CVE-2021-3072

Technical details for CVE-2021-3072 are not publicly available in the provided documents. Monitor for updates when more information is disclosed by the reporting party or vendors.

CVE-2021-3066

Technical details for CVE-2021-3066 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-6086

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-6086

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-5714

In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with...

CVE-2024-6086 Improper Access Control in lunary-ai/lunary

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-6086

CVE-2024-6086 affects lunary-ai/lunary v1.2.7, where improper access control lets any authenticated user, including low-privilege roles like Prompt Editor, modify an organization’s name. Root cause: checkAccess() is not implemented, enabling attribute modification without proper authorization. Ex...

CVE-2024-22232

CVE-2024-22232 describes a directory traversal in Salt’s file server triggered by a specially crafted URL. The underlying issue is input validation that allows traversal sequences, enabling a malicious user to read arbitrary files from a Salt master’s filesystem. Affected component: Salt master/f...

Lunary Access Control Error Vulnerability

Lunary is a production toolkit for LLM from lunary open source. An access control error vulnerability exists in lunary version 1.2.4, which stems from the backend failing to validate the project identifier against the current user's organization ID and the project it belongs to, as well as a...

lunary 访问控制错误漏洞

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control and can be exploited by an attacker to change the name of an organization...

PT-2024-37091 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.4 Description: The issue is caused by an improper access control vulnerability that allows members with team management permissions to manipulate project identifiers in requests. This enables them to invite users ...

PT-2024-37376 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.7 Description: The issue allows any authenticated user to change the name of an organization due to improper access control. This is because the checkAccess function is not implemented, enabling users with low...

PT-2025-5347 · Unknown +1 · Vaultwarden +1

Name of the Vulnerable Software and Affected Versions: vaultwarden versions prior to 1.33.0 Description: The issue allows an attacker to obtain owner rights of another organization. To exploit this, the attacker must know the ID of the victim organization and be the owner or admin of another...

CVE-2023-35049

CVE-2023-35049 affects the WordPress WooCommerce Stripe Payment Gateway plugin

CVE-2023-41805

CVE-2023-41805 is a Missing Authorization (Broken Access Control) issue in Brainstorm Force Premium Starter Templates and Brainstorm Force Starter Templates astra-sites, affecting Premium Starter/Templates ≤ 3.2.5. Root cause: insufficient authorization checks enabling access to data/configs. Pat...

CVE-2023-39993

CVE-2023-39993 refers to a Broken Access Control issue in the WordPress plugin ElementsKit Lite / Elementor addons . Affected versions are ≤ 2.9.0 (Wpmet ElementsKit Lite). The root cause is a Missing Authorization/Access control weakness that could allow unauthorized actions. Remediation: upgrad...

CVE-2023-40004

CVE-2023-40004 is a Missing Authorization vulnerability affecting multiple ServMask WordPress extensions (Box, OneDrive, Dropbox, Google Drive) for All-in-One WP Migration. Connected sources (Patchstack) confirm unauthenticated access token manipulation due to insufficient authorization in the pl...

CVE-2023-46146

CVE-2023-46146 relates to Themify Themify Ultra (Theme) with versions up to 7.3.5, where a Missing Authorization/Broken Access Control vulnerability could allow unauthorized access. Public sources indicate the issue affects Themify Ultra through 7.3.5 and that Patchstack lists the fixed version a...

CVE-2023-46148

CVE-2023-46148 – Themify Ultra (WordPress Theme) \n\nTechnical details from the provided sources indicate a Missing Authorization vulnerability in Themify Ultra (affecting versions up to 7.3.5). The root cause is insufficient access control that allows an authenticated user with subscriber-level ...

CVE-2023-47770

CVE-2023-47770 concerns Betheme WordPress theme (Muffin Group) with a Missing Authorization vulnerability in versions up to 27.1.1. The issue is described as Broken Access Control / Missing Authorization, enabling privilege escalation for authenticated users (Contributor level and above) to acces...