UBUNTU-CVE-2024-40627

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

CVE-2024-40627

CVE-2024-40627 concerns the Fastapi-OPA OpaMiddleware, which incorrectly allows unauthenticated HTTP OPTIONS requests by bypassing policy evaluation. This can enable an unauthenticated attacker to infer entity existence based on responses, potentially leaking information about writable entities. ...

GHSA-5F5C-8RVC-J8WF OpaMiddleware does not filter HTTP OPTIONS requests

Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...

MAL-2024-7755 Malicious code in moti-another-test2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d69768182e243b62f5e59ad12afa5e852bf7d96caa187facab436fd3b38ca69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7756 Malicious code in moto-test-int (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2387221aed62494dae4d55fdace72a03b718b13dd18dec7ea97b0df19d4865f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7758 Malicious code in transitive-vulnerability-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94b6b18dfb31ebb3155a17b612cec91c947ae2da8b9be46c3e172b779fa40e99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-28950

Name of the Vulnerable Software and Affected Versions Fastapi OPA versions prior to 2.0.1 Description The issue allows unauthenticated attackers to discover which entities exist within an application by sending HTTP OPTIONS requests. This is because OpaMiddleware allows all HTTP OPTIONS requests...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1881)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1905)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for...

RHEL 8 : expat (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - expat: Stack exhaustion in doctype parsing CVE-2022-25313 - libexpat through 2.5.0 allows recursive XML...

VulnCheck KEV: CVE-2024-34102

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference XXE vulnerability that allows for remote code execution...

Malicious code in komcay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3ad3da1b41f64619c16ccbdcd725acffd6c557ba6029fe77287ddec8b6c886 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7715 Malicious code in komcay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3ad3da1b41f64619c16ccbdcd725acffd6c557ba6029fe77287ddec8b6c886 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7713 Malicious code in komcax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62c911bd41972a2fa3147e74bc8e6a7905d586c2f095b8190453f09f9250c613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7722 Malicious code in tilda-date-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b98b7d3c762a3af730da420104e9016e9ca64e0313f7195afe1a8b29be029275 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7717 Malicious code in stylecshert (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd9222f2e9e0e525a219159b5ce16c4ff17fe52d2b7e31e284a8114c681e24a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stylesnox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 231ba61276a9baae8583e87d40a97b7ee4c4dff960555a6df856c57ed2adff0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7711 Malicious code in jqueryxxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fa56bed3cb6a5adca01b8c14e48b17a0c6d2807089f8bf5dbbd4e871a7684d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7702 Malicious code in cloudhost (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06d8e1813e9e9ae1dd5749ee815f32696a16d538138675ee92e5cd2272e6c870 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...