https://vulnerability.circl.lu/sightings/feed 2026-05-08T23:06:04.493991+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1f8130cb-9613-4516-8a07-619019b1b029/export 2026-05-08T23:06:04.803960+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "1f8130cb-9613-4516-8a07-619019b1b029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29249", "type": "seen", "source": "https://t.me/cibsecurity/43279", "content": "\u203c CVE-2022-29249 \u203c\n\nJavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-24T20:37:00.000000Z"} 2022-05-24T20:37:00+00:00 https://vulnerability.circl.lu/sighting/03c582b5-f6c1-49a8-a530-26e62089a5b2/export 2026-05-08T23:06:04.803874+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "03c582b5-f6c1-49a8-a530-26e62089a5b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29248", "type": "seen", "source": "https://t.me/cibsecurity/43356", "content": "\u203c CVE-2022-29248 \u203c\n\nGuzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-25T22:38:27.000000Z"} 2022-05-25T22:38:27+00:00 https://vulnerability.circl.lu/sighting/04229dec-7bd1-4fe2-b166-775f74629802/export 2026-05-08T23:06:04.803795+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "04229dec-7bd1-4fe2-b166-775f74629802", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29243", "type": "seen", "source": "https://t.me/cibsecurity/43570", "content": "\u203c CVE-2022-29243 \u203c\n\nNextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size validation of new session names allows users to create app passwords with long names. These long names are then loaded into memory on usage, resulting in impacted performance. Versions 22.2.7 and 23.0.4 contain a fix for this issue. There are currently no known workarounds available.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-31T20:23:48.000000Z"} 2022-05-31T20:23:48+00:00 https://vulnerability.circl.lu/sighting/06561192-7b00-43f1-9fb2-291d8aa8a3ec/export 2026-05-08T23:06:04.803712+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "06561192-7b00-43f1-9fb2-291d8aa8a3ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29245", "type": "seen", "source": "https://t.me/cibsecurity/43573", "content": "\u203c CVE-2022-29245 \u203c\n\nSSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client\u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u201e\u00a2s private key is generated with `System.Random`. `System.Random` is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes. When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be brute forced. This allows an attacker who is able to eavesdrop on the communications to decrypt them. Version 2020.0.2 contains a patch for this issue. As a workaround, one may disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-31T20:23:51.000000Z"} 2022-05-31T20:23:51+00:00 https://vulnerability.circl.lu/sighting/90d81cf7-fcfa-406b-a01c-ad5992a8e953/export 2026-05-08T23:06:04.803625+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "90d81cf7-fcfa-406b-a01c-ad5992a8e953", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29244", "type": "seen", "source": "https://t.me/cibsecurity/44300", "content": "\u203c CVE-2022-29244 \u203c\n\nnpm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-13T18:18:05.000000Z"} 2022-06-13T18:18:05+00:00 https://vulnerability.circl.lu/sighting/deb2750a-e558-4fbf-b74e-e238414d2008/export 2026-05-08T23:06:04.803522+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "deb2750a-e558-4fbf-b74e-e238414d2008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29247", "type": "seen", "source": "https://t.me/cibsecurity/44339", "content": "\u203c CVE-2022-29247 \u203c\n\nElectron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-14T00:17:18.000000Z"} 2022-06-14T00:17:18+00:00 https://vulnerability.circl.lu/sighting/e6f9c220-d205-4939-9b32-02d8d8bcf1a0/export 2026-05-08T23:06:04.803426+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "e6f9c220-d205-4939-9b32-02d8d8bcf1a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29241", "type": "seen", "source": "https://t.me/cibsecurity/44470", "content": "\u203c CVE-2022-29241 \u203c\n\nJupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this URL can be used from a cross-site scripting payload or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact with Jupyter services/notebooks such as modifying or overwriting critical files, such as .bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially sensitive data and possibly gain control of the impacted system. This issue is patched in version 1.17.1.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-15T00:19:32.000000Z"} 2022-06-15T00:19:32+00:00 https://vulnerability.circl.lu/sighting/6143ab37-5ea2-4398-9268-266407ef77d1/export 2026-05-08T23:06:04.803324+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "6143ab37-5ea2-4398-9268-266407ef77d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29240", "type": "seen", "source": "https://t.me/cibsecurity/49860", "content": "\u203c CVE-2022-29240 \u203c\n\nScylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-16T02:27:59.000000Z"} 2022-09-16T02:27:59+00:00 https://vulnerability.circl.lu/sighting/6fc1a2c0-c85b-4f77-81c8-014e390376d5/export 2026-05-08T23:06:04.803189+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "6fc1a2c0-c85b-4f77-81c8-014e390376d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2924", "type": "seen", "source": "https://t.me/cibsecurity/50127", "content": "\u203c CVE-2022-2924 \u203c\n\nCross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-20T12:39:05.000000Z"} 2022-09-20T12:39:05+00:00 https://vulnerability.circl.lu/sighting/920b63b0-ce01-4f6b-8b34-77c793e060d5/export 2026-05-08T23:06:04.801209+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "920b63b0-ce01-4f6b-8b34-77c793e060d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29248", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mkc5ydmwhq2n", "content": "", "creation_timestamp": "2026-04-25T04:05:07.725618Z"} 2026-04-25T04:05:07.725618+00:00