CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parti...

CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parti...

Design/Logic Flaw

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions...

CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parti...

CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parti...

CVE-2018-25031

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parti...

PT-2022-8044 · Unknown · Swagger-Ui

Name of the Vulnerable Software and Affected Versions: Swagger UI versions 4.1.2 and earlier Description: The issue allows a remote attacker to conduct spoofing attacks by persuading a victim to open a crafted URL, which could exploit this vulnerability to display remote OpenAPI definitions...

CVE-2018-25031: Improper Input Validation

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parti...

Swagger UI input validation error vulnerability

Swagger UI is an open source tool that supports visualizing and interacting with API resources. An input validation error vulnerability exists in Swagger UI versions prior to 4.1.3, which stems from the software's lack of filtering and escaping of user-submitted URL data. This vulnerability can b...

OpenAPI Unencrypted Traffic Allowed

OpenAPI specification is an API description format for REST APIs. An OpenAPI file is written in YAML or JSON and describes all the API properties like the available endpoints with the related operations or the authentication methods. As for web applications, allowing unencrypted protocols to acce...

com.enegate:micronaut-grpc-server (0.0.3), io.micronaut.configuration:micronaut-aws-common (1.0.3) +47 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (1.0.3)

io.micronaut:micronaut-http MAVEN version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - com.enegate:micronaut-grpc-server 0.0.3 - io.micronaut.configuration:micronaut-aws-common 1.0.3 -...

io.kokuwa.micronaut:micronaut-openapi-codegen (>=2.1.8, <=2.1.9), io.micronaut.acme:micronaut-acme (3.0.0-rc1) +33 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (2.5.8)

io.micronaut:micronaut-http MAVEN version 2.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.kokuwa.micronaut:micronaut-openapi-codegen =2.1.8, =3.0.0-m1, =4.0.0-rc1, =4.0.0-rc1, =4.0.0-rc1,...

io.micronaut.configuration:micronaut-hibernate-validator (1.1.0.rc2), io.micronaut.configuration:micronaut-openapi (1.1.0.rc2) +23 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (1.1.0.rc2)

io.micronaut:micronaut-http MAVEN version 1.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.micronaut.configuration:micronaut-hibernate-validator 1.1.0.rc2 -...

io.kokuwa.micronaut:micronaut-openapi-codegen (1.5.0), io.micronaut:micronaut-function (2.0.3) +17 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (2.0.3)

io.micronaut:micronaut-http MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.kokuwa.micronaut:micronaut-openapi-codegen 1.5.0 - io.micronaut:micronaut-function 2.0.3 -...

How to Make API Security an Integral Part of Your Application Security Strategy

The farther your organization travels down the digital transformation path, the more critical API protection is to your overall security posture. Every day, your development teams are innovating; they rely more on microservices to save time and money as they automate business-to-business processe...

@egomobile/http-server (>=0.18.0, <=0.23.0), @lyra-network/openapi-dev-tool (>=9.0.0, <=9.5.0) +1 more potentially affected by unknown CVE via swagger-ui-dist (>=4.0.0-beta.2, <=4.1.2)

swagger-ui-dist NPM version =4.0.0-beta.2, =0.18.0, =9.0.0, =1.3.0-moderate-vulnerability, =24.7.0-moderate-vulnerability Source cves: unknown CVE Source advisory: OSV:GHSA-QRMM-W75W-3WPX...

Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

GHSA-QRMM-W75W-3WPX Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

@egomobile/http-server (>=0.18.0, <=0.23.0), @lyra-network/openapi-dev-tool (>=9.0.0, <=9.5.0) +1 more potentially affected by CVE-2020-26870 via swagger-ui-dist (>=4.0.0-beta.2, <=4.1.2)

swagger-ui-dist NPM version =4.0.0-beta.2, =0.18.0, =9.0.0, =1.3.0-moderate-vulnerability, =24.7.0-moderate-vulnerability Source cves: CVE-2020-26870 Source advisory: GHSA-QRMM-W75W-3WPX...

Swurg - Parse OpenAPI Documents Into Burp Suite For Automating OpenAPI-based APIs Security Assessments

Swurg is a Burp Suite extension designed for OpenAPI testing. The OpenAPI Specification OAS defines a standard, programming language-agnostic interface description for REST APIs, which allows both humans and computers to discover and understand the capabilities of a service without requiring acce...