Our news and updates

In WordPress in all versions up to and including 1.9.244 a medium severity vulnerability CVE-2024-10647 was detected. This vulnerability allows attackers to inject malicious scripts into pages, which execute if a user clicks a specially crafted link. To fix this problem, users should upgrade to version 1.9.245. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10647.

In Mattermost versions 10.0.x ≤ 10.0.0 and 9.11.x ≤ 9.11.2 a medium severity vulnerability, CVE-2024-52032, was detected. This vulnerability allows attackers to retrieve the names of private channels they are not a member of when using the channel switcher feature, provided Elasticsearch v8 is enabled. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-52032.

In Mattermost versions 9.10.x up to 9.10.2, 9.11.x up to 9.11.1, 9.5.x up to 9.5.9 and 10.0.x up to 10.0.0 a low severity vulnerability CVE-2024-42000 was detected. This vulnerability allows attackers with “Read Groups” permission, but without access to specific channels, to retrieve details about private channels they are not members of by sending a request to /api/v4/channels. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-42000.

In Mattermost versions 9.11.x up to 9.11.2 and 9.5.x up to 9.5.10 a low severity vulnerability CVE-2024-36250 was detected. This vulnerability allows attackers to reuse the MFA code within approximately 30 seconds, exploiting inadequate replay protection. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36250.

In NGINX OpenID Connect versions 1.3.0 to 1.9.2, 1.12.5 and earlier, 2.2.1 to 2.4.2, 3.0.0 to 3.7.0, and 2.5.0 to 2.17.3 a medium severity vulnerability CVE-2024-10318 was detected. This vulnerability allows attackers to fix a victim’s session to an attacker-controlled account, leading to potential misuse of the victim’s session. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-10318.

In WordPress in all versions up to and including 2.7.7 a high severity vulnerability CVE-2024-10114 was detected. This vulnerability allows attackers to bypass authentication and log in as any user, including administrators, by exploiting insufficient verification in the social login process. To fix this problem, users should upgrade to the latest version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10114.

In WordPress in all versions up to and including 1.5.1 a high severity vulnerability CVE-2024-10711 was detected. This vulnerability allows attackers to update site settings through a forged request, potentially enabling privilege escalation if an administrator is tricked into clicking a malicious link. To fix this problem, users should upgrade to version 1.5.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10711.

In WordPress in all versions up to and including 3.2.6 a medium severity vulnerability CVE-2024-8323 was detected. This vulnerability allows attackers with Contributor access or higher to inject malicious scripts into pages, which execute when a user visits an affected page. To fix this problem, users should upgrade to version 3.2.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8323.

In WordPress in all versions up to and including 2.2.13 a high severity vulnerability CVE-2024-10028 was detected. This vulnerability allows attackers to access and download a site’s backup file by exposing sensitive information during the backup process. To fix this problem, users should upgrade to version 2.2.14. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10028.