Our news and updates

In Moodle a low severity vulnerability CVE-2024-38275 was detected. Due to the flaw, sensitive authorization information could be mistakenly sent to different websites during redirects. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-38275/.

In Moodle a low severity vulnerability CVE-2024-38274 was detected. This issue allows harmful code to be stored in calendar event titles, posing a risk when deleting events due to improper handling of user input. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-38274/.

In GitLab CE/EE versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2 a mediium severity vulnerability CVE-2024-1963 was detected. This vulnerability in GitLab’s Asana integration enables an attacker to exploit a regular expression denial of service through carefully constructed requests. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-1963.

In Moodle CMS version 3.10 a low severity vulnerability CVE-2024-37674 was detected. This vulnerability allows a remote attacker to run any code they want through the name parameter when creating a new activity. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-37674/.

In Strapi version 4.24.4 a low severity vulnerability CVE-2024-37818 was detected. This vulnerability allows attackers to access sensitive information or scan for open ports using a crafted GET request. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-37818/.

In Moodle versions 4.4, 4.3 to 4.3.4, 4.2 to 4.2.7, 4.1 to 4.1.10 and earlier a medium severity vulnerability CVE-2024-38277 was detected. It involves the use of cryptographic keys or passwords beyond their expiration date. This oversight extends the window during which these credentials could be vulnerable to cracking attacks, emphasizing the critical need for timely key and password management to uphold robust security measures. To fix this issue, users should upgrade Moodle to versions 4.4.1, 4.3.5, 4.2.8 and 4.1.11. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-38277/.

In FreeIPA a high severity vulnerability CVE-2024-2698 was detected. This vulnerability allows attackers to get access by bypassing the authorization. There is not solution to this yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-2698/.

In Kibana versions prior to 7.17.22 and prior to 8.14.0 a medium severity vulnerability CVE-2024-23443 was detected. This vulnerability allows attackers to upload a maliciously crafted osquery pack. To address this issue, users should upgrade Kibana to version 7.17.22, 8.14.0 or higher. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-23443/.

In Kibana versions prior to 7.17.22 and from 8.0.0 prior to 8.14.0 a medium severity vulnerability CVE-2024-23442 was detected. This issue allows malicious URLs to redirect users to fake websites, making phishing attacks easier. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-23442/.