Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter. Recommendation Update to 2.2.1 or later...

GHSA-G336-C7WV-8HP3 Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter. Recommendation Update to 2.2.1 or later...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by unknown CVE via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G336-C7WV-8HP3...

Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting. This vulnerability exists because swagger-ui automatically executes external Javascript that is loaded in via the url query string parameter when a Content-Type: application/javascript header is included. An attacker can crea...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by CVE-2016-1000233 via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: CVE-2016-1000233 Source advisory: OSV:GHSA-MRX7-8HXF-F853...

GHSA-MRX7-8HXF-F853 Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting. This vulnerability exists because swagger-ui automatically executes external Javascript that is loaded in via the url query string parameter when a Content-Type: application/javascript header is included. An attacker can crea...

Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: "definitions": "arbitraryVal": "properties": "": "LoremIpsum" Malicious JSON documents can be loaded...

GHSA-P239-93F7-H6XF Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: "definitions": "arbitraryVal": "properties": "": "LoremIpsum" Malicious JSON documents can be loaded...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by CVE-2016-5682 via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: CVE-2016-5682 Source advisory: OSV:GHSA-P239-93F7-H6XF...

Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting in both the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON documents via the query string parameter url, allowing an attacker...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by CVE-2016-1000226 via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: CVE-2016-1000226 Source advisory: OSV:GHSA-7F59-X49P-V8MQ...

GHSA-7F59-X49P-V8MQ Cross-Site Scripting in swagger-ui

Affected versions of swagger-ui are vulnerable to cross-site scripting in both the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON documents via the query string parameter url, allowing an attacker...

PT-2020-7939

Name of the Vulnerable Software and Affected Versions: swagger-ui versions prior to 2.2.1 Description: The issue exists due to the automatic execution of external Javascript loaded via the url query string parameter when a Content-Type: application/javascript header is included. An attacker can...

PT-2020-21291

Name of the Vulnerable Software and Affected Versions swagger-ui versions prior to 2.2.1 Description The issue concerns cross-site scripting via the url query string parameter. Recommendations Update to version 2.2.1 or later...

PT-2020-7947

Name of the Vulnerable Software and Affected Versions: fury-adapter-swagger versions 0.2.0 through 0.9.7 Description: The issue allows an attacker to read arbitrary files off the system, potentially leading to the exposure of sensitive data or causing a denial of service condition by attempting t...

PT-2020-7934

Name of the Vulnerable Software and Affected Versions: swagger-ui versions prior to 2.2.1 Description: The issue concerns cross-site scripting in the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON...

Security Bulletin: Novalink is impacted by Swagger vulnerability affects WebSphere Application Server Liberty

Summary Novalink uses WebSphere Application Server Liberty. There is a Swagger vulnerability that affects WebSphere Application Server Liberty. This affects the mpOpen-1.x and openAPI-3.x features. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION:...

Dynamic Swagger Support Comes to Imperva

It’s no secret that the shift to DevOps deployments has taken center stage at organizations small and large. The ability to quickly configure, manage and update via APIs is critical to a company’s ability to push out small iterative changes, without human intervention. And Swagger has become the...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM StoredIQ (CVE-2019-17495)

Summary There is a Swagger vulnerability that affects WebSphere Application Server Liberty shipped with IBM StoredIQ. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. By using the...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM StoredIQ InstaScan (CVE-2019-17495)

Summary There is a Swagger vulnerability that affects WebSphere Application Server Liberty shipped with IBM StoredIQ InstaScan. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. By usi...