Our news and updates

In Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 a medium severity vulnerability CVE-2024-5272 was detected. The “custom_playbooks_playbook_run_updated” webhook event doesn’t restrict its audience, so a guest in a linked channel can view all details of a playbook run after it’s finished. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5272.

In SuiteCRM versions prior to 7.14.4 and prior to 8.6.1 a high severity vulnerability CVE-2024-36415 was detected. This flaw in the product’s file upload system allows attackers to upload harmful files that can be executed, potentially compromising the system. This issue was resolved in versions 7.14.4 and 8.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36415/.

In SuiteCRM versions 7.14.4 and 8.6.1 a critical severity vulnerability CVE-2024-36417 was detected. An unverified IFrame could enable a cross-site scripting attack by allowing harmful inputs to be served to users without proper security checks. To address this issue, users should update SuiteCRM to versions 7.14.4 or 8.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36417/.

In SuiteCRM versions 7.14.4 and 8.6.1 a medium severity vulnerability CVE-2024-36406 was detected. Unchecked input in a web application can be exploited to redirect users to malicious sites, making phishing attacks easier. To address this issue, users should update SuiteCRM to versions 7.14.4 or 8.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36406/.

In SuiteCRM versions 7.14.4 and 8.6.1 a medium severity vulnerability CVE-2024-36407 was detected. An attacker can reset your password without accessing it, which can be annoying, and this only happens if certain password reset features are enabled and the system uses the outdated PHP 7 version. To address this issue, users should update SuiteCRM to versions 7.14.4 and 8.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36407/.

In SuiteCRM prior to versions 7.14.4 and 8.6.1 a high severity vulnerability CVE-2024-36409 was detected. Poor input validation in the Tree data entry point allows SQL Injection because it doesn’t properly clean user input. This means that when the input is passed to other parts of the system, it can change the intended commands. To address this issue, users should update SuiteCRM to versions 7.14.4 or 8.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36409.

In SuiteCRM versions 7.14.4 and 8.6.1 a critical severity vulnerability CVE-2024-36412 was detected. This vulnerability allows attackers to use SQL injection attacks. To address this issue, users must install the fix in the versions 7.14.4 and 8.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36412/.

In Strapi versions prior to 4.19.1 a low severity vulnerability CVE-2024-29181 was detected. This issue allows Authors to see items linked to collections they didn’t create, though they should only see their own items. To receive a patch users should upgrade @strapi/plugin-content-manager to version 4.19.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-29181/.

In SuiteCRM versions prior to 7.14.4 and 8.6 a critical severity vulnerability CVE-2024-36411 was detected. This vulnerability is due to poor input validation in the EmailUIAjax displayView controller, which allows for SQL Injection attacks. Users are strongly advised to upgrade to versions 7.14.4 and 8.6.1 to ensure their systems are secure. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-36411.