Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
74 results · page 2 of 2
Jan 15, 2024fastify-swagger-ui is a Fastify plugin for serving Swagger UI.CVE-2024-22207 · Other software · fastify · reported by GitHubMedium 5.3
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
- Product
- fastify-swagger-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) andCVE-2023-6073 · Other software · Volkswagen · reported by cve@asrg.ioMedium 5.7
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
- Product
- ID.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OCVE-2023-38337 · Other software · Rswag Project · reported by MITREHigh 7.5
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
- Product
- Rswag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2023A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via CVE-2023-34733 · Other software · VW · reported by MITREMedium 6.8
A lack of exception handling in the Volkswagen Discover Media Infotainment System Software Version 0876 allows attackers to cause a Denial of Service (DoS) via supplying crafted media files when connecting a device to the vehicle's USB plug and play feature.
- Product
- Discover Media Infotainment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023SwagPayPal is a PayPal integration for shopware/platform.CVE-2023-23941 · Other software · shopware · reported by GitHubHigh 7.5
SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has been fixed with version 5.4.4. As a workaround, disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.
- Product
- SwagPayPal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusCVE-2022-41266 · Websites & servers · SAP · reported by cna@sap.comHigh 8
Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untrusted sources, which can be leveraged by an attacker to execute a DOM Cross-Site Scripting (XSS) attack. As a result, an attacker may be able to steal user tokens and achieve a full account takeover including access to administrative tools in SAP Commerce.
- Product
- Commerce Webservices 2.0 (Swagger UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 10, 2022The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31524 · Other software · Purestorage · reported by MITRECritical 9.3
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Pure Swagger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0.CVE-2022-24863 · Other software · swaggo · reported by GitHubHigh 7.5
http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workaround.
- Product
- http-swagger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim.CVE-2021-46708 · Other software · Smartbear · reported by MITREMedium 6.1
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
- Product
- Swagger-ui-dist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.snyk.io
Mar 11, 2022Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.CVE-2018-25031 · Other software · smartbear · reported by MITREMedium 4.3
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.
- Product
- swagger_ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Embed Swagger: Reflected Cross-Site ScriptingCVE-2022-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
- Product
- Embed Swagger
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Embed Swagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Mar 10, 2021swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languagesCVE-2021-21364 · Other software · swagger-api · reported by GitHubMedium 5.3
swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363.
- Product
- swagger-codegen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languagesCVE-2021-21363 · Other software · swagger-api · reported by GitHubMedium 5.3
swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
- Product
- swagger-codegen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary cCVE-2020-28656 · Other software · VW · reported by MITREMedium 6.8
The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed, which can cause attacker-controlled files to be written to the infotainment system and executed as root.
- Product
- Polo Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontextis.comcontextis.com
Dec 20, 2019swagger-ui has XSS in key namesCVE-2016-1000229 · Other software · Smartbear · reported by MITREMedium 6.1
swagger-ui has XSS in key names
- Product
- Swagger-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Oct 10, 2019A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perfoCVE-2019-17495 · Other software · Smartbear · reported by MITRECritical 9.8
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
- Product
- Swagger UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2019In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possiCVE-2019-16332 · WordPress plugins & themes · reported by MITREMedium 6.1
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
- Product
- api-bearer-auth
- Fixed in
- 20190907
- What to do
- Update api-bearer-auth to 20190907 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Aug 20, 2019IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger.CVE-2019-4437 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comexchange.xforce.ibmcloud.com
Mar 1, 2018This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.CVE-2018-1170 · Other software · Volkswagen · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Link App and Customer-Link Bridge. The issue results from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN messages. Was ZDI-CAN-5264.
- Product
- Volkswagen Customer-Link App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Nov 27, 2017A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed wCVE-2017-1000207 · Other software · Swagger · reported by MITREHigh 8.8
A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
- Product
- Swagger-codegen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml OpenCVE-2017-1000208 · Other software · Swagger · reported by MITREHigh 8.8
A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
- Product
- Swagger-codegen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2017Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.CVE-2016-5682 · Other software · Smartbear · reported by cret@cert.orgMedium 6.1
Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.
- Product
- Swagger-ui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.rapid7.comcommunity.rapid7.com
Dec 14, 2007Buffer overflow in the sw_rpc_agent_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23CVE-2007-6195 · Other software · HP · reported by MITREHigh 10
Buffer overflow in the sw_rpc_agent_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23 allows remote attackers to execute arbitrary code or cause a denial of service via malformed arguments in an opcode 0x04 DCE RPC request.
- Product
- Hp-ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Mar 24, 2006Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecCVE-2006-1389 · Other software · HP · reported by MITREHigh 7.8
Unspecified vulnerability in swagentd in HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
- Product
- Hp-ux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.