In Ansible Automation Platform version 2 a medium severity vulnerability CVE-2024-11483 was detected. Attackers can escalate privileges by misusing read-scoped OAuth2 (Open Authorization 2.0) tokens to gain write access, affecting API endpoints using ansible_base.oauth2_provider. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-11483.
Read more IT Business Management
In Authentik versions prior to 2024.8.5 a medium severity vulnerability CVE-2024-52307 was detected. This vulnerability allows attackers to brute-force the SECRET_KEY, which secures the /-/metrics/ endpoint, due to a flaw in how comparisons are done. To fix this issue, users need to update to versions 2024.8.5 or 2024.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-52307.
In Authentik versions prior to 2024.8.5 a high severity vulnerability CVE-2024-52289 was detected. This vulnerability allows attackers to bypass redirect URI validation and potentially redirect users to malicious websites. To fix this issue, users should upgrade Authentik to versions 2024.8.5 and 2024.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-52289.
Read more Security
In InfluxDB versions through 2.7.10 a high severity vulnerability CVE-2024-30896 was detected. This vulnerability allows administrators with high-level access to view sensitive authentication tokens, potentially exposing them to misuse. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-30896.
Read more Data Analytics
In Kubernetes versions prior to 1.28.11, and from 1.29.0 to 1.29.6 and 1.30.0 to 1.30.2 a high severity vulnerability CVE-2024-10220 was detected. This vulnerability allows attackers to execute arbitrary commands via specially crafted gitRepo volumes, potentially compromising the affected system. To fix this issue, users should upgrade Kubernetes to versions 1.28.12, 1.29.7, 1.30.3. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-10220.
Read more Developer Tools
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26 and 8.3.* before 8.3.14 a critical severity vulnerability CVE-2024-11236 was detected. This vulnerability allows attackers to exploit long string inputs to cause system crashes or execute malicious actions. To fix this issue, users should upgrade PHP to versions 8.1.31, 8.2.26, or 8.3.14. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-11236.
Read more Web Development
In Django CMS versions before 4.0 a medium severity vulnerability CVE-2024-11406 was detected. This vulnerability allows Stored Cross-Site Scripting (XSS) through improper neutralization of input in Django CMS Attributes Fields. To address this issue, update to Django CMS version 4.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-11406.
Read more Application Development
In Authentik versions prior to 2024.8.5 a medium severity vulnerability CVE-2024-52287 was detected. This vulnerability allows attackers to obtain OAuth tokens with unauthorized scopes using client_credentials or device_code grants. These tokens could be used to perform malicious actions in trusted systems. To fix this issue, users need to update to versions 2024.8.5 or 2024.10.3. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-52287.
Read more Security
In LibreNMS versions before 24.10.0 a medium severity vulnerability CVE-2024-50352 was detected. This vulnerability allows attackers to inject malicious JavaScript through the “name” field in the “Services” section. To address this issue, update to LibreNMS version 24.10.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-50352.
Read more Monitoring