Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
71 results · page 2 of 2
Jun 6, 2024An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2.CVE-2024-5131 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID. This issue was fixed in version 1.2.25.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any datasetCVE-2024-5130 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks.CVE-2024-5129 · Other software · lunary-ai · reported by security@huntr.devHigh 8.2
A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2.CVE-2024-5128 · Other software · lunary-ai · reported by security@huntr.devHigh 8.8
An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any dataset_prompt or dataset_prompt_variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access. This vulnerability was fixed in version 1.2.25.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts.CVE-2024-5126 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts. Affected versions include 1.2.2 up to but not including 1.2.25. The vulnerability allows unauthorized users to update prompt details due to insufficient access control checks. This issue was addressed and fixed in version 1.2.25.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use.CVE-2024-5277 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the backend's handling of the reset password process, where the token, once used, is not discarded or invalidated, enabling its reuse. This vulnerability could lead to unauthorized account access if an attacker obtains the recovery token.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign theCVE-2024-5127 · Other software · lunary-ai · reported by security@huntr.devMedium 5.4
In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the oCVE-2024-3504 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2024A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10.CVE-2024-4148 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to.CVE-2024-4154 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the necessary permissions or being assigned to the project. This issue allows for unauthorized modification of project names, potentially leading to confusion or unauthorized access to project resources.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2024An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficieCVE-2024-4151 · Other software · lunary-ai · reported by security@huntr.devHigh 8.1
An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2024In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to mCVE-2024-3761 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a dataset by sending a DELETE request to the endpoint. The issue was fixed in version 1.2.8. The impact of this vulnerability is significant as it permits unauthorized users to delete datasets, potentially leading to data loss or disruption of service.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process.CVE-2024-1739 · Other software · lunary-ai · reported by security@huntr.devCritical 9.1
lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoinCVE-2024-1738 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.get route in the evaluations API endpoint. This vulnerability allows unauthorized users to retrieve the results of any organization's evaluation by simply knowing the evaluation ID, due to the lack of project ID verification in the SQL query. As a result, attackers can gain access to potentially private data contained within the evaluation results.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation.CVE-2024-1666 · Other software · lunary-ai · reported by security@huntr.devMedium 5.3
In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint.CVE-2024-1626 · Other software · lunary-ai · reported by security@huntr.devHigh 8.1
An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, within the project update endpoint. The vulnerability allows authenticated users to modify the name of any project within the system without proper authorization checks, by directly referencing the project's ID in the PATCH request to the '/v1/projects/:projectId' endpoint. This issue arises because the endpoint does not verify if the provided project ID belongs to the currently authenticated user, enabling unauthorized modifications across different organizational projects.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization.CVE-2024-1902 · Other software · lunary-ai · reported by security@huntr.devHigh 7.5
lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an oCVE-2024-1741 · Other software · lunary-ai · reported by security@huntr.devCritical 9.1
lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using CVE-2024-1740 · Other software · lunary-ai · reported by security@huntr.devCritical 9.1
In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organizatCVE-2024-1643 · Other software · lunary-ai · reported by security@huntr.devCritical 9.1
By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The flaw is due to insufficient verification of user permissions when joining an organization.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2024An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organizCVE-2024-1625 · Other software · lunary-ai · reported by security@huntr.devMedium 6.5
An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project's ID. This issue affects the project deletion functionality implemented in the projects.delete route.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.