CVE-2018-25031

CVE-2018-25031 Descripción: Swagger UI anterior a 4.1.3 podría permitir que un atacante remoto realice ataques de suplantación de identidad. Al persuadir a una víctima para que abra una URL manipulada, un atacante podría explotar esta vulnerabilidad para mostrar definiciones OpenAPI remotas...

EUVD-2026-87984

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

GHSA-CR3Q-PQGQ-M8C2 Spoofing attack in swagger-ui

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions...

PT-2022-8044 · Unknown · Swagger-Ui

Name of the Vulnerable Software and Affected Versions: Swagger UI versions 4.1.2 and earlier Description: The issue allows a remote attacker to conduct spoofing attacks by persuading a victim to open a crafted URL, which could exploit this vulnerability to display remote OpenAPI definitions...

Swagger UI 输入验证错误漏洞

Swagger UI is an open source tool that supports visualizing and interacting with API resources. An input validation error vulnerability exists in Swagger UI versions prior to 4.1.3, which stems from the software's lack of filtering and escaping of user-submitted URL data. This vulnerability can b...