CVE-2023-30546

CVE-2023-30546 affects Contiki-NG, where an off-by-one in the Antelope DBMS storage backend (os/storage/antelope/storage-cfs.c) in functions storage_get_index/storage_put_index allocates a buffer one byte too small for merging strings, allowing reads beyond the buffer. The issue is present in Con...

Apache Superset Vulnerability: Insecure Default Configuration Exposes Servers to RCE Attacks

The maintainers of the Apache Superset open source data visualization software have released fixes to plug an insecure default configuration that could lead to remote code execution. The vulnerability, tracked as CVE-2023-27524 CVSS score: 8.9, impacts versions up to and including 2.0.1 and relat...

it-internet-design.de Cross Site Scripting vulnerability OBB-3275718

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Abuse of the Service Location Protocol May Lead to DoS Attacks

The Service Location Protocol SLP, RFC 2608link is external allows an unauthenticated remote attacker to register arbitrary services. This could allow an attacker to use spoofed UDP traffic to conduct a denial-of-service DoS attack with a significant amplification factor. Researchers from Bitsigh...

April 25, 2023—KB5025297 (OS Build 19045.2913) Preview

None None...

April 25, 2023—KB5025298 (OS Build 22000.1880) Preview

None None...

CVE-2023-24822

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. Th...

CVE-2023-24823

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header...

Out-of-bounds

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write wil...

Null pointer dereference

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. Th...

CVE-2023-24823 RIOT-OS vulnerable to Packet Type Confusion during IPHC send

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header...

CVE-2023-24823

RIOT-OS vulnerability CVE-2023-24823 involves a type confusion in the 6LoWPAN IPHC encoding where IPv6 extension headers can be mistaken for a UDP header. Before version 2022.10, this leads to an out-of-bounds write in the packet buffer, which can corrupt other packets and allocator metadata, pot...

CVE-2023-24822

CVE-2023-24822 affects RIOT-OS: the network stack processing 6LoWPAN frames is vulnerable to a NULL-pointer dereference when encoding the 6LoWPAN IPHC header, prior to version 2022.10. Exploitation results in a hard fault and denial of service. The issue is fixed in version 2022.10; a manual patc...

CVE-2023-24819

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be us...

Null pointer dereference

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an...

CVE-2023-24821

CVE-2023-24821 affects RIOT-OS prior to 2022.10, where the 6LoWPAN network stack can process crafted frames that cause a large out-of-bounds write beyond the packet buffer. This yields an unhandled hard fault on RAM pages, causing the system to hang and resulting in denial of service. Version 202...

CVE-2023-24821 RIOT-OS vulnerable to Integer Underflow during defragmentation

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write wil...

CVE-2023-24820 RIOT-OS vulnerable to Integer Underflow during IPHC receive

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. An attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault...

CVE-2023-24820

RIOT-OS CVE-2023-24820 affects the 6LoWPAN network stack; processing crafted frames can trigger a large out-of-bounds write beyond the packet buffer, causing an unhandled hard fault when RAM is exhausted and a denial-of-service condition. The issue is fixed in version 2022.10; a manual patch is a...

CVE-2023-24819 RIOT-OS vulnerable to Buffer Overflow during IPHC receive

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer. The overflow can be us...