PatchFirst · Vulnérabilités récentes
Vulnérabilité publiée pour yapi-vendor au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.
Vulnérabilités : 4
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests
Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.