Developer Tools

In Gitea version 1.22.0 a high severity vulnerability CVE-2024-6886 was detected. This vulnerability allows attackers to add harmful scripts to the website, which other users might see, leading to stolen data or hijacked accounts. To fix this problem, users should upgrade Gitea to version 1.23.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6886.

In OpenShift versions using Podman a medium severity vulnerability CVE-2024-3056 was detected. This vulnerability allows an attacker to create a container that uses up memory and IPC resources, eventually leading to system instability. If the container is set to restart automatically, the attack can be repeated. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-3056.

In OpenShift versions that use github.com/containers/image library a high severity vulnerability CVE-2024-3727 was detected. This vulnerability allows attackers to perform unintended actions on behalf of the victim user, such as accessing resources, exhausting system resources, or traversing local file paths. To address this issue users should upgrade to versions 5.30.1 or 5.29.3. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-3727.

In Harbor versions prior to 2.9.5 and 2.10.3 a medium severity vulnerability CVE-2024-22278 was detected. This vulnerability allows authenticated users to modify configurations. To fix this problem, users should upgrade to versions 2.9.5, 2.10.3 or 2.11.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-22278.

In GitLab versions 6.7 prior to 17.0.5, 17.1 prior to 17.1.3 and 17.2 prior to 17.2.1 a medium severity vulnerability CVE-2024-7057 was detected. This vulnerability allows attackers to view sensitive files in GitLab. To fix this problem, users should upgrade GitLab CE/EE to versions 17.0.5, 17.1.3 or 17.2.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7057.

In GitLab CE/EE all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 a high severity vulnerability CVE-2024-7047 was detected. A cross-site scripting (XSS) vulnerability allows an attacker to run arbitrary scripts as the logged-in user, potentially leading to unauthorized actions and access to sensitive information. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7047.

In the OpenShift console version 3.1 a medium severity vulnerability CVE-2024-7128 was detected. This vulnerability allows some parts of the app to skip proper user authentication when using the default “openShiftAuth” provider. This can lead to data exposure because the necessary checks are not performed. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7128.

In GitLab CE/EE versions 15.4 prior to 17.0.5, 17.1 prior to 17.1.3 and 17.2 prior to 17.2.1 a low severity vulnerability CVE-2024-7060 was detected. This vulnerability allows attackers to access sensitive information by viewing project or group exports without authorization. To fix this problem, users should upgrade GitLab CE/EE to versions 17.0.5, 17.1.3, or 17.2.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7060.

In OpenShift versions 4.12.0 prior to 4.12.12, 4.13.0 prior to 4.13.5 and 4.14.0 prior to 4.14.0 a medium severity vulnerability CVE-2024-7128 was detected. This allows attackers to access and potentially steal data because the system is not properly checking user credentials. To fix this problem, users should upgrade to OpenShift versions 4.12.13, 4.13.6, and 4.14.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7128.