CVE-2025-46569 OPA server Data API HTTP path injection of Rego

Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a singl...

CVE-2025-46569 OPA server Data API HTTP path injection of Rego

Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a singl...

OPA server Data API HTTP path injection of Rego

Impact When run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used...

CVE-2025-46569: Incorrect Authorization

Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a singl...

PT-2025-18710

Name of the Vulnerable Software and Affected Versions Open Policy Agent OPA versions prior to 1.4.0 Description The issue concerns the Open Policy Agent OPA, a general-purpose policy engine. In versions prior to 1.4.0, when run as a server, OPA exposes an HTTP Data API. A crafted HTTP request pat...

CVE-2025-42603 Information Disclosure Vulnerability in Meon KYC solutions

This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive...

CVE-2024-47053

CVE-2024-47053 concerns an authorization flaw in Mautic’s API. Any authenticated user can access all reports and their data via the API, bypassing permissions intended to restrict access to non-system reports (e.g., View Own/View Others). The vulnerability arises from Mautic’s HTTP Basic Authenti...

Apache Superset SQL Injection Vulnerability (CNVD-2024-26534)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit the vulnerability to...

PT-2024-20550

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0 Description A guest user could exploit a chart data REST API and send arbitrary SQL statements that, on error, could leak information from the underlying...

FMDataAPI Cross-Site Scripting Vulnerability

FMDataAPI is a class of Masayuki Nii personal developer. It is used to access FileMaker databases using the FileMaker Data API. A cross-site scripting vulnerability exists in FMDataAPI version 22 and earlier, which stems from a problem in the file FMDataAPISample.php that can lead to cross-site...

Malicious code in @squareup/data-api.js-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 351c78770a4888af009e5d2270940bb942890cf8ceb18057cf2f33f709ba191a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Stripo Inc: Non-revoked API Key Information disclosure via Stripo_report()

Talking about 983331 reports where a security researcher reported secret API key leakage vulnerability in a JavaScript file at Stripo. This report is disclosed on HackerOne, and the team at Stripo have forgotten to blur the API keys from the report before disclosing it to the public. The API keys...

MAL-2022-1194 Malicious code in aws-data-api-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e36620b1bbf035669a206034da9186c8aa8a8926a9288ee9fd34545aa6fc9ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aws-data-api-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e36620b1bbf035669a206034da9186c8aa8a8926a9288ee9fd34545aa6fc9ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in data-api.js-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68057aab80a4b5d9446687fc971935efb298ebbb4631efbd5780649ef2f35ec6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @epc-libraries/data-api-versions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f82fc77aff4c8f44ec626ff023762b926e5407f3b269db521d9006777e956242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-12834

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...

spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

Important: Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update

A minor version update from 7.5 to 7.6 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

PHPMyWind data/api/oauth/connect.php reflective cross-site scripting vulnerability

PHPMyWind is a PHP + MySQL based development , W3C standard building engine . A reflective cross-site scripting vulnerability exists in PHPMyWind data/api/oauth/connect.php. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...