Search for packages
| purl | pkg:npm/swagger-ui@3.10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-byuc-dyx4-zben
Aliases: CVE-2021-46708 GHSA-6c9x-mj3g-h47x |
Improper Restriction of Rendered UI Layers or Frames The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. |
Affected by 0 other vulnerabilities. |
|
VCID-gdhu-jxfv-k7a9
Aliases: CVE-2019-17495 GHSA-c427-hjc3-wrfw |
Injection Vulnerability A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that `<style>@import` within the JSON data was a functional attack method. |
Affected by 3 other vulnerabilities. |
|
VCID-h64t-4k96-h7d4
Aliases: GHSA-x9p2-fxq6-2m5f GMS-2019-143 |
Reverse Tabnapping in swagger-ui Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks. ## Recommendation Upgrade to version 3.18.0 or later. |
Affected by 5 other vulnerabilities. |
|
VCID-jkux-j1yd-47ep
Aliases: CVE-2018-25031 GHSA-cr3q-pqgq-m8c2 |
Spoofing attack in swagger-ui Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. |
Affected by 0 other vulnerabilities. |
|
VCID-mpx5-7r4y-77a9
Aliases: GHSA-4f9m-pxwh-68hg GMS-2020-782 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in swagger-ui. |
Affected by 4 other vulnerabilities. |
|
VCID-s2s9-qpgy-nffr
Aliases: GHSA-qrmm-w75w-3wpx GMS-2021-188 GMS-2021-327 GMS-2021-44 GMS-2021-470 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in swagger-ui-react. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||