MAL-2024-10764 Malicious code in opa-fe-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0912f1fa265b4c148d99d5ebf17f99f098efa46a5222a44acee011d8ab0680df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opa-fe-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0912f1fa265b4c148d99d5ebf17f99f098efa46a5222a44acee011d8ab0680df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

Details have emerged about a now-patched security flaw in Styra's Open Policy Agent OPA that, if successfully exploited, could have led to leakage of New Technology LAN Manager NTLM hashes. "The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server's local us...

GO-2024-3141 OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa

OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions...

CVE-2024-8260

An SMB force-authentication vulnerability exists in all versions of OPA. The vulnerability exists due to improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or one of the OPA Go library’s functions. Mitigation Mitigation for...

GHSA-C77R-FH37-X2PX OPA for Windows has an SMB force-authentication vulnerability

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

OPA for Windows has an SMB force-authentication vulnerability

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

GHSA-C77R-FH37-X2PX vulnerabilities

Vulnerabilities for packages: spire-server, zot, conftest, k8sgpt, cosign, kubescape, policy-controller, snyk-cli, zarf, opa, tfsec, kots...

CVE-2024-8260

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: spire-server, zot, conftest, k8sgpt, cosign, kubescape, policy-controller, snyk-cli, zarf, opa, tfsec, kots...

CVE-2024-8260 vulnerabilities

Vulnerabilities for packages: policy-controller, spire-server, conftest, conftest-fips, spire-server-fips, zot, k8sgpt, opa, cosign, zarf, kots, cosign-fips, kubescape, snyk-cli, policy-controller-fips, tfsec...

CVE-2024-8260 OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260

Technical details for CVE-2024-8260 are not publicly available in the provided connected documents. The initial description mentions OPA on Windows and an SMB force-authentication issue, but no concrete affected versions, impact, exploit data, or fixes are given here. Monitor for updates.

CVE-2024-8260 OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260 OPA SMB Force-Authentication

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-8260: Authentication Bypass by Capture-replay

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s...

CVE-2024-24786 affecting package opa for versions less than 0.63.0-1

CVE-2024-24786 affecting package opa for versions less than 0.63.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45142 affecting package opa for versions less than 0.63.0-1

CVE-2023-45142 affecting package opa for versions less than 0.63.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package opa for versions less than 0.63.0-1

CVE-2023-45288 affecting package opa for versions less than 0.63.0-1. A patched version of the package is available...

Information Disclosure

fastapi-opa is vulnerable to Information Disclosure. The vulnerability is due to lack of authentication enforcement for HTTP OPTIONS requests by OpaMiddleware, allowing an unauthenticated attacker to determine the existence of entities within the application based on the responses to these reques...