Our news and updates

In Django versions 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17 a critical severity vulnerability CVE-2024-53907 was detected. This vulnerability allows attackers to trigger a potential denial-of-service attack using inputs with large sequences of nested incomplete HTML entities. To address this issue, users should upgrade Django to versions 5.1.4, 5.0.10, or 4.2.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-53907.

In Zabbix versions 5.0.0 <= 5.0.42, 6.0.0 <= 6.0.32, 6.4.0 <= 6.4.17, and 7.0.0 <= 7.0.1rc1 a high severity vulnerability CVE-2024-36467 was detected. This vulnerability allows authenticated users with API access (users with the default User role) to add themselves to any group, such as Zabbix Administrators, except for groups that are disabled or have restricted GUI access. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36467.

In Zabbix versions 7.0.0 through 7.0.2rc1 a low-severity vulnerability CVE-2024-36468 was detected. This vulnerability allows attackers to exploit a stack buffer overflow in the `zbx_snmp_cache_handle_engineid` function, caused by improper bounds checking when copying data from `session->securityEngineID` to `local_record.engineid`. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36468.

In Mattermost versions 9.7.x up to 9.7.5, 9.8.x up to 9.8.2, and 9.9.x up to 9.9.2 a medium severity vulnerability CVE-2024-12247 was detected. This vulnerability allows users keep old permissions even when permission updates are made, as the updates don’t apply across all cluster nodes. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12247.

In Python versions before 3.12.0 and from 3.12.0a1 to 3.12.0b1 a medium severity vulnerability CVE-2024-11168 was detected. This vulnerability allows attackers to exploit improper validation of bracketed hosts in the urlsplit() and urlparse() functions, potentially leading to SSRF (Server-Side Request Forgery). To address this issue, upgrade to Python 3.12.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-11168.

In Kanboard version 1.2.40 a medium severity vulnerability CVE-2024-54001 was detected. This vulnerability allows attackers to inject malicious HTML or JavaScript into the application, potentially leading to unauthorized actions or data theft. To fix this issue, users should upgrade Kanboard to version 1.2.41. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-54001.

In WordPress Contact Forms by Cimatti versions up to 1.9.2 a medium severity vulnerability CVE-2024-10521 was detected. This vulnerability allows unauthenticated attackers to delete forms via a forged request by exploiting missing or incorrect nonce validation in the process_bulk_action function. To address this issue, users must upgrade to WordPress Contact Forms by Cimatti version 1.9.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10521.

In Wallet for WooCommerce plugin versions up to 1.5.6 a medium severity vulnerability CVE-2024-7747 was detected. This vulnerability allows attackers with Subscriber access or higher to generate fake funds and transfer them to users or themselves. They could also request withdrawals if approved by an admin. To address this issue, users must upgrade to Wallet for WooCommerce version 1.5.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7747.

In Browser WebDriver for Zabbix versions from 7.0.0 to 7.0.3 a medium severity vulnerability CVE-2024-42328 was detected. This vulnerability allows attackers to crash the application by exploiting a NULL pointer dereference when the server returns an empty response. To fix this issue, users should upgrade Zabbix to version 7.0.4rc1. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-42328.