69682 matches found
CVE-2024-10366
The CVE-2024-10366 vulnerability affects danny-avila/librechat v0.7.5-rc2, where the delete-attachments endpoint does not verify that the attachment ID belongs to the current user. This IDOR allows any authenticated user (low privileges) to delete attachments of other users, with a network-style ...
CVE-2024-10366 IDOR in delete attachments in danny-avila/librechat
An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...
CVE-2024-8999 Improper Access Control in lunary-ai/lunary
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...
CVE-2024-8999
Lunary (lunary-ai/lunary) v1.4.25 contains an improper access control vulnerability in POST /api/v1/data-warehouse/bigquery, allowing unauthenticated/export of the entire database to Google BigQuery. Root cause: insufficient access checks on the data-warehouse/bigquery endpoint. Impact is high (c...
CVE-2024-8999 Improper Access Control in lunary-ai/lunary
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...
PT-2025-12338 · D Link · D-Link Dir-605L +1
Name of the Vulnerable Software and Affected Versions: D-Link DIR-618 version 2.02/3.02 D-Link DIR-605L version 2.02/3.02 Description: A problematic vulnerability was found in the Firewall Service component, affecting the /goform/formAdvFirewall file. This issue leads to improper access controls,...
PT-2025-12339 · D Link · D-Link Dir-605L +1
Name of the Vulnerable Software and Affected Versions: D-Link DIR-618 versions 2.02/3.02 D-Link DIR-605L versions 2.02/3.02 Description: A problematic issue has been found, affecting some unknown processing of the file /goform/formAdvNetwork, leading to improper access controls. The attack can on...
Lunary 授权问题漏洞
lunary is lunary open source a production toolkit for LLM . An authorization issue vulnerability exists in lunary that stems from the /checklists/:id route not being properly access controlled, which can be exploited by an attacker to cause a low-privileged user to modify the checklist...
Audi UTR Dashcam 安全漏洞
Audi UTR Dashcam is a high performance Audi car recorder from Audi Germany. It is used to accurately videotape and record details during driving. A security vulnerability exists in Audi UTR Dashcam version 2.0, which stems from improper access control of the Command API component, and the attack...
CVE-2024-7767: Missing Authorization
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and...
CVE-2024-10363: Missing Authorization
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions...
CVE-2025-2551: Improper Access Control
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/formSetPortTr. The manipulation leads to improper access controls. Access to the local network is required for this attack. The exploit has...
CVE-2025-2557: Improper Access Control
A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the component Command API. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has...
CVE-2025-2552: Improper Access Control
A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/formTcpipSetup. The manipulation leads to improper access controls. Access to the local network is required for this attack to...
CVE-2025-2549: Improper Access Control
A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/formSetPassword. The manipulation leads to improper access controls. The attack needs to be done within the local...
PT-2025-13695 · Tenda · Tenda Fh1202
Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue was found in the Web Management Interface of the affected software, specifically affecting an unknown part of the file /goform/qossetting. This issue leads to improper access...
Lunary 安全漏洞
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary, which stems from improper access control on the /v1/datasets endpoint, and can be exploited by an attacker to gain access to unauthorized datasets...
LibreChat 访问控制错误漏洞
LibreChat is an enhanced ChatGPT clone. LibreChat suffers from an Improper Access Control vulnerability that can be exploited by an attacker to corrupt application logic and permissions and allow unauthorized operations...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8 that stems from improper access control and allows an attacker to view and delete arbitrary files...
D-Link DIR-605L和D-Link DIR-618 安全漏洞
The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DIR-618 version 2.02 and the D-Link DIR-605L version 3.02, which stems from improper access control in the file /goform/formSetDomainFilter, an...