Our news and updates

In Foreman version 3.9.0 a medium severity vulnerability CVE-2024-8553 was detected. This vulnerability allows attackers to exploit loader macros to bypass access controls and read any database field if they have permission to create or view report templates. To fix this issue, users should update Foreman to version 3.9.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-8553.

In Vault Community versions from 1.2.0 up to 1.18.0 and Vault Enterprise versions from 1.2.0 up to 1.18.0, 1.17.7, 1.16.11 a medium severity vulnerability CVE-2024-8185 was detected. This vulnerability allows attackers to crash Vault clusters by sending too many requests to a specific API endpoint, which can use up all the available memory and disrupt the service. To fix this issue, users should update Vault Community to version 1.18.1 and Vault Enterprise to versions 1.18.1, 1.17.8, and 1.16.12. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8185.

In WooCommerce PDF Invoices & Packing Slips versions up to 3.8.6 a medium severity vulnerability CVE-2024-5042, was detected. This allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access. To fix this issue, users must upgrade to version 3.8.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-50421.

In Apache NiFi versions 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 a medium severity vulnerability CVE-2024-45477 was detected. This allows attackers to inject and execute arbitrary JavaScript code within the session context of an authenticated user authorized to configure a Parameter Context. To fix this issue, users must upgrade to Apache NiFi version 1.28.0 or 2.0.0-M4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-45477.

In Mattermost versions from 9.11.x prior to 9.11.1 and from 9.5.x prior to 9.5.9 a low severity vulnerability CVE-2024-10214 was detected. This vulnerability allows attackers to create two active sessions, increasing the chance of unauthorized access. To fix this issue, users should update Mattermost to versions 9.11.2, 9.5.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10214.

In Django versions 5.1.1, 5.0.9, and 4.2.16 a medium severity vulnerability CVE-2024-45231 was detected. This issue allows attackers to find out which email addresses are registered by sending password reset requests and checking the response — this only happens if the email system fails to send messages. Currently, there is no fix for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-45231.

In Django versions 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16 a high severity issue CVE-2024-45230 was detected. Attackers can use large inputs with specific characters to cause a denial-of-service attack through the `urlize()` and `urlizetrunc()` filters.
To fix this issue, users are advised to upgrade to versions 5.1.1, 5.0.9, or 4.2.16. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-45230.

In Grafana version 10.4.0 a low severity vulnerability CVE-2024-10452 was detected. This vulnerability allows organization admins to delete pending invites created in an organization they are not part of. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10452.

In Mattermost versions 9.10.0 to 9.10.2, 9.11.0 to 9.11.1, and 9.5.0 to 9.5.9 a medium severity vulnerability CVE-2024-50052 was found. This issue allows authenticated users to delete any post because the system fails to verify the message’s origin. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-50052.