CVE-2017-1000207: Deserialization of Untrusted Data

A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger codegen version = 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in...

Swagger-Parser's and swagger-codegen Arbitrary Code Execution Vulnerabilities

Swagger-Parser's is a Swagger cross-language REST API interface parser. swagger-codegen is an API development tool. A security vulnerability exists in Swagger-Parser's 1.0.30 and earlier and swagger-codegen 2.2.2 and earlier. An attacker can exploit the vulnerability to execute arbitrary code...

CVE-2017-1000208

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

CVE-2017-1000208

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

Design/Logic Flaw

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

CVE-2017-1000208

CVE-2017-1000208 involves Swagger-Parser 1.0.30 and earlier with YAML parsing that enables arbitrary code execution when processing crafted OpenAPI specs. It impacts Swagger Codegen commands generate/validate (

CVE-2017-1000208

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

CVE-2017-1000208: Deserialization of Untrusted Data

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

Cross-site Scripting (XSS)

swagger-ui is vulnerable to cross-site scripting XSS attacks. The library does not sanitize href links, allowing a malicious user to inject and execute arbitrary Javascript through these links...

swagger-ui cross-site scripting vulnerability (CNVD-2017-16019)

swagger-ui is a set of API online documentation generation and testing tools . A cross-site scripting vulnerability exists in versions of swagger-ui prior to 2.2.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross-site Scripting (XSS)

github.com/kubernetes/kubernetes is vulnerable to cross-site scripting XSS. This is because url query param from swagger-UI is not properly handled...

swagger-ui cross-site scripting vulnerability

swagger-ui is a set of API online documentation generation and testing tools . A cross-site scripting vulnerability exists in swagger-ui because the program fails to adequately filter user-submitted input. A remote attacker can exploit this vulnerability to execute arbitrary code in a browser...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI is affected by an XSS vulnerability in the Definitions section via the Default field, affecting versions before 2.2.1. The issue allows a remote attacker to inject script that could run in a victim’s browser and potentially steal cookie-based credentials. Remediation per the provided s...

CVE-2016-5682: Improper Neutralization of Input During Web Page Generation

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Arbitrary File Read And Denial Of Service (DoS)

fury-adapter-swagger is vulnerable to arbitrary file reads off the file system and denial of service DoS attacks. This could be used to retrieve sensitive data, or fill the entire available memory and cause a denial of service by reading/dev/zero...