CVE-2024-7314

anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on...

PT-2024-38260 · Anji Plus · Anji-Plus Aj-Report

Name of the Vulnerable Software and Affected Versions: anji-plus AJ-Report versions = 1.4.0 Description: The issue allows a remote and unauthenticated attacker to bypass authentication by appending ";swagger-ui" to HTTP requests, potentially executing arbitrary Java on the victim server. This is...

AJ-Report 安全漏洞

AJ-Report is an open source visual design tool from anji-plus. A security vulnerability exists in AJ-Report versions prior to 1.4.1, which originates from a remote, unauthenticated attacker who can attach swagger-ui to an HTTP request to bypass authentication and execute arbitrary Java on the...

Malicious code in Be.Vlaanderеn.Bаsisregisters.AspNetCore.Swagger (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4153 Malicious code in Be.Vlaanderеn.Bаsisregisters.AspNetCore.Swagger (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaanderеn.Bаsisregіsters.AspNеtCore.Swagger (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaandеren.Basisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4163 Malicious code in Be.Vlaandеren.Basisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոdеren.Bаsisregisters.AspNetCore.Swaggеr.ReDoc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Ionity GmbH: HTML injection in swagger UI

A vulnerability was discovered in the Swagger UI that allowed for HTML injection. This vulnerability existed because the application failed to properly sanitize user-supplied input before rendering it in the HTML context. An attacker could have exploited this issue to execute arbitrary scripts in...

Security Bulletin: B2B API of IBM Sterling B2B Integrator is vulnerable to information disclosure due to Springfox Swagger (CVE-2019-17495)

Summary IBM Sterling B2B Integrator uses Springfox Swagger. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS injection flaw. ...

CVE-2024-5356 anji-plus AJ-Report testTransform;swagger-ui sql injection

A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The...

com.netflix.genie:genie-app (>=3.0.0 <=4.3.17), com.netflix.genie:genie-security (>=4.0.0-rc.1 <=4.0.0-rc.31) +3 more potentially affected by CVE-2024-4701 via com.netflix.genie:genie-web (>=0.22 <=4.3.17)

com.netflix.genie:genie-web MAVEN version =0.22, =3.0.0, =4.0.0-rc.1, =4.0.0, =4.0.0, =0.22, =1.0.1 Source cves: CVE-2024-4701 Source advisory: OSV:GHSA-WPCV-5JGP-69F3...

BIT-GITLAB-2021-39910

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature...

GO-2022-0427 Unprotected file upload in github.com/swaggo/http-swagger

The httpSwagger package's HTTP handler provides WebDAV read/write access to an in-memory filesystem. An attacker can exploit this to cause memory exhaustion by uploading many files, XSS attacks by uploading malicious files, or other unexpected behaviors...

GHSA-49W7-5R33-JM9M http-swagger XSS via PUT requests

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

http-swagger XSS via PUT requests

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

CVE-2024-25712

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

Code injection

http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded via httpSwagger.WrapHandler and webdav.memFile can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because if a solution continued to allow...

http-swagger security vulnerability

http-swagger is a net/http wrapper. A security vulnerability exists in http-swagger versions prior to 1.2.6, which stems from a vulnerability that allows attackers to conduct cross-site scripting XSS attacks via PUT requests...