rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6830 SourceCodester Simple Inventory Management System Order action.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument order_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271812.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Simple Inventory Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Xu Mingming (VulDB User)
Published: 2024-07-17T16:00:06.881Z
CVE-2024-6831 
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due to a client-side-only check. 
Axis has released patched versions for the highlighted flaw. Please 
refer to the Axis security advisory for more information and solution.
Problem types: cwe_id: CWE-602
description: CWE-602: Client-Side Enforcement of Server-Side Security
Affected products: vendor: Axis Communications AB
product: AXIS Camera Station Pro
default_status: unaffected
vendor: Axis Communications AB
product: AXIS Camera Station
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Published: 2024-11-26T07:14:58.823Z
CVE-2024-6833 Zowe CLI Auto-Init Leaks Credentials Locally
A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation.
Problem types: description: CWE-257: Storing Passwords in a Recoverable Format
description: CWE-313: Cleartext Storage in a File or on Disk
Affected products: vendor: Open Mainframe Project
product: Zowe
CVSS v3.1: baseScore: 5.9
baseSeverity: MEDIUM
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C/CR:M/IR:X/AR:X/MAV:L/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:N/MA:N
Credits: lang: en
value: Broadcom Inc.
Published: 2024-07-17T14:41:37.598Z
CVE-2024-6834 Imperative Local Command Injection allows Activity Masking
A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user credentials.
Affected products: vendor: Open Mainframe Project
product: Zowe
CVSS v3.1: baseScore: 9
baseSeverity: CRITICAL
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:T/RC:C/CR:H/IR:H/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:C/MC:H/MI:H/MA:H
Credits: lang: en
value: Pavel Jares
lang: en
value: Andrej Chmelo
Published: 2024-07-17T14:44:06.283Z
CVE-2024-6835 Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_load_posts function. This makes it possible for unauthenticated attackers to extract text data from password-protected posts using the boolean-based attack on the AJAX search form
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: vinod-dalvi
product: Ivory Search – WordPress Search Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Matthew Rollings
Published: 2024-09-05T06:41:38.540Z
CVE-2024-6836 Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update
The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to update multiple settings, including templates, designs, checkouts, and other plugin settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: amans2k
product: FunnelKit – Funnel Builder for WooCommerce Checkout
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-07-24T05:31:55.874Z
CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow
In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: mlflow
product: mlflow/mlflow
Published: 2025-03-20T10:09:11.431Z
CVE-2024-6839 Improper Regex Path Matching in corydolphin/flask-cors
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
Problem types: cwe_id: CWE-41
description: CWE-41 Improper Resolution of Path Equivalence
Affected products: vendor: corydolphin
product: corydolphin/flask-cors
Published: 2025-03-20T10:09:42.595Z
CVE-2024-6840 Automation-controller: gain access to the k8s api server via job execution with container group
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
Problem types: cwe_id: CWE-285
description: Improper Authorization
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.4 for RHEL 8
cpes: cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9
cpe:/a:redhat:ansible_automation_platform:2.4::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.4 for RHEL 9
cpes: cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9
cpe:/a:redhat:ansible_automation_platform:2.4::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el8
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2024-09-12T16:35:08.921Z
CVE-2024-6841 CSRF in vanna-ai/vanna
A Cross-Site Request Forgery (CSRF) vulnerability exists in the latest commit (56b782bcefd2e59b19cd7ba7878b95f54884f502) of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF attacks. This vulnerability allows an attacker to run arbitrary SQL commands via CSRF without the target intending to expose the web app to the network or other users. The impact is limited to data alteration or deletion, as the attacker cannot read the results of the query.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: vanna-ai
product: vanna-ai/vanna
Published: 2025-03-20T10:10:14.484Z
CVE-2024-6842 Exposure of Sensitive Information in mintplex-labs/anything-llm
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: mintplex-labs
product: mintplex-labs/anything-llm
Published: 2025-03-20T10:10:27.588Z
