339 matches found
CVE-2024-42818
A cross-site scripting XSS vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
CVE-2024-42818
A cross-site scripting XSS vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
FastAPI Admin 安全漏洞
FastAPI Admin is FastAPI Admin open source a fast administration dashboard based on FastAPI and TortoiseORM. A security vulnerability exists in FastAPI Admin version v0.1.4, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary web...
FastAPI Admin 安全漏洞
FastAPI Admin is FastAPI Admin open source a fast administration dashboard based on FastAPI and TortoiseORM. A security vulnerability exists in FastAPI Admin version v0.1.4, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary web...
CVE-2024-42816
A cross-site scripting XSS vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
CVE-2024-42818
CVE-2024-42818 is a cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4, allowing injection of arbitrary scripts/HTML via the Product Name parameter. Multiple connected sources corroborate the issue and its scope. Public data do not specify a confirm...
CVE-2024-42816
A cross-site scripting XSS vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
PT-2024-30175
Name of the Vulnerable Software and Affected Versions fastapi-admin pro version 0.1.4 Description A cross-site scripting XSS vulnerability in the Create Product function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
CVE-2024-42816
The CVE-2024-42816 issue affects fastapi-admin pro v0.1.4, where the Create Product function is vulnerable to Cross‑Site Scripting (XSS) through a crafted payload in the Product Name parameter. Multiple sources (NVD, Red Hat, Veracode, GHSA) describe that insufficient validation/sanitization of P...
Information Disclosure
fastapi-opa is vulnerable to Information Disclosure. The vulnerability is due to lack of authentication enforcement for HTTP OPTIONS requests by OpaMiddleware, allowing an unauthenticated attacker to determine the existence of entities within the application based on the responses to these reques...
CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
UBUNTU-CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627
CVE-2024-40627 concerns the Fastapi-OPA OpaMiddleware, which incorrectly allows unauthenticated HTTP OPTIONS requests by bypassing policy evaluation. This can enable an unauthenticated attacker to infer entity existence based on responses, potentially leaking information about writable entities. ...
CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
OpaMiddleware does not filter HTTP OPTIONS requests
Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...
GHSA-5F5C-8RVC-J8WF OpaMiddleware does not filter HTTP OPTIONS requests
Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...
PT-2024-28950
Name of the Vulnerable Software and Affected Versions Fastapi OPA versions prior to 2.0.1 Description The issue allows unauthenticated attackers to discover which entities exist within an application by sending HTTP OPTIONS requests. This is because OpaMiddleware allows all HTTP OPTIONS requests...