In the RediSearch module that provides querying, secondary indexing, and full-text search for Redis versions 2.6.24, 2.8.21, 2.10.10 a high severity vulnerability CVE-2024-51737 was detected. This vulnerability allows attackers to trigger a buffer overflow by using specially crafted arguments in the FT.SEARCH or FT.AGGREGATE commands, potentially leading to remote code execution. To fix this issue, users should upgrade the RediSearch module for Redis to versions 2.6.24, 2.8.21, and 2.10.10. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-51737.
In PostgreSQL versions before 17.1, 16.5, 15.9, 14.14, 13.17 and 12.21 a high severity vulnerability CVE-2024-10979 was detected. This vulnerability allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. To address this issue, users should upgrade PostgreSQL to versions 17.1, 16.5, 15.9, 14.14, 13.17 or 12.21. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-10979.
Read more Database
In pgAdmin versions prior to 7.0 a high severity vulnerability CVE-2023-1907 was detected. This vulnerability allows attackers to potentially attach users to another user’s session when multiple connection attempts occur simultaneously while logging into pgAdmin running in server mode using LDAP authentication. To address this issue, users should upgrade pgAdmin to version 7.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-1907.
In Redis versions from 7.0.0 to prior to 7.2.7 and from 7.4.0 to prior to 7.4.2 a medium severity vulnerability CVE-2024-51741 was detected. This vulnerability allows an authenticated user with sufficient privileges to create a malformed ACL selector, which, when accessed, triggers a server panic and subsequent denial of service. To address this issue, users should upgrade to Redis version 7.2.7 or 7.4.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-51741.
Read more Database
In Redis versions before 7.4.2, 7.2.7 and 6.2.17 a high severity vulnerability CVE-2024-46981 was detected. This vulnerability allows authenticated users to execute remote code by using a specially crafted Lua script to manipulate the garbage collector. To address this issue, users must upgrade to Redis version 7.4.2, 7.2.7 or 6.2.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-46981.
Read more Database
In GeoServer versions prior to 2.26.0 a medium severity vulnerability CVE-2024-35230 was detected. This vulnerability allows attackers to identify software and components used by the server via the welcome and about pages, potentially aiding in targeted attacks. To address this issue, users should upgrade GeoServer to version 2.26.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-35230.
Read more Database
In MongoDB Server versions 6.0 (prior to 6.0.17), 7.0 (prior to 7.0.13), and 7.3 (prior to 7.3.4) a medium severity vulnerability CVE-2024-8305 was detected. This vulnerability allows attackers to trigger crashes in secondary nodes by incorrectly enforcing index constraints. In extreme cases, multiple secondaries may crash, potentially leaving no primaries available. To address this issue, update to the latest fixed versions: 6.0.17, 7.0.13, or 7.3.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8305.
Read more Database
In MariaDB version 11.1 a medium severity vulnerability CVE-2024-27766 was detected. This vulnerability allows remote attackers to execute arbitrary code through the lib_mysqludf_sys.so function. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-27766.
In MariaDB versions 10.5 a medium severity vulnerability CVE-2023-39593 was detected. This vulnerability allows authenticated attackers to execute arbitrary commands with elevated privileges. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-39593.
Read more Database