swagger-ui vulnerabilities and exploits

(subscribe to this query)

Swagger-UI prior to 2.2.1 has XSS via the Default field in the Definitions section.

Smartbear Swagger-ui

Swagger UI prior to 4.1.3 could allow a remote malicious user to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

Smartbear Swagger Ui

7 Github repositories

fastify-swagger-ui is a Fastify plugin for serving Swagger UI. before 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fix...

Smartbear Swagger Ui

The swagger-ui-dist package prior to 4.1.3 for Node.js could allow a remote malicious user to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actio...

Smartbear Swagger-ui-dist

swagger-ui has XSS in key names

Smartbear Swagger-ui -Redhat Jboss Fuse 6.3 Redhat Openshift 2.0

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI prior to 3.23.11 allows malicious users to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this pr...

Smartbear Swagger Ui Oracle Utilities Framework 4.3.0.6.0 Oracle Utilities Framework 4.4.0.0.0 Oracle Banking Digital Experience 19.1 Oracle Utilities Framework 4.4.0.2.0 Oracle Banking Digital Experience 19.2 Oracle Banking Digital Experience 20.1 Oracle Primavera Gateway Oracle Banking Platform Oracle Banking Digital Experience 21.1 Oracle Banking Apis Oracle Banking Apis 19.1 Oracle Banking Apis 19.2 Oracle Banking Apis 20.1 Oracle Banking Apis 21.1 Oracle Banking Digital Experience

4 Github repositories

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 prior to 14.3.6, all versions starting from 14.4 prior to 14.4.4, all versions starting from 14.5 prior to 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature.

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an malicious user to execute a DOM Cross-Site Scripting (XSS) attack. As a result...

Sap Commerce Webservices 2.0 1905 Sap Commerce Webservices 2.0 2005 Sap Commerce Webservices 2.0 2105 Sap Commerce Webservices 2.0 2011 Sap Commerce Webservices 2.0 2205

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook