com.github.xiaodongw:swagger-finatra_2.11 (>=0.7.0, <=0.7.2), io.paradoxical:finatra-server_2.12 (>=1.0.1, <=1.0.2) +7 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.2.8)

org.webjars:swagger-ui MAVEN version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.github.xiaodongw:swagger-finatra2.11 =0.7.0, =1.0.1, =1.0.1, =0.6.0, =0.5.0, =0.5.0, =0.6.0, =0.6.0, =0.5.0,...

com.danhaywood.mavendeps:isiswebapp (>=0.0.1, <=0.0.2), org.apache.isis.core:isis-core-viewer-restfulobjects-server (>=1.11.0, <=1.14.0) +1 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.3)

org.webjars:swagger-ui MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.danhaywood.mavendeps:isiswebapp =0.0.1, =1.11.0, =1.14.0 - org.incode.mavendeps:isiswebapp 1.14.0 Source cves:...

org.rouplex:rouplex-deployment-service-provider-jersey (>=1.0.0, <=1.0.1), org.rouplex:rouplex-deployment-webapp (>=1.0.0, <=1.0.1) +2 more potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.2.5)

org.webjars:swagger-ui MAVEN version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - org.rouplex:rouplex-deployment-service-provider-jersey =1.0.0, =1.0.0, =1.0.0, =1.0.4 - tv.cntt:xitrum2.11 3.28.1...

Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

GHSA-C427-HJC3-WRFW Cross-site scripting in Swagger-UI

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: OSV:GHSA-C427-HJC3-WRFW...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: GHSA-C427-HJC3-WRFW...

com.gitblit.fathom:fathom-integration-test (>=0.7.0, <=0.8.1), com.gitblit.fathom:fathom-rest-swagger (>=0.7.0, <=0.8.1) potentially affected by CVE-2019-17495 via org.webjars:swagger-ui (2.1.2)

org.webjars:swagger-ui MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - com.gitblit.fathom:fathom-integration-test =0.7.0, =0.7.0, =0.8.1 Source cves: CVE-2019-17495 Source advisory:...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Design/Logic Flaw

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2019-17495

CVE-2019-17495 is a CSS injection flaw in Swagger UI prior to 3.23.11 using the Relative Path Overwrite (RPO) technique that can lead to exfiltration of sensitive data (e.g., CSRF tokens) via CSS-based input field values. Concrete details across connected docs show multiple IBM advisories referen...

ai.hyacinth.framework:core-service-endpoint-support (>=0.5.0, <=0.5.24), ai.hyacinth.framework:core-service-swagger-support (>=0.5.0, <=0.5.24) +1675 more potentially affected by CVE-2019-17495 via io.springfox:springfox-swagger-ui (>=2.0.1, <=2.9.2)

io.springfox:springfox-swagger-ui MAVEN version =2.0.1, =0.5.0, =0.5.0, =0.5.0, =0.9.6, =0.5.0, =0.2.0, =0.4.0, =0.1.0, =0.7, =3.0.0.release, =3.0.0.release, =3.0.0.release, =2.3.2-beta.3, =2.3.2-beta.7 and more Source cves: CVE-2019-17495 Source advisory: MEND:CVE-2019-17495...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

@activeledger/activecore (>=2.0.0-rc5, <=2.0.0-rc.8.0.6), @aktr/node-module-a (1.0.1) +189 more potentially affected by CVE-2019-17495 via swagger-ui (>=2.0.2, <=3.20.7)

swagger-ui NPM version =2.0.2, =2.0.0-rc5, =1.4.0, =0.0.4, =1.0.2, =7.0.0, =1.3.0, =3.0.0-alpha.0, =0.7.2, =3.0.1, =2.0.0, =0.0.1, =0.2.1 and more Source cves: CVE-2019-17495 Source advisory: MEND:CVE-2019-17495...

Swagger UI Injection Vulnerability

Swagger UI is an open source tool that supports visualizing API resources and being able to interact with them. An injection vulnerability exists in Swagger UI versions prior to 3.23.11, which can be exploited by an attacker to disclose information e.g., cross-site requests to forge token values...

PT-2019-5682

Name of the Vulnerable Software and Affected Versions Swagger UI versions prior to 3.23.11 Description The issue is related to a Cascading Style Sheets CSS injection vulnerability in Swagger UI. This vulnerability can be exploited by a remote attacker to perform a cross-site scripting attack. The...

CVE-2019-17495: Cross-Site Request Forgery (CSRF)

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

Path Traversal

Overview All versions of @wturyn/swagger-injector are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured dist folder using relative paths. Recommendation No fix is currently available. Consider using an alternative...