In Python versions prior to 3.13.0 a high severity vulnerability CVE-2024-9287 was detected. This vulnerability in CPython’s venv module allows attackers to add harmful commands to virtual environments, which run when activated. Only environments created by attackers are at risk. To fix this issue, users are advised to upgrade to version 3.13.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-9287.
Read more Application Development
In Umbraco versions 13.x before 13.5.2, 10.x before 10.8.7, and 8.x before 8.18.15 a medium severity vulnerability CVE-2024-48927 was detected. This vulnerability allows attackers to execute code remotely when Backoffice users “preview” SVG files in full-screen mode. To address this issue, update to versions 13.5.2, 10.8.7, or 8.18.15. As a workaround, enable server-side file validation to strip script tags from the content during file uploads. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-48927.
Read more CMS
In Umbraco versions on the 13.x branch prior to 13.5.2 and versions on the 10.x branch prior to 10.8.7 a medium severity vulnerability CVE-2024-48929 was detected. This vulnerability allows attackers to exploit incomplete session termination during explicit sign-outs. To address this issue, users are advised to update to versions 13.5.2 or 10.8.7. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-48929.
Read more CMS
In Nagios XI versions before 2024R1 a critical severity vulnerability CVE-2023-48082 was detected. This vulnerability allows attackers to generate identical API keys for all users, enabling unauthorized authentication. To address this issue, update to Nagios XI 2024R1 or later. For more details, visit https://avd.aquasec.com/nvd/2023/cve-2023-48082.
Read more Monitoring
In GitLab CE/EE versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1 a high severity vulnerability CVE-2024-8312 was detected. This vulnerability allows attackers to inject HTML into the Global Search field on a diff view, leading to cross-site scripting (XSS) attacks. To fix this issue, users should update GitLab to versions 17.5.1, 17.4.3, and 17.3.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8312.
Read more Developer Tools
In GitLab CE/EE all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1 a high severity vulnerability CVE-2024-6826 was detected. This vulnerability allows attackers to cause a denial of service (DoS) by importing a maliciously crafted XML manifest file into GitLab, potentially leading to service disruption. To fix this issue, users should update GitLab to versions 17.5.1, 17.4.3, and 17.3.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6826.
Read more Developer Tools
In Liferay Portal versions 7.4.0 through 7.4.3.103 and Liferay DXP versions from 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and 7.3 update 29 through update 35 a high severity vulnerability CVE-2024-26273 was detected. This vulnerability allows attackers to change user passwords, shut down the server, execute arbitrary code in the scripting console, and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter. To fix this issue, users should update Liferay Portal to version 7.4.3.104 and Liferay DXP to versions 2024.Q1.1, 2023.Q4.3, 2023.Q3.6, 7.3 Update 36. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-26273.
In Liferay Portal versions 7.4.3.75 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92, and 7.3 update 32 through update 36 a high severity vulnerability CVE-2024-26271 was detected. This CSRF vulnerability in the My Account widget allows attackers to change user passwords, shut down the server, execute arbitrary code in the scripting console, and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter. To address this issue, users should update Liferay Portal to version 7.4.3.112, and Liferay DXP to versions 2024.Q1.1, 2023.Q4.3, 2023.Q3.6, 7.3 Update 36. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-26271.
In Liferay Portal versions 7.0.0 to 7.4.3.101 and Liferay DXP versions 2023.Q3.1 to 2023.Q3.4 a critical severity vulnerability CVE-2024-8980 was detected. This vulnerability allows attackers to execute arbitrary Groovy scripts via crafted URLs due to insufficient CSRF protection. To fix this issue, users must upgrade to a patched version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8980.
Read more CMS