Discovering Shadow APIs with Wallarm API firewall

Shadow APIs can be defined as active endpoints that you are not aware of. Some APIs are deployed but never documented. Others are services that don’t have an owner anymore. Some are even old v2 versions that have been deprecated for years, yet still exposed. Long story short: these APIs are not...

What is OpenAPI ❓ Concept, Examples and Advantages

What is OpenAPI? If there is anything that is growing anything like leaps and bounds then it’s API development and awareness towards API’s security. Whether it’s web API or mobile API, growth is significant in each domain. While we discuss API development, OpenAPI deserves a mention for sure. Thi...

GHSA-Q324-Q795-2Q5P Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with...

PT-2021-24447

Name of the Vulnerable Software and Affected Versions: openapi-cli versions prior to 1.0.0-beta.59 Description: The issue allows path traversal when the preview-docs command is executed in a directory containing files with a question mark ? in their name, provided the attacker is aware of the fil...

API8: Injection☝️ — What you need to know

API8: Injection☝️ — What you need to know Introduction API8:2019 Injection What is Injection? API’s with the following properties are open to injection flaws: When we don’t sanitize the input from the front-end we are opening ourselves to a world of problems, this would allow the user to input...

@apalchys/serverless-openapi-documentation (>=0.1.0, <=0.5.4), @conqa/serverless-openapi-documentation (>=1.0.1, <=1.0.4) +21 more potentially affected by CVE-2021-23396 via lutils (2.4.0)

lutils NPM version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lutils and may be impacted: - @apalchys/serverless-openapi-documentation =0.1.0, =1.0.1, =0.0.1, =0.1.0, =0.1.0, =2.6.6, =0.3.0, =0.0.1, =0.0.2, =2.0.0-1, =3.2.0 and more Source...

@apalchys/serverless-openapi-documentation (>=0.1.0, <=0.5.4), @conqa/serverless-openapi-documentation (>=1.0.1, <=1.0.4) +27 more potentially affected by CVE-2021-23396 via lutils (>=0.2.11, <=2.4.0)

lutils NPM version =0.2.11, =0.1.0, =1.0.1, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =2.0.9, =0.3.0, =0.0.1, =0.1.9 and more Source cves: CVE-2021-23396 Source advisory: SNYK:JS-LUTILS-1311023...

Fedora: Security Advisory for python-fastapi (FEDORA-2021-e7fabd81fb)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: python-fastapi-0.65.1-2.fc34

FastAPI is a modern, fast high-performance, web framework for building AP Is with Python 3.6+ based on standard Python type hints. The key features are: =EF=BF=BD=EF=BF=BD=EF=BF=BD Fast: Very high performance, on par with Node JS and Go thanks to Starlette and Pydantic. One of the fastest Python...

coub-api (>=0.1.1a0, <=0.1.2), pydantic-openapi (>=0.1.2, <=0.1.4) potentially affected by CVE-2021-29510 via pydantic (0.16.1)

pydantic PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - coub-api =0.1.1a0, =0.1.2, =0.1.4 Source cves: CVE-2021-29510 Source advisory: OSV:PYSEC-2021-47...

Insecure Temporary File And Folder

openapi-generator-online uses insecure temporary file and folder. The usage of Files.createTempFile to create temporary files and folders allows auto-generated files to be read and modified by any user on the system...

org.openapitools:openapi-generator-gradle-plugin (3.2.3), org.openapitools:openapi-generator-maven-plugin (3.2.3) +1 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (3.2.3)

org.openapitools:openapi-generator MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapitools:openapi-generator-gradle-plugin 3.2.3 -...

org.openapi.generator:org.openapi.generator.gradle.plugin (4.2.1), org.openapitools:openapi-generator-gradle-plugin (4.2.1) +2 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.2.1)

org.openapitools:openapi-generator MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapi.generator:org.openapi.generator.gradle.plugin 4.2.1 -...

org.openapi.generator:org.openapi.generator.gradle.plugin (4.1.3), org.openapitools:openapi-generator-gradle-plugin (4.1.3) +2 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.1.3)

org.openapitools:openapi-generator MAVEN version 4.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapi.generator:org.openapi.generator.gradle.plugin 4.1.3 -...

org.openapitools:openapi-generator-gradle-plugin (3.2.2), org.openapitools:openapi-generator-maven-plugin (3.2.2) +1 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (3.2.2)

org.openapitools:openapi-generator MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapitools:openapi-generator-gradle-plugin 3.2.2 -...

org.openapi.generator:org.openapi.generator.gradle.plugin (4.1.1), org.openapitools:openapi-generator-gradle-plugin (4.1.1) +2 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.1.1)

org.openapitools:openapi-generator MAVEN version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapi.generator:org.openapi.generator.gradle.plugin 4.1.1 -...

com.bluetrainsoftware.maven:openapi-dart-generator (>=2.5, <=3.10), dev.sschnabe.micronaut:micronaut-openapi-codegen (>=0.1.0, <=0.2.1) +5 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.2.2)

org.openapitools:openapi-generator MAVEN version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - com.bluetrainsoftware.maven:openapi-dart-generator =2.5, =0.1.0, =1.0.0, =1.0.1 -...

io.agrest.openapi:agrest-openapi-designfirst (>=3.0, <=4.6), org.openapitools:openapi-generator-gradle-plugin (3.0.2) +3 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (3.0.2)

org.openapitools:openapi-generator MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - io.agrest.openapi:agrest-openapi-designfirst =3.0, =4.6 -...

de.unikassel.vs.apirepo.plugins.api:de.unikassel.vs.apirepo.plugins.api.gradle.plugin (>=0.0.1-stable, <=0.1.0-stable), de.unikassel.vs.apirepo.plugins.client:de.unikassel.vs.apirepo.plugins.client.gradle.plugin (>=0.0.1-stable, <=0.1.0-stable) +11 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.0.3)

org.openapitools:openapi-generator MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - de.unikassel.vs.apirepo.plugins.api:de.unikassel.vs.apirepo.plugins.api.gradle.plugin...

org.openapitools:openapi-generator-gradle-plugin (3.1.2), org.openapitools:openapi-generator-maven-plugin (3.1.2) +1 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (3.1.2)

org.openapitools:openapi-generator MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - org.openapitools:openapi-generator-gradle-plugin 3.1.2 -...