CVE-2017-1000208

A vulnerability in Swagger-Parser's version = 1.0.30 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen = 2.2.2 and can lead to...

CVE-2017-1000208

CVE-2017-1000208 involves Swagger-Parser 1.0.30 and earlier with YAML parsing that enables arbitrary code execution when processing crafted OpenAPI specs. It impacts Swagger Codegen commands generate/validate (

Cross-site Scripting (XSS)

swagger-ui is vulnerable to cross-site scripting XSS attacks. The library does not sanitize href links, allowing a malicious user to inject and execute arbitrary Javascript through these links...

swagger-ui cross-site scripting vulnerability (CNVD-2017-16019)

swagger-ui is a set of API online documentation generation and testing tools . A cross-site scripting vulnerability exists in versions of swagger-ui prior to 2.2.1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross-site Scripting (XSS)

github.com/kubernetes/kubernetes is vulnerable to cross-site scripting XSS. This is because url query param from swagger-UI is not properly handled...

swagger-ui cross-site scripting vulnerability

swagger-ui is a set of API online documentation generation and testing tools . A cross-site scripting vulnerability exists in swagger-ui because the program fails to adequately filter user-submitted input. A remote attacker can exploit this vulnerability to execute arbitrary code in a browser...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...

CVE-2016-5682

Swagger-UI is affected by an XSS vulnerability in the Definitions section via the Default field, affecting versions before 2.2.1. The issue allows a remote attacker to inject script that could run in a victim’s browser and potentially steal cookie-based credentials. Remediation per the provided s...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R2 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Arbitrary File Read And Denial Of Service (DoS)

fury-adapter-swagger is vulnerable to arbitrary file reads off the file system and denial of service DoS attacks. This could be used to retrieve sensitive data, or fill the entire available memory and cause a denial of service by reading/dev/zero...

Arbitrary File Read

Overview Affected versions of fury-adapter-swagger have a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like /dev/zero. Proof of Concept: --- swagger:...

CVE-2016-1000229

It was found that swagger-ui contains a cross site scripting XSS vulnerability in the key names in the JSON document. An attacker could use this flaw to supply a key name with script tags which could cause arbitrary code execution. Additionally it is possible to load the arbitrary JSON files...

Cross-Site Scripting

Overview Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter. Recommendation Update to 2.2.1 or later. References - GitHub Issue - GitHub Advisory...

Cross-Site Scripting

Overview Affected versions of swagger-ui are vulnerable to cross-site scripting. This vulnerability exists because swagger-ui automatically executes external Javascript that is loaded in via the url query string parameter when a Content-Type: application/javascript header is included. An attacker...

Cross-Site Scripting

Overview Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: "definitions": "arbitraryVal": "properties": "": "LoremIpsum" Malicious JSON documents can ...

Cross-Site Scripting

Overview Affected versions of swagger-ui are vulnerable to cross-site scripting in both the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON documents via the query string parameter url, allowing an...

The vulnerability of WebSphere Application Server for application servers allows attackers to increase their privileges.

The vulnerability of the Discovery programming interface implementation in WebSphere Application Server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by using an external reference in the Swagger document...