CVE-2024-6843 SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSS
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Chatbot with ChatGPT WordPress
default_status: unaffected
Credits: lang: en
value: Karolis Narvilas
lang: en
value: WPScan
Published: 2024-08-19T06:00:05.662Z
CVE-2024-6844 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: corydolphin
product: corydolphin/flask-cors
Published: 2025-03-20T10:10:51.818Z
CVE-2024-6845 SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
Problem types: description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Chatbot with ChatGPT WordPress
default_status: unaffected
Credits: lang: en
value: Kieran Burge
lang: en
value: WPScan
Published: 2024-09-25T06:00:04.626Z
CVE-2024-6846 SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Chatbot with ChatGPT WordPress
default_status: unaffected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-09-05T06:00:01.905Z
CVE-2024-6847 SmartSearch WP <= 2.4.4 - Unauthenticated SQLi
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Chatbot with ChatGPT WordPress
default_status: unaffected
Credits: lang: en
value: Karolis Narvilas
lang: en
value: WPScan
Published: 2024-08-20T06:00:03.192Z
CVE-2024-6848 Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 1.26.6 due to insufficient input sanitization and output escaping affecting the boldgrid_canvas_image AJAX endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: boldgrid
product: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: wesley
Published: 2024-07-20T11:18:27.812Z
CVE-2024-6849 Preloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: maxsdesign
product: Preloader Plus – WordPress Loading Screen Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: wesley
Published: 2024-09-07T08:37:02.802Z
CVE-2024-6850 Carousel Slider < 2.2.14 - Editor+ Stored XSS
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Carousel Slider
default_status: unaffected
Credits: lang: en
value: Krugov Artyom
lang: en
value: WPScan
Published: 2024-09-13T06:00:03.481Z
CVE-2024-6851 Arbitrary File Deletion in aimhubio/aim
In version 3.22.0 of aimhubio/aim, the LocalFileManager._cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted glob-pattern to lead to arbitrary file deletion.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: aimhubio
product: aimhubio/aim
Published: 2025-03-20T10:09:55.149Z
CVE-2024-6852 WP MultiTasking <= 0.1.12 - Settings Update via CSRF
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Norbert Hofmann
lang: en
value: WPScan
Published: 2024-09-08T06:00:02.122Z
CVE-2024-6853 WP MultiTasking <= 0.1.12 - Welcome Popup Update via CSRF
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Norbert Hofmann
lang: en
value: WPScan
Published: 2024-09-08T06:00:02.382Z
CVE-2024-6854 Arbitrary File Overwrite in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: h2oai
product: h2oai/h2o-3
Published: 2025-03-20T10:09:57.301Z
CVE-2024-6855 WP MultiTasking <= 0.1.12 - Exit Popup Update via CSRF
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Norbert Hofmann
lang: en
value: WPScan
Published: 2024-09-08T06:00:02.581Z
CVE-2024-6856 WP MultiTasking <= 0.1.12 - SMTP Settings Update via CSRF
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Norbert Hofmann
lang: en
value: WPScan
Published: 2024-09-08T06:00:02.783Z
CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Norbert Hofmann
lang: en
value: WPScan
Published: 2025-04-09T06:00:04.059Z
CVE-2024-6858 In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
Problem types: cwe_id: CWE-1287
description: CWE-1287 Improper validation of specified type of input
Affected products: vendor: Arista Networks
product: EOS
default_status: unaffected
Published: 2026-06-04T21:51:08.709Z
CVE-2024-6859 WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode
The WP MultiTasking  WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-09-08T06:00:02.961Z
CVE-2024-6860 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF
The WP MultiTasking  WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP MultiTasking
default_status: affected
Credits: lang: en
value: Norbert Hofmann
lang: en
value: WPScan
Published: 2025-04-09T06:00:05.104Z
CVE-2024-6861 Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api
A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.
Problem types: cwe_id: CWE-200
description: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Satellite 6.12 for RHEL 8
cpes: cpe:/a:redhat:satellite_maintenance:6.12::el8
cpe:/a:redhat:satellite_utils:6.12::el8
cpe:/a:redhat:satellite_capsule:6.12::el8
cpe:/a:redhat:satellite:6.12::el8
default_status: affected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Satellite 6
cpes: cpe:/a:redhat:satellite:6
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Sébastien Vecten for reporting this issue.
Published: 2024-11-06T14:54:51.099Z
CVE-2024-6862 Cross-Site Request Forgery (CSRF) in lunary-ai/lunary
A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: lunary-ai
product: lunary-ai/lunary
Published: 2024-09-13T16:13:51.639Z