Cursor’s Magic Comes with a Catch: The Trust Setting You’re Missing

Occasionally, a new AI tool emerges unexpectedly and dominates the conversation on social media. This time, that tool is Cursor, an AI coding platform that’s making waves for simplifying app development with advanced models like Claude 3.5 Sonnet and GPT-4o. In a recent video posted on X, which h...

Ivanti Warns of Active Exploitation of Newly Patched Cloud Appliance Vulnerability

Ivanti has revealed that a newly patched security flaw in its Cloud Service Appliance CSA has come under active exploitation in the wild. The high-severity vulnerability in question is CVE-2024-8190 CVSS score: 7.2, which allows remote code execution under certain circumstances. "An OS command...

GHSA-9JMP-J63G-8X6M Withdrawn Advisory: Lunary information disclosure vulnerability

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

GHSA-6P2Q-8QFQ-WQ7X Withdrawn Advisory: Lunary improper access control vulnerability

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

Withdrawn Advisory: Lunary Improper Authentication vulnerability

Withdrawn Advisory This advisory was incorrectly linked the the npm package lunary. The advisory is valid, but not for that package. Original Advisory A broken access control vulnerability exists prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 of lunary-ai/lunary. The saml.ts file allows...

Withdrawn Advisory: Lunary improper access control vulnerability

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

My TedXBillings Talk

Over the summer, I gave a talk about AI and democracy at TedXBillings. The recording is live. Please share. Im hoping for more than 200 views…...

CVE-2024-6582

A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...

CVE-2024-6862

A Cross-Site Request Forgery CSRF vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for...

CVE-2024-6582

A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...

CVE-2024-6867

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...

CVE-2024-6862

A Cross-Site Request Forgery CSRF vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for...

CVE-2024-6087

An improper access control vulnerability exists in lunary-ai/lunary at the latest commit a761d83 on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target user...

CVE-2024-6087

An improper access control vulnerability exists in lunary-ai/lunary at the latest commit a761d83 on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target user...

CVE-2024-6862 Cross-Site Request Forgery (CSRF) in lunary-ai/lunary

A Cross-Site Request Forgery CSRF vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for...

CVE-2024-6862 Cross-Site Request Forgery (CSRF) in lunary-ai/lunary

A Cross-Site Request Forgery CSRF vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for...

CVE-2024-6862

CVE-2024-6862 concerns lunary-ai/lunary version 1.2.34 with CSRF arising from overly permissive CORS settings. The backend allegedly permits all origins, exposing unauthenticated endpoints and enabling CSRF attacks that can let an attacker sign up for and create projects or operate as a user on l...

CVE-2024-6867 Information Disclosure in lunary-ai/lunary

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...

CVE-2024-6867

The CVE-2024-6867 issue affects lunary-ai/lunary, specifically the runs/{run_id}/related endpoint. The root cause is missing access-control checks, allowing an attacker to retrieve information about non-public runs and their related runs by supplying a run_id. Affected main branch commit: a761d83...

CVE-2024-6867 Information Disclosure in lunary-ai/lunary

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...