CVE-2023-51515

CVE-2023-51515 affects Uncode Core (WordPress plugin) up to version 2.8.8, with a Missing Authorization vulnerability enabling Privilege Escalation. Multiple sources confirm the issue and that a fix exists; remediation is to upgrade to a non-vulnerable version (patched). If upgrading is not immed...

CVE-2023-51499

CVE-2023-51499 affects the WordPress WooCommerce Shipping Per Product plugin. Connected sources describe a Missing Authorization/Broken Access Control flaw in versions up to 2.5.4, enabling unauthorized access to affected resources. Remediation per sources is to upgrade to a fixed version (2.5.5+...

CVE-2022-40211

CVE-2022-40211 affects the WordPress GiveWP plugin

CVE-2024-0881

The CVE-2024-0881 entry concerns the WordPress Combo Blocks ecosystem (Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel) prior to version 2.2.76. Root cause: improper access control allows unauthenticated AJAX actions to reveal password-protected posts, enabling ...

CVE-2023-6257

CVE-2023-6257 affects the WordPress plugin Inline Related Posts (before v3.6.0). The root cause is missing authorization in an AJAX action that serves post content to authenticated users, enabling subscribers to read content from password-protected posts. Reported base CVSS v3.1 score is 4.3 (Med...

CVE-2023-29483

CVE-2023-29483 affects dnspython (used with eventlet) and enables a remote attacker to interfere with DNS name resolution by sending an invalid UDP packet before a valid one (a TuDoor attack). Affected combo: eventlet before 0.35.2 used in dnspython before 2.6.0. The note indicates 2.6.0 is unusa...

CVE-2024-1902

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

CVE-2024-1902

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

CVE-2024-1643

By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The fla...

CVE-2024-1902 Session Reuse Vulnerability in lunary-ai/lunary

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

CVE-2024-1902

CVE-2024-1902 affects lunary-ai/lunary. The issue is a session-reuse vulnerability where a removed user can alter an organization’s name using an old authorization token via the orgs.patch route. Root cause: lack of validation to verify membership in the organization before permitting changes, du...

CVE-2024-1902 Session Reuse Vulnerability in lunary-ai/lunary

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

CVE-2024-1740 Incorrect Authorization in lunary-ai/lunary

In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which...

CVE-2024-1740 Incorrect Authorization in lunary-ai/lunary

In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which...

CVE-2024-1643

CVE-2024-1643 affects lunary (production toolkit for LLMs). The issue is unauthorized organization access: an attacker can join an organization by knowing its ID and gain read/write access to all data due to insufficient verification of user permissions when joining. The connected documents consi...

CVE-2024-1643 Unauthorized Organization Access in lunary-ai/lunary

By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The fla...

CVE-2024-2243

CVE-2024-2243 affects the csmock component used with OSH (OAuth? Kerberos-based) in Tencent/TencentOS and Fedora/RHEL packaging. The vulnerability allows a regular OSH-service user (anyone with a Kerberos ticket) to disclose the confidential Snyk authentication token and to run arbitrary commands...

CVE-2024-2428

The Ultimate Video Player For WordPress plugin (version

CVE-2023-6385

CVE-2023-6385 affects the WordPress Ping Optimizer plugin up to version 2.35.1.3.0. The vulnerability stems from missing CSRF checks in certain areas, enabling an attacker to cause logged-in users to perform unwanted actions (e.g., clearing logs) via CSRF. Several trusted sources (NVD, CVE feeds,...

PT-2024-18176 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 0.3.0 Description: An Insecure Direct Object Reference IDOR vulnerability exists, allowing unauthorized deletion of any organization's project. The issue is due to insufficient authorization checks in the project...