Our news and updates

In Ansible Automation Platform version 2 a medium severity vulnerability CVE-2024-11483 was detected. Attackers can escalate privileges by misusing read-scoped OAuth2 (Open Authorization 2.0) tokens to gain write access, affecting API endpoints using ansible_base.oauth2_provider. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-11483.

In InfluxDB versions through 2.7.10 a high severity vulnerability CVE-2024-30896 was detected. This vulnerability allows administrators with high-level access to view sensitive authentication tokens, potentially exposing them to misuse. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-30896.

In Kubernetes versions prior to 1.28.11, and from 1.29.0 to 1.29.6 and 1.30.0 to 1.30.2 a high severity vulnerability CVE-2024-10220 was detected. This vulnerability allows attackers to execute arbitrary commands via specially crafted gitRepo volumes, potentially compromising the affected system. To fix this issue, users should upgrade Kubernetes to versions 1.28.12, 1.29.7, 1.30.3. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-10220.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26 and 8.3.* before 8.3.14 a critical severity vulnerability CVE-2024-11236 was detected. This vulnerability allows attackers to exploit long string inputs to cause system crashes or execute malicious actions. To fix this issue, users should upgrade PHP to versions 8.1.31, 8.2.26, or 8.3.14. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-11236.

In Authentik versions prior to 2024.8.5 a medium severity vulnerability CVE-2024-52307 was detected. This vulnerability allows attackers to brute-force the SECRET_KEY, which secures the /-/metrics/ endpoint, due to a flaw in how comparisons are done. To fix this issue, users need to update to versions 2024.8.5 or 2024.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-52307.

In Authentik versions prior to 2024.8.5 a high severity vulnerability CVE-2024-52289 was detected. This vulnerability allows attackers to bypass redirect URI validation and potentially redirect users to malicious websites. To fix this issue, users should upgrade Authentik to versions 2024.8.5 and 2024.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-52289.

In LibreNMS versions before 24.10.0 a medium severity vulnerability CVE-2024-50352 was detected. This vulnerability allows attackers to inject malicious JavaScript through the “name” field in the “Services” section. To address this issue, update to LibreNMS version 24.10.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-50352.

In LibreNMS versions before 24.10.0 a medium severity vulnerability CVE-2024-50355 was detected. This vulnerability allows attackers with Admin role to inject JavaScript code into the device Display Name, which is not properly sanitized. The injected code can be triggered from different sources. To address this issue, update to LibreNMS version 24.10.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-50355.

In LibreNMS versions before 24.10.0 a medium severity vulnerability CVE-2024-51494 was detected. This vulnerability allows authenticated users to inject arbitrary JavaScript through the “descr” parameter when editing a device’s port settings on the “Port Settings” page. The injected code can be executed when the page is visited, potentially compromising the user’s session and enabling unauthorized actions. To address this issue, update to LibreNMS version 24.10.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-51494.