Our news and updates

In MySQL Cluster versions 7.5.33 and prior, 7.6.29 and prior, 8.0.36 and prior and 8.3.0 and prior a low severity vulnerability CVE-2024-21101 was detected. High-privileged attackers with network access can exploit this vulnerability to read some data in the MySQL Cluster without authorization. Currently, there is no fix version for this vulnerability. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-21101/.

In Nginx a medium severity vulnerability CVE-2024-31079 was detected. A vulnerability can cause it to crash if specific, well-timed requests are made, though the attacker has limited control over the timing. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-31079/.

In OpenProject a high severity vulnerability CVE-2024-35224 was detected. A project admin could exploit a bug in the Cost Report feature to insert harmful code. Updating to version 13.4.2, 14.0.2, or 14.1.0 resolves this vulnerability. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-35224/.

In WooCommerce version 5.0.4 a medium severity vulnerability CVE-2024-35748 was detected. This vulnerability allows attackers to get access without an authorization check. There is no solution yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-35748/.

In Mattermost versions 9.6.0 and 8.1.11 a medium severity vulnerability CVE-2024-31859 was detected. This vulnerability allows attackers to get the admin role. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-31859/.

In Apache HTTP Server versions through 2.4.58 a low severity vulnerability CVE-2023-38709 was detected. Weak input validation within Apache’s core can enable malicious or exploitable backend systems or content generators to manipulate and divide HTTP responses. For more information, visit https://avd.aquasec.com/nvd/2023/cve-2023-38709/.

In the MySQL Server product of Oracle MySQL in versions 8.0.34 and prior a medium severity vulnerability CVE-2024-21053 was detected. It allows high-privileged attackers with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or crash of MySQL Server. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-21053/.

In NGINX Plus or NGINX OSS a medium severity vulnerability CVE-2024-32760 was detected. This vulnerability allows attackers to use undisclosed HTTP/3 and cause NGINX worker processes to terminate. There are no solutions to it yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-32760/.

In ‘bson’ module of MongoDB version 4.6.2 a medium severity vulnerability CVE-2024-5629 was detected. This vulnerability allows attackers to have an access to the application memory. There are no solutions for this yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5629/.