CVE-2024-7767 Improper Access Control in danswer-ai/danswer

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...

CVE-2024-7767

CVE-2024-7767 affects danswer-ai/danswer v0.3.94. The root cause is improper access control, enabling the first user created in the system to view, modify, and delete chats created by an Admin. Reported impact includes unauthorized access to sensitive information and potential data integrity issu...

CVE-2024-7767 Improper Access Control in danswer-ai/danswer

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...

CVE-2024-8183 CORS Misconfiguration in prefecthq/prefect

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and...

CVE-2024-8183

CVE-2024-8183 affects the Prefect framework (prefect, v2.20.2). The issue is a misconfigured Cross-Origin Resource Sharing (CORS) policy that permits unauthorized domains to access sensitive data, potentially enabling unauthorized access to the database and leading to data leaks, confidentiality ...

CVE-2024-8183 CORS Misconfiguration in prefecthq/prefect

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and...

CVE-2024-11301 Improper Enforcement of Unique Constraint in lunary-ai/lunary

In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator...

CVE-2024-11301 Improper Enforcement of Unique Constraint in lunary-ai/lunary

In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator...

CVE-2024-11301

CVE-2024-11301 affects lunary-ai/lunary prior to 1.6.3. The issue is the absence of a unique constraint on the combination of projectId and slug when creating evaluators, allowing an attacker to overwrite an existing evaluator by submitting a POST with the same slug. This leads to data integrity ...

CVE-2024-6827 HTTP Request Smuggling in benoitc/gunicorn

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data...

CVE-2024-6827 HTTP Request Smuggling in benoitc/gunicorn

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data...

CVE-2024-6827

CVE-2024-6827 affects Gunicorn 21.2.0 where Transfer-Encoding is not properly validated, causing fallback to Content-Length and TE.CL HTTP request smuggling. This can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, and data integrity issues. Root cause: improper vali...

CVE-2024-9096 Improper Authorization in lunary-ai/lunary

In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks proper access control, such as middleware to ensure that only authorized users e.g., project owners or admins can modify checklist data. This...

CVE-2024-9000 Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary

In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...

CVE-2024-9000

In lunary-ai/lunary prior to version 1.4.26, the checklists.post endpoint lacks proper authorization checks, allowing unauthorized users to create or modify checklists. The issue includes missing validation of the user’s permissions and a failure to enforce unique slugs for new checklists, enabli...

CVE-2024-9000 Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary

In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...

PT-2025-12105 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to 1.6.3 Description: The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This enables an attacker to overwrite existing data by...

PT-2025-12222

Name of the Vulnerable Software and Affected Versions prefecthq/prefect version 2.20.2 Description A CORS Cross-Origin Resource Sharing misconfiguration allows unauthorized domains to access sensitive data, potentially leading to unauthorized access to the database. This can result in data leaks,...

Lunary 安全漏洞

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary versions prior to 1.6.3 that stems from not enforcing unique constraints and can be exploited by an attacker to cause data integrity issues...

The vulnerability of the nft_map_deactivate() function in the net/netfilter/nf_tables_api.c module of the netfilter component in the Linux operating system’s kernel allows a attacker to compromise the integrity of the protected information.

The vulnerability of the nftmapdeactivate function in the net/netfilter/nftablesapi.c module of the netfilter component of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...