CVE-2024-5389

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset...

CVE-2024-25929

CVE-2024-25929: WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX

CVE-2024-25092

CVE-2024-25092 is a Missing Authorization vulnerability in WordPress NextMove Lite (XLPlugins NextMove Lite) affecting all versions through 2.17.0. An authenticated user with subscriber-level privileges or higher can install and activate arbitrary plugins due to a missing capability check (xl_add...

CVE-2024-24716

Technical details about CVE-2024-24716 (Awesome Support Missing Authorization) are not publicly provided in the connected documents. No exploit, affected versions beyond 6.1.6, or remediation specifics are given. Monitor vendor advisories for updates.

CVE-2023-34003

CVE-2023-34003 affects the WooCommerce Box Office plugin (versions

CVE-2023-51494

CVE-2023-51494 is a Missing Authorization vulnerability in the WooCommerce Product Vendors plugin (WordPress). Affected versions are WooCommerce Product Vendors up to 2.2.1. Root cause: insufficient authorization checks allowing unauthenticated access to vendor-related actions. Impact in the NVD ...

lunary-ai/lunary allows users unauthorized access to projects

Withdrawn: This advisory was incorrectly linked the the npm package lunary. The advisory is valid, but not for that packlage. In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organizatio...

CVE-2024-4146

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146

In Lunary (lunary-ai/lunary) v1.2.13, CVE-2024-4146 describes an incorrect authorization vulnerability in the checkProjectAccess middleware. The vulnerability relies on only verifying organization membership and fails to enforce explicit project-level permissions checked via the account_project t...

CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-21748

CVE-2024-21748 affects WordPress Icegram Engage plugin (Icegram) with versions up to 3.1.21. Root cause: Missing/Broken Authorization leading to unauthorized access. Patch 3.1.22 fixes the issue; severity reported as low (CVSS ~4.3).

CVE-2022-35718

CVE-2022-35718 affects IBM Sterling Partner Engagement Manager. The IBM bulletin states that the product stores sensitive information in URL parameters, which can be disclosed to unauthorized parties via server logs, referrer headers, or browser history. Affected versions: IBM Sterling Partner En...

CVE-2024-0444

CVE-2024-0444 concerns GStreamer and its AV1 parsing path. The flaw is a stack-based buffer overflow in the AV1 tile-list data parsing, caused by insufficient validation of the length of user-supplied data before copying to a fixed-size stack buffer. Exploitation can lead to remote arbitrary code...

CVE-2024-5248

In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the GET /v1/users/me/org endpoint. The platform's role definitions restrict the Prompt Editor role to prompt management and project viewing/listing capabilities, explicitly...

CVE-2024-3504

An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in versi...

CVE-2024-3504 Improper Access Control in lunary-ai/lunary

An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in versi...

CVE-2024-3504

CVE-2024-3504 affects lunary-ai/lunary up to version 1.2.2. The root cause is improper access control that allows an admin to elevate any organization user to the owner role, enabling the elevated user to delete projects within the organization. The issue is mitigated by upgrading to version 1.2....

PT-2024-34599 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.4 Description: An account takeover issue exists due to the exposure of password recovery tokens in API responses. When a user initiates the password reset process, the recovery token is included in the response of...

PT-2024-26295 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions up to and including 1.2.2 Description: An improper access control issue exists, allowing an admin to update any organization user to the organization owner. This enables the elevated user to delete projects within th...