Our news and updates

In Node.js version 18.20.1-r0 and earlier a high severity vulnerability CVE-2024-27983 was detected. An issue in Node.js HTTP/2 server allows attackers to disrupt its function by sending a small amount of specially crafted packets, potentially leading to server unavailability, so it’s important to stay attentive for any unusual server behavior. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-27983/.

In Moodle version 3.10.9 a medium severity vulnerability CVE-2024-29374 was detected. Due to this bug, certain website links could be used by attackers to run harmful scripts in your browser, potentially causing harm. Currently, there is no fix version for this issue. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-29374/.

In pgAdmin version 8.4 and earlier a high severity vulnerability CVE-2024-3116 was detected. It allows attackers to run harmful code on the server, endangering the integrity of the database system and the safety of your data. To address this issue, users are advised to update pgAdmin to version 8.5 or later. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-3116/.

In Openshift a medium severity vulnerability CVE-2024-0406 was detected. An issue has been identified where certain files, when unpacked from a tar file, could potentially grant unauthorized access or modify files with the user’s permission, so be cautious when extracting files from unknown sources. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-0406/.

In Moodle version 4.3.3 a medium severity vulnerability CVE-2024-28593 was detected. The Chat activity allows students to insert a potentially unwanted HTML A element, IMG element, or HTML content that leads to performance degradation. The vendor’s Using_Chat page says “If you know some HTML code, you can use it in your text to do things like insert images, play sounds, or create different colored and sized text.”  To fix this issue, users should upgrade Moodle to versions 4.3.4 or later. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-28593/.

In Mautic versions up to 4.4.9 a medium severity vulnerability CVE-2024-2730 was detected. Unpublished landing pages can be accessed through public preview URLs, even by people who aren’t logged in. This could potentially leak sensitive information. There’s no fix available for this issue at the moment. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-2730/.

In Mautic a medium severity vulnerability CVE-2024-2731 was detected. Users with low privileges, having all permissions deselected, can access pages revealing sensitive data such as company names, users’ names and surnames, stage names, monitoring campaigns, and their descriptions. Additionally, unprivileged users can view and modify tag descriptions. At the time of publication of the CVE no patch is available. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-2731/.

In Mautic a medium severity vulnerability CVE-2024-3448 was detected. This vulnerability allows users with low privileges to improperly perform certain AJAX actions, resulting in a Server-Side Request Forgery. Attackers can exploit this vulnerability to analyze error messages and conduct a port scan in the back-end. At the time of publication of the CVE no patch is available. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-3448/.

In Apache HTTP Server versions through 2.4.58 a medium severity vulnerability CVE-2024-24795 was detected. This issue allows attackers to add bad response headers to backend apps, causing something called an HTTP desynchronization attack. This vulnerability is fixed in Apache HTTP Server 2.4.59. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-24795/.