AJ-Report 安全漏洞

AJ-Report is an open source visual design tool from anji-plus. A security vulnerability exists in AJ-Report versions prior to 1.4.1, which originates from a remote, unauthenticated attacker who can attach swagger-ui to an HTTP request to bypass authentication and execute arbitrary Java on the...

PT-2024-38260

Name of the Vulnerable Software and Affected Versions anji-plus AJ-Report versions = 1.4.0 Description The issue allows a remote and unauthenticated attacker to bypass authentication by appending ";swagger-ui" to HTTP requests, potentially executing arbitrary Java on the victim server. This is du...

Malicious code in Be.Vlaanderеn.Bаsisregisters.AspNetCore.Swagger (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4153 Malicious code in Be.Vlaanderеn.Bаsisregisters.AspNetCore.Swagger (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaanderеn.Bаsisregіsters.AspNеtCore.Swagger (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4163 Malicious code in Be.Vlaandеren.Basisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaandеren.Basisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոdеren.Bаsisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Ionity GmbH: HTML injection in swagger UI

A vulnerability was discovered in the Swagger UI that allowed for HTML injection. This vulnerability existed because the application failed to properly sanitize user-supplied input before rendering it in the HTML context. An attacker could have exploited this issue to execute arbitrary scripts in...

Security Bulletin: B2B API of IBM Sterling B2B Integrator is vulnerable to information disclosure due to Springfox Swagger (CVE-2019-17495)

Summary IBM Sterling B2B Integrator uses Springfox Swagger. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. ...

CVE-2024-5356

A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2024-5356 anji-plus AJ-Report testTransform;swagger-ui sql injection

A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2024-5356: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The...

PT-2024-35777

Name of the Vulnerable Software and Affected Versions anji-plus AJ-Report versions up to 1.4.1 Description A critical issue was found in the software, affecting an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the dynSentence argument leads to SQL injection. ...

BIT-GITLAB-2021-39910

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature...

GO-2022-0427 Unprotected file upload in github.com/swaggo/http-swagger

The httpSwagger package's HTTP handler provides WebDAV read/write access to an in-memory filesystem. An attacker can exploit this to cause memory exhaustion by uploading many files, XSS attacks by uploading malicious files, or other unexpected behaviors...

http-swagger XSS via PUT requests

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

GHSA-49W7-5R33-JM9M http-swagger XSS via PUT requests

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

CVE-2024-25712

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

Code injection

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...