Our news and updates

In Kibana versions up to and including 7.17.22 and 8.0.0 up to and including 8.14.3 a medium severity vulnerability CVE-2024-43708 was detected. This vulnerability allows an authenticated user with read access to any feature in Kibana to send a specially crafted payload to certain UI inputs, causing the server to crash due to improper resource allocation without limits or throttling. To address this issue, users should upgrade Kibana to versions 7.17.23, 8.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43708.

In Kibana versions from 8.0.0 up to 8.15.0 a high severity vulnerability CVE-2024-43707 was detected. This issue allows a user without access to Fleet to view Elastic Agent policies, which could contain sensitive information depending on the enabled integrations and their versions. To address this vulnerability, users should upgrade Kibana to version 8.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43707.

In Argo CD versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 a high severity vulnerability CVE-2025-55191 was detected. This vulnerability allows authenticated attackers with repository permissions to trigger a race condition in the repository credentials handler, causing the Argo CD server to panic and crash, leading to denial-of-service. To address this issue, users should upgrade Argo CD to versions 2.14.20, 3.2.0-rc2, 3.1.8, 3.0.19 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55191.

In iTop v.3.1.0-2-11973 a high severity vulnerability CVE-2023-47489 was detected. A CSV injection in the export functionality (export-v2.php and ajax.render.php) allows a local attacker to inject crafted scripts that can lead to arbitrary code execution. To address this issue, users should upgrade iTop to versions 3.0.4, 3.1.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-47489.

In iTop v.3.1.0-2-11973 a medium severity vulnerability CVE-2023-47488 was detected. This cross-site scripting (XSS) vulnerability allows a local attacker to obtain sensitive information by injecting a crafted script into the attrib_manager_id parameter in the General Information page or the id parameter in the contact page. To address this issue, users should upgrade iTop to versions 3.0.4, 3.1.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-47488.

In Kibana versions up to and including 7.17.28, 8.0.0 to 8.17.7, 8.18.0 to 8.18.2, and 9.0.0 to 9.0.2 a medium severity vulnerability CVE-2025-25012 was detected. The flaw allows open redirect attacks through the Short URLs feature in Discover, Dashboard, and Visualization Library, which can redirect users to arbitrary sites and enable server-side request forgery (SSRF). To address this issue, users should upgrade Kibana to versions 7.17.29, 8.17.8, 8.18.3, 9.0.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25012.

In Kibana versions prior to 7.17.29, 8.17.8, 8.18.3 and 9.0.3 a medium severity vulnerability CVE-2024-52974 was detected. This vulnerability allows a user with read permissions for Observability to send a specially crafted request to the Observability API, which could cause the Kibana server to crash. To address this issue, users should upgrade Kibana to versions 7.17.29, 8.17.8, 8.18.3, 9.0.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-52974.

In Liferay Portal versions 7.4.0 through 7.4.3.119, and Liferay DXP versions 2023.Q3.1 through 2023.Q3.10, 2023.Q4.0 through 2024.Q4.10, and 2024.Q1.1 through 2024.Q1.5 (including 7.4 GA through update 92 and older unsupported releases) a medium severity vulnerability CVE-2025-43816 was detected. This memory leak in the StructuredContents headless API could allow an attacker to repeatedly call the endpoint and exhaust server memory, leading to denial of service. To address this issue, users should upgrade Liferay Portal to versions 7.4.3.120 or later, and Liferay DXP 2024.Q1.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-43816.

In Nagios XI versions prior to 2026R1 a high severity vulnerability CVE-2025-34227 was detected. This authenticated command injection issue affects the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query configuration wizards. By injecting shell characters into service arguments, an attacker could execute arbitrary system commands on the underlying host as the nagios user. To address this issue, users should upgrade to Nagios XI 2026R1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-34227.