CVE-2024-9095

In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery and export the entire database. This includes sensitive data such as password hashes and secret API keys. The route is protected by a...

CVE-2024-9095

creationtimestamp| type| source ---|---|--- 2025-03-20 11:40:52+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lksmi2bray2p 2025-03-20 12:48:36+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114194836039010317 2025-03-20 19:18:37+00:00|...

CVE-2024-9095

In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery and export the entire database. This includes sensitive data such as password hashes and secret API keys. The route is protected by a...