754 matches found
FastAPI Admin security vulnerabilities
FastAPI Admin is FastAPI Admin open source a fast administration dashboard based on FastAPI and TortoiseORM. A security vulnerability exists in FastAPI Admin version v0.1.4, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary web...
CVE-2024-42818
The software fastapi-admin pro version v0.1.4 is vulnerable to a cross-site scripting (XSS) vulnerability within the Config-Create function. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Product Name parameter. To remediate this issue, users should ...
CVE-2024-42818
A cross-site scripting XSS vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
CVE-2024-42816
A cross-site scripting (XSS) vulnerability exists in the Create Product function of fastapi-admin pro v0.1.4 . An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Product Name parameter. To remediate this issue, users should upgrade to version 0.1.5 . Unt...
Information Disclosure
fastapi-opa is vulnerable to Information Disclosure. The vulnerability is due to lack of authentication enforcement for HTTP OPTIONS requests by OpaMiddleware, allowing an unauthenticated attacker to determine the existence of entities within the application based on the responses to these reques...
CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
UBUNTU-CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627
CVE-2024-40627 concerns the Fastapi-OPA OpaMiddleware, which incorrectly allows unauthenticated HTTP OPTIONS requests by bypassing policy evaluation. This can enable an unauthenticated attacker to infer entity existence based on responses, potentially leaking information about writable entities. ...
fastflows (>=0.1.0.dev1656870221, <=0.1.2) potentially affected by CVE-2024-40627 via fastapi-opa (1.4.8)
fastapi-opa PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-opa and may be impacted: - fastflows =0.1.0.dev1656870221, =0.1.2 Source cves: CVE-2024-40627 Source advisory: MEND:CVE-2024-40627...
CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
CVE-2024-40627
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
fastflows (>=0.1.0.dev1656870221, <=0.1.2) potentially affected by CVE-2024-40627 via fastapi-opa (1.4.8)
fastapi-opa PYPI version 1.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-opa and may be impacted: - fastflows =0.1.0.dev1656870221, =0.1.2 Source cves: CVE-2024-40627 Source advisory: OSV:GHSA-5F5C-8RVC-J8WF...
GHSA-5F5C-8RVC-J8WF OpaMiddleware does not filter HTTP OPTIONS requests
Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...
OpaMiddleware does not filter HTTP OPTIONS requests
Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...
PT-2024-28950
Name of the Vulnerable Software and Affected Versions Fastapi OPA versions prior to 2.0.1 Description The issue allows unauthenticated attackers to discover which entities exist within an application by sending HTTP OPTIONS requests. This is because OpaMiddleware allows all HTTP OPTIONS requests...
CVE-2024-40627: Observable Response Discrepancy
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
