Our news and updates

In Apache Airflow Providers FAB versions 1.2.1 (when used with Apache Airflow 2.9.3), FAB 1.2.0 for all Airflow versions a critical severity vulnerability CVE-2024-42447 was detected. This vulnerability allows attackers to maintain access to the application even after the user attempts to log out by exploiting session persistence. To fix this issue, users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-42447.

In WordPress versions up to 2.1.0 a medium severity vulnerability CVE-2024-7848 was detected. This vulnerability allows authenticated users, even with low-level access, to access other users’ private files due to improper validation. To fix this issue, users must upgrade WordPress to the latest version. For more details, visit: https://nvd.nist.gov/vuln/detail/CVE-2024-7848.

In Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 a medium severity vulnerability CVE-2024-40884 was detected. This vulnerability allows attackers with team admin access to disable the invite link for new members, even if they don’t have permission to add team members, which can interfere with team management and control. To fix this problem, users should upgrade Mattermost to versions 9.5.8 and 9.10.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-40884.

In NGINX Agent versions>=2.17.0<=2.36.1 and in NGINX Instance Manager versions >=2.3.1<=2.17.1=3 a medium severity vulnerability CVE-2024-7634 was detected.The restriction feature allows a highly privileged attacker to write or overwrite files outside the secure directory. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7634.

In JupyterLab versions before 3.6.7 and from 4.0.0 to 4.2.4 a high severity vulnerability CVE-2024-43805 was detected. This vulnerability allows attackers to gain access to any data the victim can access and execute arbitrary requests as if they were the victim by exploiting a vulnerability in JupyterLab through malicious notebooks or Markdown files. To fix this problem, users should upgrade JupyterLab to versions 3.6.8 and 4.2.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-43805.

In Drupal versions 11.x-dev a medium severity vulnerability CVE-2024-45440 was detected. This allows attackers to obtain the full directory path of the Drupal installation, which can provide valuable information for further attacks or exploitation, even if error logging is disabled. This vulnerability is currently unpatched. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-45440.

In Mattermost versions 9.5.x <= 9.5.7 and 9.10.x <= 9.10.0 a medium severity vulnerability CVE-2024-39810 was detected. The ElasticSearch configuration lacks time and size limits on the CA path file, allowing a user with console access to add files like /dev/zero, which can crash the application.  Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39810.

In Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x <= 9.8.2 a medium severity vulnerability CVE-2024-39836 was detected. Mattermost versions have a vulnerability where remote or synthetic users can use munged email addresses from shared channels to create sessions and reset passwords if the emails are valid. To fix this problem, users should upgrade to version 9.11.0, 9.9.2, 9.5.8, 9.10.1, or 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39836.

In Mattermost versions 9.9.x ≤ 9.9.1, 9.5.x ≤ 9.5.7, 9.10.x ≤ 9.10.0, and 9.8.x ≤ 9.8.2 a medium severity vulnerability CVE-2024-40886 was detected. This vulnerability allows attackers to perform a one-click path traversal and launch a CSRF attack on the User Management page. To fix this problem, users should upgrade to version 9.11.0, 9.9.2, 9.5.8, 9.10.1, 9.8.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-40886.