Our news and updates

In GitLab versions from 16.8 before 17.1.7, from 17.2 before 17.2.5, and from 17.3 before 17.3.2 a high severity vulnerability CVE-2024-8635 was detected. This vulnerability allows attackers to make unauthorized requests to internal resources using a custom Maven Dependency Proxy URL. To address this issue, upgrade to GitLab version 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8635.

In GitLab EE versions 16.6 to 17.1.7, 17.2 to 17.2.5, and 17.3 to 17.3.2 a high severity vulnerability CVE-2024-8631 was detected. This vulnerability allows users with the Admin Group Member custom role to escalate their privileges to include other custom roles. To address this issue, users should upgrade to GitLab EE to version 17.1.7, 17.2.5, or 17.3.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8631.

In Zabbix versions 5.0.0 – 5.0.42, 6.0.0 – 6.0.30, 6.4.0 – 6.4.15, 7.0.0alpha1 – 7.0.0rc2 a medium severity vulnerability CVE-2024-22122 was detected. This vulnerability allows attackers to execute arbitrary AT commands on a modem through specially crafted input in the “Number” field during SMS notification configuration in Zabbix, due to the lack of validation on both the web interface and server side. To fix this problem, users should upgrade Zabbix to versions 5.0.43rc1, 6.0.31rc1, 6.4.16rc1, and 7.0.0rc3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-22122.

In OpenStack Ironic versions before 21.4.3, from 22.0.0 to 23.0.2, from 23.1.0 to 24.1.2, and from 25.0.0 to 26.0.1 a medium severity vulnerability CVE-2024-44082 was detected. This vulnerability allows attackers to exploit crafted images in OpenStack Ironic, leading to unauthorized access to potentially sensitive data by triggering undesired behaviors in qemu-img. To fix this problem users should upgrade OpenStack Ironic to versions 21.4.3, 23.0.2, 24.1.2, and 26.0.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-44082.

In OpenStack Nova versions before 27.4.1, 28.0 before 28.2.1, and 29.0 before 29.1.1 a medium severity vulnerability CVE-2024-40767 was detected. This vulnerability allows attackers to gain unauthorized access to potentially sensitive data by supplying a crafted image with a file path reference in OpenStack Nova, which can result in the server returning the contents of the referenced file. To fix this problem, users should upgrade OpenStack Nova to versions 27.4.1 and later, 28.2.1 and later, and 29.1.1 and later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-40767.

In PostgreSQL versions before 16.4, 15.8, 14.13, 13.16, 12.20 a high severity vulnerability CVE-2024-7348 was detected. This vulnerability allows attackers to execute SQL functions as a superuser by exploiting a race condition, swapping an object with a view or foreign table during the backup process. To fix this problem, users should upgrade to version 16.4.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-7348.

In Discourse Calendar plugin versions prior to 0.5 a medium severity vulnerability CVE-2024-45303 was detected. This vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks by exploiting dynamic calendar event names. This issue affects sites with modified or disabled default Content Security Policy in Discourse. To address this issue users should update to version 0.5 of the Discourse Calendar plugin. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-45303.

In MySQL Server versions 8.4.0 and prior a medium severity vulnerability CVE-2024-21176 was detected. This vulnerability allows attackers with low privileges and network access via multiple protocols to cause a hang or repeatedly crash the MySQL Server, resulting in a complete denial of service. To fix this issue, users should upgrade to version 8.4.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-21176.

In the Blakeembrey/js-template plugin for Node.js versions before 1.2.0 a high severity vulnerability CVE-2024-45390 was detected. This vulnerability allows attackers to inject and execute malicious code in templates if they can control the template name. To fix this problem, users should upgrade the Blakeembrey/js-template plugin to version 1.2.0. For more details, visit the https://nvd.nist.gov/vuln/detail/CVE-2024-45390.