Vulnerabilities (CVE)

Filtered by vendor Smartbear Subscribe
Total 14 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-25031 1 Smartbear 1 Swagger Ui 2022-06-03 4.3 MEDIUM 4.3 MEDIUM
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
CVE-2021-46708 1 Smartbear 1 Swagger Ui 2022-06-01 4.3 MEDIUM 6.1 MEDIUM
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVE-2019-17495 2 Oracle, Smartbear 6 Banking Apis, Banking Digital Experience, Banking Platform and 3 more 2022-04-06 7.5 HIGH 9.8 CRITICAL
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
CVE-2021-41657 1 Smartbear 1 Codecollaborator 2022-03-16 4.3 MEDIUM 6.5 MEDIUM
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack.
CVE-2020-26118 1 Smartbear 1 Collaborator 2021-07-21 9.0 HIGH 8.8 HIGH
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.
CVE-2020-12835 1 Smartbear 1 Readyapi 2021-07-21 7.5 HIGH 9.8 CRITICAL
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component.
CVE-2021-21364 1 Smartbear 1 Swagger-codegen 2021-03-19 2.1 LOW 5.5 MEDIUM
swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363.
CVE-2021-21363 1 Smartbear 1 Swagger-codegen 2021-03-18 4.4 MEDIUM 7.0 HIGH
swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
CVE-2019-12180 1 Smartbear 2 Readyapi, Soapui 2020-08-24 9.3 HIGH 7.8 HIGH
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.
CVE-2016-5682 1 Smartbear 1 Swagger-ui 2020-05-07 4.3 MEDIUM 6.1 MEDIUM
Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.
CVE-2016-1000229 2 Redhat, Smartbear 3 Jboss Fuse, Openshift, Swagger-ui 2019-12-31 4.3 MEDIUM 6.1 MEDIUM
swagger-ui has XSS in key names
CVE-2018-20580 1 Smartbear 1 Readyapi 2019-05-14 9.3 HIGH 8.8 HIGH
The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
CVE-2017-16670 1 Smartbear 1 Soapui 2018-03-19 6.8 MEDIUM 7.8 HIGH
The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file.
CVE-2014-1202 2 Eviware, Smartbear 2 Soapui, Soapui 2014-01-28 9.3 HIGH N/A
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.