https://vulnerability.circl.lu/sightings/feed 2026-06-27T11:49:26.407625+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1796f912-8578-43e6-a60c-306ce2cc8bd8/export 2026-06-27T11:49:26.430093+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "1796f912-8578-43e6-a60c-306ce2cc8bd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24827", "type": "seen", "source": "https://t.me/cibsecurity/57646", "content": "\u203c CVE-2023-24827 \u203c\n\nsyft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable. The `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key `) during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue. The credentials are leaked in two ways: in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level >= `DEBUG`) and in the attestation or SBOM only when the `syft-json` format is used. Note that as of v0.69.0 any generated attestations by the `syft attest` command are uploaded to the OCI registry (if you have write access to that registry) in the same way `cosign attach` is done. This means that any attestations generated for the affected versions of syft when the `SYFT_ATTEST_PASSWORD` environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry. This issue has been patched in commit `9995950c70` and has been released as v0.70.0. There are no workarounds for this vulnerability. Users are advised to upgrade.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-07T07:23:43.000000Z"} 2023-02-07T07:23:43+00:00 https://vulnerability.circl.lu/sighting/60b6d0f9-e2b7-47d8-b31a-53ff7128d1d2/export 2026-06-27T11:49:26.429949+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "60b6d0f9-e2b7-47d8-b31a-53ff7128d1d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24828", "type": "seen", "source": "https://t.me/cibsecurity/57735", "content": "\u203c CVE-2023-24828 \u203c\n\nOnedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-08T02:23:37.000000Z"} 2023-02-08T02:23:37+00:00 https://vulnerability.circl.lu/sighting/72e396e0-adb7-46ee-bbae-7a92f9bd4aa7/export 2026-06-27T11:49:26.428874+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "72e396e0-adb7-46ee-bbae-7a92f9bd4aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-24824", "type": "published-proof-of-concept", "source": "https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh", "content": "", "creation_timestamp": "2023-03-31T19:16:06.000000Z"} 2023-03-31T19:16:06+00:00 https://vulnerability.circl.lu/sighting/94421cc5-125b-480b-953f-05e19480c694/export 2026-06-27T11:49:26.428764+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "94421cc5-125b-480b-953f-05e19480c694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24820", "type": "seen", "source": "https://t.me/cibsecurity/62703", "content": "\u203c CVE-2023-24820 \u203c\n\nRIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset. Thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patch manually.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-24T18:14:27.000000Z"} 2023-04-24T18:14:27+00:00 https://vulnerability.circl.lu/sighting/7031ca80-3b51-48ed-91bd-24798217d19f/export 2026-06-27T11:49:26.428644+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7031ca80-3b51-48ed-91bd-24798217d19f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24822", "type": "seen", "source": "https://t.me/cibsecurity/62724", "content": "\u203c CVE-2023-24822 \u203c\n\nRIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. The NULL pointer dereference causes a hard fault exception, leading to denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patches manually.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-24T20:19:24.000000Z"} 2023-04-24T20:19:24+00:00 https://vulnerability.circl.lu/sighting/4df177a4-e99b-41ae-a4b2-aae28a925eed/export 2026-06-27T11:49:26.428519+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "4df177a4-e99b-41ae-a4b2-aae28a925eed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24821", "type": "seen", "source": "https://t.me/cibsecurity/62732", "content": "\u203c CVE-2023-24821 \u203c\n\nRIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset, thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-24T20:19:33.000000Z"} 2023-04-24T20:19:33+00:00 https://vulnerability.circl.lu/sighting/93faa083-ca24-4141-9dbf-0a8ee74caf61/export 2026-06-27T11:49:26.428404+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "93faa083-ca24-4141-9dbf-0a8ee74caf61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24823", "type": "seen", "source": "https://t.me/cibsecurity/62733", "content": "\u203c CVE-2023-24823 \u203c\n\nRIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header. This occurs while encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. Version 2022.10 fixes this issue. As a workaround, apply the patches manually.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-04-24T20:19:34.000000Z"} 2023-04-24T20:19:34+00:00 https://vulnerability.circl.lu/sighting/a10df98f-c020-49d6-a1a7-d1c4b5db553c/export 2026-06-27T11:49:26.428288+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a10df98f-c020-49d6-a1a7-d1c4b5db553c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24825", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1164", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-24825\n\ud83d\udd39 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds.\n\ud83d\udccf Published: 2023-05-30T15:54:49.930Z\n\ud83d\udccf Modified: 2025-01-10T16:55:33.480Z\n\ud83d\udd17 References:\n1. https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2\n2. https://github.com/RIOT-OS/RIOT/commit/0c522075445a62ce3102e141573ecc2788521897\n3. https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416\n4. https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429\n5. https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729\n6. https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L761\n7. https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169", "creation_timestamp": "2025-01-10T17:03:29.000000Z"} 2025-01-10T17:03:29+00:00 https://vulnerability.circl.lu/sighting/dc3bf2fb-76cc-46f4-912c-0f8c54a0a314/export 2026-06-27T11:49:26.428135+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dc3bf2fb-76cc-46f4-912c-0f8c54a0a314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24826", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1165", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-24826\n\ud83d\udd39 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR.\n\ud83d\udccf Published: 2023-05-30T16:07:45.208Z\n\ud83d\udccf Modified: 2025-01-10T16:54:54.059Z\n\ud83d\udd17 References:\n1. https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xfj4-9g7w-f4gh\n2. https://github.com/RIOT-OS/RIOT/commit/287f030af20e829469cdf740606148018a5a220d\n3. https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L402\n4. https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L420", "creation_timestamp": "2025-01-10T17:03:32.000000Z"} 2025-01-10T17:03:32+00:00 https://vulnerability.circl.lu/sighting/5bde4cfb-5718-4ea4-9839-8b6923f8ab1f/export 2026-06-27T11:49:26.425835+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5bde4cfb-5718-4ea4-9839-8b6923f8ab1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24829", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9147", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-24829\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database.\n\nThis problem is fixed from version 0.13.3 of iotdb-web-workbench onwards.\n\n\n\n\ud83d\udccf Published: 2023-01-31T09:22:41.587Z\n\ud83d\udccf Modified: 2025-03-27T17:13:42.494Z\n\ud83d\udd17 References:\n1. https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gxlksmo", "creation_timestamp": "2025-03-27T17:26:35.000000Z"} 2025-03-27T17:26:35+00:00