Our news and updates

In Mattermost versions 9.10.x ≤ 9.10.2, 9.11.x ≤ 9.11.1, and 9.5.x ≤ 9.5.9 a medium severity vulnerability CVE-2024-47401 was detected. This vulnerability allows attackers to generate large responses, resulting in an amplified GraphQL response that could cause the application to crash by sending a specially crafted request to Playbooks. To fix this issue, users should upgrade Mattermost to versions 8.0.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47401.

In Mattermost versions 9.10.x ≤ 9.10.2, 9.11.x ≤ 9.11.1, and 9.5.x ≤ 9.5.9 a medium severity vulnerability CVE-2024-46872 was found. This vulnerability lets attackers bypass security by manipulating user inputs, leading to CSRF attacks in Playbooks. To fix this issue, users are advised to upgrade to version 8.0.0 or above, specifically the version released after 2024-09-26. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-46872.

In Mattermost versions 9.5.x up to 9.5.9 a medium severity vulnerability CVE-2024-10241 was detected. This vulnerability allows attackers to see the names of private channels they shouldn’t have access to using the cmd+K or ctrl+K shortcut. To fix this issue, users should update Mattermost to version to version 9.5.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10241.

In Umbraco CMS versions from 14.0.0 to before 14.3.0 a medium severity vulnerability CVE-2024-48925 was detected. This vulnerability allows low-privilege users to access the webhook API and retrieve information restricted to users with access to the settings section. To address this issue, upgrade to version 14.3.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-48925.

In Sonatype Nexus Repository versions 3.0.0 through 3.72.0 a medium severity vulnerability CVE-2024-5764 was detected. This vulnerability allows attackers to exploit hard-coded encryption passphrases in the repository’s configuration database, compromising the security of stored secrets like SMTP, HTTP proxy credentials, and user tokens. Currently, there is no patch version for this vurnerability. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-5764.

In Nginx UI versions prior to 2.0.0-beta.36 a high severity vulnerability CVE-2024-49368 was detected. This vulnerability allows attackers to execute arbitrary commands by exploiting improper input validation in the logrotate configuration. To fix this issue, users must upgrade to version 2.0.0-beta.36. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-49368.

In OneDev versions prior to 11.0.9 a high severity vulnerability CVE-2024-45309 was detected. This vulnerability allows attackers to read arbitrary files accessible by the OneDev server process, even without authentication. To fix this issue, users must upgrade to version 11.0.9. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-45309.

In OpenShift GraphQL introspection feature a medium severity vulnerability CVE-2024-50312 was detected. This vulnerability lets unauthorized users access introspection, exposing all available queries and mutations, which increases attack risk. To temporarily fix this, disable GraphQL introspection in OpenShift Console settings; this may limit some development tools. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-50312.

In Umbraco versions 13.x before 13.5.2, 10.x before 10.8.7, and 8.x before 8.18.15 a medium severity vulnerability CVE-2024-48927 was detected. This vulnerability allows attackers to execute code remotely when Backoffice users “preview” SVG files in full-screen mode. To address this issue, update to versions 13.5.2, 10.8.7, or 8.18.15. As a workaround, enable server-side file validation to strip script tags from the content during file uploads. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-48927.