Our news and updates

In Vault and Vault Enterprise versions prior to 1.17.1 and 1.16.5 a medium severity vulnerability CVE-2024-6468 was detected. This vulnerability allows attackers to avoid security barriers and gain access to protected user information. To fix this problem, users should upgrade Vault and Vault Enterprise to versions 1.17.2, 1.16.6, and 1.15.12. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6468.

In NetworkManager for Red Hat OpenShift Container Platform 4 a low severity vulnerability CVE-2024-6501 was detected. If a system has DEBUG logs on and an interface called eth1 with LLDP enabled, a hacker could send a bad LLDP packet, causing NetworkManager to crash and resulting in a denial of service. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6501/.

In Gitlab versions from 11.8 to 17.1.2 a low severity vulnerability CVE-2024-6595 was detected. This vulnerability allows attackers to upload an NPM package. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6595/.

In Bootstrap versions from 2.0.0 up to 3.4.1 a medium severity vulnerability CVE-2024-6485 was detected. This vulnerability is related to the button plugin’s data-loading-text attribute. Attackers can exploit this vulnerability by injecting harmful JavaScript code into the attribute. This code executes when the button enters its loading state, potentially enabling Cross-Site Scripting (XSS) attacks. To address this issue, users should upgrade to versions 4.0.0 or higher. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6485.

In Bootstrap carousel component versions from 2.0.0 up to 3.4.1 a medium severity vulnerability CVE-2024-6484 was detected. This vulnerability can expose users to Cross-Site Scripting (XSS) attacks. The problem occurs because the data-slide and data-slide-to attributes are not properly sanitized, allowing attackers to insert malicious code through the href attribute of an tag. To address this issue users should upgrade to version 5.0.0-beta1 or higher. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6484.

In OpenSSH’s server (sshd) versions 4.13, 4.14, 4.15, and 4.16 a high severity vulnerability CVE-2024-6409 was detected. If a remote attacker doesn’t authenticate within a specific time frame, sshd’s signal handler can be triggered asynchronously. This handler calls non-async-signal-safe functions like syslog(), potentially allowing a successful attacker to execute remote code on the sshd server with unprivileged user privileges. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6409.

In Rocket.Chat a medium severity vulnerability CVE-2024-37405 was detected. This vulnerability allows attackers to access sensitive data. There is no fix to this yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-37405/.

In Discourse versions before 3.2.3 a medium severity vulnerability CVE-2024-38360 was detected. This vulnerability allows attackers to reduce the availability of a Discourse instance. To address this issue, users should update to version 3.2.3. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-38360/.

In GitLab versions from 15.8 through 16.11.6, from 17.0 through 17.0.4 and from 17.1 through 17.1.2 a high severity vulnerability CVE-2024-6385 was detected. This vulnerability allows attackers to trigger a pipeline as another user under certain circumstances. To fix this problem, users should upgrade GitLab to one of the following versions 16.11.6, 17.0.4, or 17.1.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6385.