Our news and updates

In Vault and Vault Enterprise versions 1.14.0 and newer a medium severity vulnerability CVE-2024-2660 was detected. This vulnerability affects how Vault checks for certificate status, potentially letting someone with network access use a fake certificate to get unauthorized access. The issue is resolved in Vault version 1.16.0 and Vault Enterprise versions 1.16.1, 1.15.7, and 1.14.11. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-2660.

In Ansible versions v3.0.0-v3.10.6 a critical security vulnerability, CVE-2024-29202 was detected. This vulnerability allows attackers to steal sensitive data. To address this issue, users are advised to upgrade to v3.10.7. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-29202.

In Dolibarr a critical security vulnerability CVE-2024-29477 was detected. This vulnerability allows attackers to access your network and execute malicious code during installation. The issue is resolved in Dolibarr version 19.0.1 or newer. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-29477.

In Elasticsearch versions 8.10.0 and before 8.13.0 a medium security vulnerability CVE-2024-23451 was detected. This vulnerability affects the API key-based security model for Remote Cluster Security 20. This allows a malicious user with a valid API key to read arbitrary documents from any index on a remote cluster. The issue is resolved in Elasticsearch version 8.13.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-23451.

In Apache Airflow package versions 2.8.2 to 2.8.4 a medium security vulnerability CVE-2024-29735 was detected. This vulnerability causes permission issues. The issue is resolved in Apache Airflow versions 2.8.4 or newer. A workaround is to avoid using the root user, upgrade to a newer version, or adjust permissions in the Airflow config file. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-29735.

In OpenShift Virtualization a medium security vulnerability CVE-2024-31419 was detected. This vulnerability allows attackers to disclose limited host metrics to any guest without administrator consent. The issue is resolved in version Container-native Virtualization 4.15.1. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31419.

The identified XSS vulnerability in Typebot’s sign-in page, up to version 2.24.0, posed a significant security threat by potentially allowing attackers to compromise user accounts. By exploiting the redirectPath parameter in the URL, attackers could execute malicious JavaScript, thereby gaining unauthorized access. The release of version 2.24.0 signifies a proactive response to address this vulnerability, reinforcing Typebot’s commitment to user security and the integrity of its platform.

In Grafana versions 9.5.0 to 10.3.5 a medium security vulnerability CVE-2024-1313 was detected. This vulnerability allows a user from a different organization to delete a snapshot by bypassing authorization using its view key. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-1313.

Argo CD users, a critical security flaw in specific versions demands immediate action to prevent unauthorized access. This vulnerability, tied to authentication mechanisms, could allow attackers to bypass login credentials. It’s found in certain session validation configurations, posing a significant risk of unauthorized changes or data access. Review your Argo CD version against official documentation to ensure you’re not vulnerable. Upgrading to the latest version is advised for enhanced security.