CVE-2024-8999

lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...

CVE-2024-8999

Lunary (lunary-ai/lunary) v1.4.25 contains an improper access control vulnerability in POST /api/v1/data-warehouse/bigquery, allowing unauthenticated/export of the entire database to Google BigQuery. Root cause: insufficient access checks on the data-warehouse/bigquery endpoint. Impact is high (c...

CVE-2024-8999 Improper Access Control in lunary-ai/lunary

lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...

CVE-2024-9095

In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery and export the entire database. This includes sensitive data such as password hashes and secret API keys. The route is protected by a...

PT-2025-12258

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version v1.4.25 Description The issue is an improper access control vulnerability in the "POST /api/v1/data-warehouse/bigquery" endpoint. This allows any user to export the entire database data by creating a stream to Google...

CVE-2024-8999: Missing Authorization

lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...

CVE-2024-0551

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for...

CVE-2024-12269

The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...

CVE-2024-12269

CVE-2024-12269 affects the Safe Ai Malware Protection for WP WordPress plugin. A missing capability check in export_db() in all versions up to and including 1.0.17 allows unauthenticated attackers to retrieve a complete dump of the site’s database. Connected sources confirm the vulnerability and ...

CVE-2024-12269 Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export

The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...

CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...

SOPlanning security vulnerabilities

SOPlanning is a suite of online project management software from SOPlanning. A security vulnerability exists in SOPlanning. An attacker exploiting the vulnerability could access the underlying database by exporting it as a CSV file...

PT-2024-21655

Name of the Vulnerable Software and Affected Versions SO Planning tool versions prior to 1.52.02 Description An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use...

CVE-2024-0551

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for...

Design/Logic Flaw

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for...

CVE-2024-0551 Download and export of file via default user role

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for...

CVE-2024-0551

CVE-2024-0551 describes an access-control error that allows exporting the database and related data via the default user role for users with prior system access. The export mechanism uses a deterministic name, and the download is initiated by the UI before the export is deleted from the system, i...

CVE-2024-0551

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for...

AnythingLLM Access Control Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. An access control error vulnerability exists in AnythingLLM. An attacker could use this vulnerability to gain access to the system and export database information...

PT-2024-15651 · Git +2 · Anything-Llm +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows exports of the database and associated exported information of the system via the default user role. An attacker would need to have been granted access to the system prior...