PT-2019-7509

Name of the Vulnerable Software and Affected Versions swagger-ui affected versions not specified Description The issue is related to Cross-Site Scripting XSS in key names. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.11.0: Never allow an empty password to validate 9682 9683 Prevent redirect to Host 9678 9679 Swagger hide search field 9554 Add "search" to reserved usernames 9063 Switch to fomantic-ui 9374 Only serve attachments when linked to issue/release and if accessible...

org.jooby:coverage-report (>=0.6.2, <=1.1.2), org.jooby:jooby-swagger (>=0.6.2, <=1.1.3) potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.8-m1)

org.webjars:swagger-ui MAVEN version 2.1.8-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.jooby:coverage-report =0.6.2, =0.6.2, =1.1.3 Source cves: CVE-2019-17495 Source advisory:...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: GHSA-C427-HJC3-WRFW...

GHSA-C427-HJC3-WRFW Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by CVE-2019-17495 via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

api-browser (>=0.0.1, <=0.0.3), decoupled-swagger-editor (1.0.0) +3 more potentially affected by CVE-2019-17495 via swagger-ui (>=3.0.5, <=3.20.7)

swagger-ui NPM version =3.0.5, =0.0.1, =0.0.1, =3.0.12, =3.1.8 Source cves: CVE-2019-17495 Source advisory: GHSA-C427-HJC3-WRFW...

com.danhaywood.mavendeps:isiswebapp (>=0.0.1, <=0.0.2), org.apache.isis.core:isis-core-viewer-restfulobjects-server (>=1.11.0, <=1.14.0) +1 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.3)

org.webjars:swagger-ui MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.danhaywood.mavendeps:isiswebapp =0.0.1, =1.11.0, =1.14.0 - org.incode.mavendeps:isiswebapp 1.14.0 Source cves:...

com.github.xiaodongw:swagger-finatra_2.11 (>=0.7.0, <=0.7.2), io.paradoxical:finatra-server_2.12 (>=1.0.1, <=1.0.2) +7 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.2.8)

org.webjars:swagger-ui MAVEN version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.github.xiaodongw:swagger-finatra2.11 =0.7.0, =1.0.1, =1.0.1, =0.6.0, =0.5.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0,...

com.gitblit.fathom:fathom-integration-test (>=0.7.0, <=0.8.1), com.gitblit.fathom:fathom-rest-swagger (>=0.7.0, <=0.8.1) potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.2)

org.webjars:swagger-ui MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.gitblit.fathom:fathom-integration-test =0.7.0, =0.7.0, =0.8.1 Source cves: CVE-2019-17495 Source advisory:...

org.rouplex:rouplex-deployment-service-provider-jersey (>=1.0.0, <=1.0.1), org.rouplex:rouplex-deployment-webapp (>=1.0.0, <=1.0.1) +2 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.2.5)

org.webjars:swagger-ui MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.rouplex:rouplex-deployment-service-provider-jersey =1.0.0, =1.0.0, =1.0.0, =1.0.4 - tv.cntt:xitrum2.11 3.28.1...

Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Design/Logic Flaw

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

@activeledger/activecore (>=2.0.0-rc5, <=2.0.0-rc.8.0.6), @aktr/node-module-a (1.0.1) +189 more potentially affected by CVE-2019-17495 via swagger-ui (>=2.0.2, <=3.20.7)

swagger-ui NPM version =2.0.2, =2.0.0-rc5, =1.4.0, =0.0.4, =1.0.2, =7.0.0, =1.3.0, =3.0.0-alpha.0, =0.7.2, =3.0.1, =2.0.0, =0.0.1, =0.2.1 and more Source cves: CVE-2019-17495 Source advisory: MEND:CVE-2019-17495...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: MEND:CVE-2019-17495...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...