Our news and updates

In SQLite version 0.1.1 a critical severity vulnerability CVE-2024-46488 was detected. This vulnerability allows attackers to trigger a heap buffer overflow using a specially crafted file, potentially causing a system Denial of Service (DoS). To fix this issue, users should upgrade SQLite to version 0.1.3. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-46488.

In WordPress Simple HTML Sitemap versions up to and including 3.1 a high severity vulnerability CVE-2024-7385 was detected. This vulnerability allows authenticated attackers with Administrator-level access or higher to inject additional SQL queries via the ‘id’ parameter, which could be used to extract sensitive information from the database. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7385.

In GitLab versions from 8.0 up to 16.4 a medium severity vulnerability CVE-2023-3441 was detected, allowing attackers to introduce unreviewed or malicious code into sensitive parts of a GitLab repository, which increases the risk of security breaches or data compromise. To fix this issue, users should upgrade to version 16.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2023-3441.

In OpenShift versions using the bind-propagation option in the Dockerfile RUN –mount instruction a medium severity vulnerability CVE-2024-9407 was detected. This vulnerability allows attackers to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9407.

In OpenShift versions using FIPS OpenSSL a medium severity vulnerability CVE-2024-9355 was found. It allows attackers to return an uninitialized buffer in FIPS mode, leading to incorrect hash comparisons and the potential for a derived key to be all zeros. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9355.

In Vault Community Edition versions from 1.7.7 up to 1.17.5 and Vault Enterprise from 1.7.7 up to 1.17.5, 1.16.9, and 1.15.14 a medium severity vulnerability CVE-2024-7594 was detected. This vulnerability allows attackers to authenticate as any user on the host by exploiting an SSH certificate requested by an authorized user, potentially leading to unauthorized access to sensitive resources and data. To fix this issue, users should upgrade Vault Community Edition to version 1.17.6 and Vault Enterprise to versions 1.17.6, 1.16.10, and 1.15.15 For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-7594.

In WordPress MDTF plugin versions up to, and including, 1.3.3.3 a high severity vulnerability CVE-2024-8623 was detected. This vulnerability allows attackers to execute arbitrary shortcodes due to improper validation of input values before running the `do_shortcode` function. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8623.

In Mattermost versions 9.5.x up to and including 9.5.8 a medium severity vulnerability CVE-2024-45843 was detected. This vulnerability allows attackers to exploit the lack of SSRF denylist entries for Oracle Cloud and Alibaba in Mattermost, potentially leading to unauthorized access to internal services or data. To fix this issue, users should upgrade Mattermost to versions 9.11.0 or 9.5.9. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-45843.

In Mattermost versions up to 9.5.x <= 9.5.8 a low severity vulnerability CVE-2024-47145 was detected. This vulnerability allows attackers to view posts and files from archived channels via file links, even when access to archived channels is disabled. To fix this problem, users should upgrade to version 9.11.0 and 9.5.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47145.