In sigstore-python versions from 2.0.0 to 3.5.9 a low severity vulnerability CVE-2024-55655 was detected. This vulnerability allows attackers to bypass integration time validation in “v2” and “v3” bundles during the verification flow, which could lead to a Denial of Service. To address this issue, users must upgrade to sigstore-python version 3.6.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-55655.
Read more Application Development
In GitLab CE/EE versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2 a high severity vulnerability CVE-2024-11274 was detected. This vulnerability allows attackers to inject NEL (Network Error Logging) headers in the Kubernetes (k8s) proxy response, which could lead to session data exfiltration. To address this issue, users must upgrade to versions 17.4.6, 17.5.4, or 17.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11274.
Read more Developer Tools
In the kvCORE IDX plugin for WordPress version 2.3.35 a medium severity vulnerability CVE-2024-11723 was detected. This vulnerability allows attackers to trick users into clicking malicious links, which can steal personal data or perform harmful actions on their behalf. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-11723.
Read more CMS
In the Essential Real Estate plugin for WordPress version 5.1.6 a medium severity vulnerability CVE-2024-12329 was detected. This vulnerability allows authenticated users with Contributor-level access and above to view sensitive data, such as invoices and transaction logs, without proper authorization. To fix this issue, users should upgrade the Essential Real Estate plugin for WordPress to version 5.1.7. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-12329.
Read more CMS
In the Country Blocker plugin for WordPress versions up to and including 3.2 a medium severity vulnerability CVE-2024-11459 was detected. This vulnerability allows attackers to inject harmful web scripts into pages via the ‘ip’ parameter. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11459.
Read more CMS
In GitLab CE/EE versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4 and starting from 17.6 prior to 17.6.2 a medium severity vulnerability CVE-2024-12292 was detected. This vulnerability allows attackers to access sensitive information retained in GraphQL logs. To address this issue, users should upgrade to versions 17.4.6, 17.5.4, or 17.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12292.
Read more Developer Tools
In GitLab CE/EE versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2 a medium severity vulnerability CVE-2024-12570 was detected. This vulnerability lets attackers use a victim’s CI_JOB_TOKEN to steal their GitLab session token. To address this issue, users should upgrade to versions 17.4.6, 17.5.4, or 17.6.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12570.
Read more Developer Tools
In LibreNMS versions 24.9.0 up to 24.10.0 a medium severity vulnerability CVE-2024-53457 was detected. This vulnerability lets attackers run harmful web scripts or HTML code by adding a specially crafted input into the Display Name field. To address this issue, users should upgrade LibreNMS to version 24.10.1 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-53457.
Read more Monitoring
In the Planaday API plugin for WordPress versions up to and including 11.4 a medium severity vulnerability CVE-2024-11804 was detected. This vulnerability allows attackers to inject harmful web scripts into pages by exploiting the ‘tab’ parameter. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11804.
Read more CMS