Our news and updates

In the MySQL Server product of Oracle MySQL in versions 8.0.34 and prior a medium severity vulnerability CVE-2024-21053 was detected. It allows high-privileged attackers with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or crash of MySQL Server. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-21053/.

In NGINX Plus or NGINX OSS a medium severity vulnerability CVE-2024-32760 was detected. This vulnerability allows attackers to use undisclosed HTTP/3 and cause NGINX worker processes to terminate. There are no solutions to it yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-32760/.

In ‘bson’ module of MongoDB version 4.6.2 a medium severity vulnerability CVE-2024-5629 was detected. This vulnerability allows attackers to have an access to the application memory. There are no solutions for this yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5629/.

In Kanboard version 1.2.36 a high severity vulnerability CVE-2024-36399 was detected. This vulnerability allows attackers to take over any other project. To address this issue, users need to update to version 1.2.37. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36399/.

In Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, and 8.1.x <= 8.1.12 a medium severity vulnerability CVE-2024-36255 was detected. This flaw lets attackers run task commands as other users by creating fake post actions that trigger unexpected commands in any channel. The web application does not properly check user input. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36255/.

In NGINX Plus or NGINX OSS a medium severity vulnerability CVE-2024-34161 was detected. When these apps use a feature called HTTP/3 QUIC, and the network allows big data to move smoothly, certain packets can trick NGINX into releasing memory it’s supposed to keep. Update NGINX Plus or NGINX OSS to a fixed version that resolves the issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-34161.

In Apache Superset versions before 3.0.3 a medium severity vulnerability CVE-2023-49657 was detected. Attackers with permission to create or update charts or dashboards can insert harmful scripts or HTML snippets, enabling them to execute cross-site scripting attacks. To enhance security in 2.X versions, users need to update their configuration settings. For more information, visit https://avd.aquasec.com/nvd/2023/cve-2023-49657/.

In Apache Airflow versions before 2.8.2 vulnerability CVE-2024-26280 was detected. This issue allows certain users to see audit logs they shouldn’t. Starting from version 2.8.2, only admin users can view audit logs by default. Others need explicit permission. It’s advised to upgrade to version 2.8.2 or later to fix this problem. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-26280/.

In Apache Airflow versions 2.8.0 through 2.8.2 a high severity vulnerability CVE-2024-28746 was detected. It allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-28746/.