Our news and updates

In Zabbix versions from 6.0.0 to 6.0.33, from 6.4.0 to 6.4.18, from 7.0.0 to 7.0.3 a critical severity vulnerability CVE-2024-42330 was detected. This vulnerability allows attackers to manipulate HTTP headers to access hidden properties of objects by exploiting improper encoding of server data for JavaScript. To fix this issue, users should upgrade Zabbix to versions 6.0.34rc1, 6.4.19rc1, and 7.0.4rc1. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-42330.

In Zabbix versions from 6.0.0 to 6.0.31, from 6.4.0 to 6.4.16 and 7.0.0 a high severity vulnerability CVE-2024-36466 was detected. This vulnerability allows attackers to forge and sign a zbx_session cookie, granting them admin permissions. To fix this issue, users should upgrade Zabbix to versions 6.0.32rc1, 6.4.17rc1 and 7.0.1rc1. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-36466.

In Zabbix versions from 6.0.0 to 6.0.29 and from 6.4.0 to 6.4.14 a medium severity vulnerability CVE-2024-36464 was detected. This vulnerability allows attackers to retrieve passwords stored in plain text within YAML files if they have access to them, potentially compromising sensitive systems. To fix this issue, users should upgrade Zabbix to versions 6.0.30rc1 or 6.4.15rc1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-36464.

In python-multipart (a streaming multipart parser for Python) versions prior to 0.0.18 a high severity vulnerability CVE-2024-53981 was detected. This vulnerability allows attackers to send specially crafted requests that can overload the server, causing it to become unresponsive and preventing other requests from being processed. To fix this issue, users should upgrade python-multipart to version 0.0.18. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-53981.

In Jenkins Simple Queue Plugin versions 1.4.4 and prior a high severity vulnerability CVE-2024-54003 was detected. This vulnerability allows attackers with View/Create permissions to exploit stored XSS due to improper handling of the view name. To address this issue, users must upgrade to version 1.4.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-54003.

In Backstage Scaffolder Plugin versions prior to 0.4.12, from 0.5.0 before 0.5.1 and from 0.6.0 before 0.6.1 a medium severity vulnerability CVE-2024-53983 was detected. This vulnerability allows attackers to exploit Server-Side Template Injection (SSTI) to perform Git config injection, enabling the capture of privileged Git tokens and unauthorized access to sensitive resources. To address this issue, users must upgrade to versions 0.4.12, 0.5.1 or 0.6.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-53983.

In Zabbix Server versions prior to 1:7.0.5+dfsg-1 a low severity vulnerability CVE-2024-42333 was detected. This vulnerability lets attackers access a small portion of server memory by reading memory outside its intended boundaries in the code src/libs/zbxmedia/email.c. This could potentially leak sensitive data. To address this issue, users must upgrade to version 1:7.0.5+dfsg-1 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-42333.

In PrestaShop version 8.1.4 a medium severity vulnerability CVE-2024-36626 was detected. This vulnerability allows attackers to exploit the function with malformed inputs, potentially causing the application to crash or resulting in a denial of service (DoS). To fix this issue, users should upgrade PrestaShop to version 8.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-36626.

In Zulip version 8.3 a medium severity vulnerability CVE-2024-36625 was detected. This vulnerability allows attackers to inject malicious scripts into the application, which can then be executed in the context of other users’ browsers. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-36625.