CVE-2024-36041

KSmserver in KDE Plasma Workspace aka plasma-workspace before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the...

CVE-2024-33869

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur via a crafted PostScript document because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command output filename...

CVE-2024-33870

An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal via a crafted PostScript document to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ i...

CVE-2024-33870

CVE-2024-33870 affects Artifex Ghostscript up to version 10.03.1. The issue is a path traversal vulnerability in PostScript handling that can reach arbitrary files when the current directory is within permitted paths, e.g., transforming ../../foo to ./../../foo and gaining access if ./ is allowed...

CVE-2016-10000

Technical details for CVE-2016-10000 are not publicly provided in the supplied documents. No affected products, vectors, or fixes are given. Monitor for updates as new information becomes available.

CVE-2024-22272

VMware Cloud Director contains an Improper Privilege Management vulnerability. An authenticated tenant administrator for a given organization within VMware Cloud Director may be able to accidentally disable their organization leading to a Denial of Service for active sessions within their own...

CVE-2021-3074

Technical details for CVE-2021-3074 are not publicly available in the provided documents; no affected products, versions, or impact are disclosed. Monitor for updates.

CVE-2021-3066

Technical details for CVE-2021-3066 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2021-3072

Technical details for CVE-2021-3072 are not publicly available in the provided documents. Monitor for updates when more information is disclosed by the reporting party or vendors.

CVE-2024-6086

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-6086

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-5714

In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with...

CVE-2024-6086 Improper Access Control in lunary-ai/lunary

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-6086

CVE-2024-6086 affects lunary-ai/lunary v1.2.7, where improper access control lets any authenticated user, including low-privilege roles like Prompt Editor, modify an organization’s name. Root cause: checkAccess() is not implemented, enabling attribute modification without proper authorization. Ex...

CVE-2024-22232

CVE-2024-22232 describes a directory traversal in Salt’s file server triggered by a specially crafted URL. The underlying issue is input validation that allows traversal sequences, enabling a malicious user to read arbitrary files from a Salt master’s filesystem. Affected component: Salt master/f...

lunary 访问控制错误漏洞

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control and can be exploited by an attacker to change the name of an organization...

Lunary Access Control Error Vulnerability

Lunary is a production toolkit for LLM from lunary open source. An access control error vulnerability exists in lunary version 1.2.4, which stems from the backend failing to validate the project identifier against the current user's organization ID and the project it belongs to, as well as a...

PT-2024-37376 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.7 Description: The issue allows any authenticated user to change the name of an organization due to improper access control. This is because the checkAccess function is not implemented, enabling users with low...

PT-2024-37091 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.4 Description: The issue is caused by an improper access control vulnerability that allows members with team management permissions to manipulate project identifiers in requests. This enables them to invite users ...

PT-2025-5347 · Unknown +1 · Vaultwarden +1

Name of the Vulnerable Software and Affected Versions: vaultwarden versions prior to 1.33.0 Description: The issue allows an attacker to obtain owner rights of another organization. To exploit this, the attacker must know the ID of the victim organization and be the owner or admin of another...