GitLab Advisory Database

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: the web application uses RouterFunctions to serve static resources resource handling …

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/{run_id}/related endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the run_id listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain …

A broken access control vulnerability exists prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.

An improper access control vulnerability exists in lunary-ai/lunary prior to commit 844e8855c7a713dc7371766dba4125de4007b1cf on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later …

A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated …

A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the api_base parameter when making requests to POST /chat/completions, causing the application to send the request to the domain specified by api_base. This request includes the OpenAI API key. A malicious user can set the api_base to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse …

Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, …

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.

A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this …

Context ICS has the following four messages that enable validators on the provider chain to perform different actions: MsgOptIn – adds a validator to the consumer chain’s active set MsgOptOut – removes a validator from the consumer chain’s active set MsgAssignConsumerKey – changes the consensus key used for a validator’s operations on a consumer chain MsgSetConsumerCommissionRate – sets a validator’s consumer-specific commission rate Normally, only the respective validators are allowed …

Context ICS has the following four messages that enable validators on the provider chain to perform different actions: MsgOptIn – adds a validator to the consumer chain’s active set MsgOptOut – removes a validator from the consumer chain’s active set MsgAssignConsumerKey – changes the consensus key used for a validator’s operations on a consumer chain MsgSetConsumerCommissionRate – sets a validator’s consumer-specific commission rate Normally, only the respective validators are allowed …

Context ICS has the following four messages that enable validators on the provider chain to perform different actions: MsgOptIn – adds a validator to the consumer chain’s active set MsgOptOut – removes a validator from the consumer chain’s active set MsgAssignConsumerKey – changes the consensus key used for a validator’s operations on a consumer chain MsgSetConsumerCommissionRate – sets a validator’s consumer-specific commission rate Normally, only the respective validators are allowed …

Context ICS has the following four messages that enable validators on the provider chain to perform different actions: MsgOptIn – adds a validator to the consumer chain’s active set MsgOptOut – removes a validator from the consumer chain’s active set MsgAssignConsumerKey – changes the consensus key used for a validator’s operations on a consumer chain MsgSetConsumerCommissionRate – sets a validator’s consumer-specific commission rate Normally, only the respective validators are allowed …