Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: lunary-ai/lunary 1.2.6 Clear all filters
TI-2024-03267 CVE-2024-3502 · GHSA-cgjv-g7x3-8jrm

Exposure of Sensitive Information in lunary-ai/lunary

Priority HIGH 80

In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00409 Published 2024-11-14 Fixed in 1.2.6 CWE-201
TI-2024-03266 CVE-2024-3501 · GHSA-36g3-5c2m-mrqx

Exposure of Sensitive Information in lunary-ai/lunary

Priority HIGH 80

In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpo…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00412 Published 2024-11-14 Fixed in 1.2.6 CWE-922