Our news and updates

In Discourse a medium severity vulnerability CVE-2024-21658 was detected. This vulnerability allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been patched in the main branch. To address this issue, users should upgrade to the latest version of Discourse. For more details, visit the https://nvd.nist.gov/vuln/detail/CVE-2024-21658.

In Lightdash version 0.1024.6 a high severity vulnerability CVE-2024-6586 has been detected. This vulnerability allows users with the necessary permissions to create and share dashboards containing HTML elements that can point to a threat actor-controlled source, which may trigger an SSRF request when exported via a POST request to /api/v1/dashboards//export. To fix this issue, users should upgrade to Lightdash version 0.1027.2. For more details, please visit the https://nvd.nist.gov/vuln/detail/CVE-2024-6586.

In Lightdash version 0.1024.6 a high severity vulnerability (CVE-2024-6585) was detected. This vulnerability allows attackers to inject malicious code into a website, potentially stealing user data or performing harmful actions in their browsers. To fix this problem, users should upgrade Lightdash to version 0.1042.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6585.

In CPython versions before 3.12.0 a medium severity vulnerability CVE-2024-7592 was detected. This vulnerability allows attackers to send cookies that use backslashes, causing the system to use excessive CPU and slow down. To fix this problem, users should upgrade CPython to version 3.13.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7592.

In Grafana versions 1.1.37 to 1.5.1 a critical severity vulnerability CVE-2024-5526 was detected. This vulnerability involves unsanitized inputs in the webhook functionality that can be exploited, allowing attackers to perform a Server Side Request Forgery attack. To fix this problem, users should upgrade Grafana OnCall to version 1.5.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-5526.

In Apache Airflow Providers FAB versions 1.2.1 (when used with Apache Airflow 2.9.3), FAB 1.2.0 for all Airflow versions a critical severity vulnerability CVE-2024-42447 was detected. This vulnerability allows attackers to maintain access to the application even after the user attempts to log out by exploiting session persistence. To fix this issue, users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-42447.

In Vault versions 1.16.7 and 1.17.3 a medium severity vulnerability CVE-2024-8365 was detected. This vulnerability allows plaintext client tokens and token accessors, which should have been securely hashed, to be stored directly in the audit logs, exposing sensitive information and potentially compromising security. To fix this issue, users should update Vault to versions 1.16.9 or 1.17.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8365.

In OpenShift AI versions before 2.9 a high severity vulnerability CVE-2024-7557 was detected. This allows attackers to bypass authentication and escalate privileges, gaining unauthorized access to other AI models and APIs within the same namespace by exploiting exposed ServiceAccount tokens. To fix this problem, users should upgrade OpenShift AI to version 2.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7557.

In Magento’s all versions a medium severity vulnerability CVE-2024-4812 was detected. This vulnerability allows storing malicious JavaScript code in the “Description” field of a user account, which can be executed when opening certain pages like Host Collections. To fix this issue, users must upgrade Magento to the latest version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-4812.