Lunary authorization issue vulnerability

lunary is lunary open source a production toolkit for LLM . An authorization issue vulnerability exists in lunary that stems from /bigquery API routing without proper access control, no detailed vulnerability details are provided at this time...

CVE-2024-9095: Missing Authorization

In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery and export the entire database. This includes sensitive data such as password hashes and secret API keys. The route is protected by a...

CVE-2024-8999: Missing Authorization

lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...

Lunary Access Control Error Vulnerability

Lunary is Lunary open source a production toolkit for LLM . Lunary suffers from an Access Control Error vulnerability that originates from the POST /api/v1/data-warehouse/bigquery endpoint without proper access control, which can be exploited by an attacker to obtain sensitive information...

dbt (0.19.1rc2), dbt-bigquery (0.19.1rc2) +2 more potentially affected by CVE-2024-40637 via dbt-core (0.19.1rc2)

dbt-core PYPI version 0.19.1rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc2 - dbt-bigquery 0.19.1rc2 - dbt-postgres 0.19.1rc2 - dbt-redshift 0.19.1rc2 Source cves: CVE-2024-40637 Source advisory:...

dbt (0.18.1b2), dbt-bigquery (0.18.1b2) +2 more potentially affected by CVE-2024-40637 via dbt-core (0.18.1b2)

dbt-core PYPI version 0.18.1b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.1b2 - dbt-bigquery 0.18.1b2 - dbt-postgres 0.18.1b2 - dbt-redshift 0.18.1b2 Source cves: CVE-2024-40637 Source advisory:...

dbt (0.18.0b2), dbt-bigquery (0.18.0b2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.18.0b2)

dbt-core PYPI version 0.18.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.18.0b2 - dbt-bigquery 0.18.0b2 - dbt-postgres 0.18.0b2 - dbt-redshift 0.18.0b2 - dbt-snowflake 0.18.0b2 Source cves: CVE-2024-40637...

dbt (0.17.1), dbt-azuresynapse (1.0.0) +7 more potentially affected by CVE-2024-40637 via dbt-core (0.17.1)

dbt-core PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.1 - dbt-azuresynapse 1.0.0 - dbt-bigquery 0.17.1 - dbt-postgres 0.17.1 - dbt-presto 0.17.1 - dbt-redshift 0.17.1 - dbt-schema-builder...

dbt (0.20.1), dbt-bigquery (0.20.1) +8 more potentially affected by CVE-2024-40637 via dbt-core (0.20.1)

dbt-core PYPI version 0.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.1 - dbt-bigquery 0.20.1 - dbt-clickhouse 0.20.1 - dbt-materialize 0.20.1 - dbt-mysql 0.20.1 - dbt-postgres 0.20.1 - dbt-presto 0.20.1 ...

dbt (0.20.0rc2), dbt-bigquery (0.20.0rc2) +5 more potentially affected by CVE-2024-40637 via dbt-core (0.20.0rc2)

dbt-core PYPI version 0.20.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.20.0rc2 - dbt-bigquery 0.20.0rc2 - dbt-postgres 0.20.0rc2 - dbt-presto 0.20.0rc2 - dbt-redshift 0.20.0rc2 - dbt-snowflake 0.20.0rc2 -...

dbt (0.19.2rc2), dbt-bigquery (0.19.2rc2) +4 more potentially affected by CVE-2024-40637 via dbt-core (0.19.2rc2)

dbt-core PYPI version 0.19.2rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.2rc2 - dbt-bigquery 0.19.2rc2 - dbt-postgres 0.19.2rc2 - dbt-presto 0.19.2rc2 - dbt-redshift 0.19.2rc2 - dbt-spark 0.19.2rc2 Source...

dbt (0.19.1b2), dbt-bigquery (0.19.1b2) +4 more potentially affected by CVE-2024-40637 via dbt-core (0.19.1b2)

dbt-core PYPI version 0.19.1b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1b2 - dbt-bigquery 0.19.1b2 - dbt-postgres 0.19.1b2 - dbt-presto 0.19.1b2 - dbt-redshift 0.19.1b2 - dbt-spark 0.19.1b2 Source cves:...

dbt (0.21.0b1), dbt-bigquery (0.21.0b1) +5 more potentially affected by CVE-2024-40637 via dbt-core (0.21.0b1)

dbt-core PYPI version 0.21.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.21.0b1 - dbt-bigquery 0.21.0b1 - dbt-postgres 0.21.0b1 - dbt-presto 0.21.0b1 - dbt-redshift 0.21.0b1 - dbt-snowflake 0.21.0b1 - dbt-spa...

dbt (0.19.0rc1), dbt-bigquery (0.19.0rc1) +5 more potentially affected by CVE-2024-40637 via dbt-core (0.19.0rc1)

dbt-core PYPI version 0.19.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.0rc1 - dbt-bigquery 0.19.0rc1 - dbt-mysql 0.19.0rc1 - dbt-postgres 0.19.0rc1 - dbt-presto 0.19.0rc1 - dbt-redshift 0.19.0rc1 -...

dbt (0.17.0rc2), dbt-bigquery (0.17.0rc2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.17.0rc2)

dbt-core PYPI version 0.17.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.0rc2 - dbt-bigquery 0.17.0rc2 - dbt-postgres 0.17.0rc2 - dbt-redshift 0.17.0rc2 - dbt-snowflake 0.17.0rc2 Source cves: CVE-2024-406...

dbt (0.16.0rc2), dbt-bigquery (0.16.0rc2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.16.0rc2)

dbt-core PYPI version 0.16.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0rc2 - dbt-bigquery 0.16.0rc2 - dbt-postgres 0.16.0rc2 - dbt-redshift 0.16.0rc2 - dbt-snowflake 0.16.0rc2 Source cves: CVE-2024-406...

dbt (0.16.0b2), dbt-bigquery (0.16.0b2) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.16.0b2)

dbt-core PYPI version 0.16.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.16.0b2 - dbt-bigquery 0.16.0b2 - dbt-postgres 0.16.0b2 - dbt-redshift 0.16.0b2 - dbt-snowflake 0.16.0b2 Source cves: CVE-2024-40637...

dbt (0.19.1rc1), dbt-bigquery (0.19.1rc1) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.19.1rc1)

dbt-core PYPI version 0.19.1rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.19.1rc1 - dbt-bigquery 0.19.1rc1 - dbt-postgres 0.19.1rc1 - dbt-redshift 0.19.1rc1 - dbt-spark 0.19.1rc1 Source cves: CVE-2024-40637...

airflow-dbt-python (>=0.5.1, <=0.7.2), dbt (0.20.2) +12 more potentially affected by CVE-2024-40637 via dbt-core (0.20.2)

dbt-core PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - airflow-dbt-python =0.5.1, =0.2.0, =0.2.0, =0.20.0rc1, =0.2.0a0, =0.2.0 Source cves: CVE-2024-40637 Source advisory: OSV:PYSEC-2024-66...

dbt (0.17.1rc3), dbt-bigquery (0.17.1rc3) +3 more potentially affected by CVE-2024-40637 via dbt-core (0.17.1rc3)

dbt-core PYPI version 0.17.1rc3 is affected by a known vulnerability. The following packages have a transitive dependency on dbt-core and may be impacted: - dbt 0.17.1rc3 - dbt-bigquery 0.17.1rc3 - dbt-postgres 0.17.1rc3 - dbt-redshift 0.17.1rc3 - dbt-snowflake 0.17.1rc3 Source cves: CVE-2024-406...