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-servlet and may be impacted: - org.apache.camel:camel-atmosphere-websocket =2.16.0 - org.apache.camel:camel-example-cxf-tomcat...