Our news and updates

In WordPress File Upload plugin for WordPress, all versions up to and including 4.24.8 a high severity vulnerability CVE-2024-7301 was detected. The issue allows unauthenticated attackers to inject arbitrary web scripts into SVG files due to insufficient input sanitization and output escaping, leading to script execution whenever a user accesses the file. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7301.

In Joomla versions 4.0.0 to 4.4.5 and 5.0.0 to 5.1.1 a medium severity vulnerability CVE-2024-21729 was detected. This vulnerability allows attackers to execute cross-site scripting (XSS) attacks due to inadequate input validation in the accessiblemedia field. To address this issue, it is recommended to update to Joomla version 4.4.6 or 5.1.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-21729.

In Nextcloud Server versions 25.0.0 to 25.0.6 and 26.0.0 to 26.0.1 a low severity vulnerability CVE-2024-37314 was detected in the Nextcloud Photos app. This vulnerability allows users to remove photos from the albums of registered users. To address this issue, it is recommended to upgrade to Nextcloud Server version 25.0.7 or 26.0.2 and Nextcloud Enterprise Server version 25.0.7 or 26.0.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-37314.

In Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8 and 2.4.4-p9 a medium severity vulnerability CVE-2024-39415 was detected. This vulnerability allows attackers to bypass security features and access minor information without user interaction. To fix this problem, users should upgrade Magento to versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 and 2.4.4-p10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39415.

In Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9 a medium severity vulnerability CVE-2024-39410 was detected. This vulnerability allows attackers to perform unauthorized actions on behalf of a user by tricking them into interacting with a malicious request. To fix this problem, users should upgrade Magento to versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39410.

In Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9 a high severity vulnerability CVE-2024-39401 was detected. This vulnerability lets an admin attacker accidentally run harmful commands on the system due to how special input elements are handled, needing user interaction to trigger the problem. To fix this issue, users should upgrade Magento to versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39401.

In Apache Airflow versions 1.10.11 and later a critical severity vulnerability CVE-2020-13927 was detected. This vulnerability allowed API requests to be made without authentication, posing significant security risks. To fix this issue, existing users need to update their configuration to [api]auth_backend = airflow.api.auth.backend.deny_all. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-13927.

In Magento Open Source versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9, and earlier a medium severity vulnerability CVE-2024-39419 was detected. This problem allows someone with limited access to bypass security protections and make small changes without permission. It can be exploited without any user action. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39419.

In Magento Open Source 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9 a medium severity vulnerability CVE-2024-39418 was detected. This vulnerability allows attackers to bypass security measures and gain unauthorized access to view and edit low-sensitivity information without needing any user interaction. To fix this problem, users should upgrade Magento Open Source to versions 2.4.7-p2 for 2.4.7-p1 and earlier, 2.4.6-p7 for 2.4.6-p6 and earlier, 2.4.5-p9 for 2.4.5-p8 and earlier, and 2.4.4-p10 for 2.4.4-p9 and earlier. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-39418.