CVE-2023-26323

A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code...

CVE-2023-26323

A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code...

CVE-2023-26323

A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code...

CVE-2023-26323 Xiaomi App Market has a code execution vulnerability

A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code...

CVE-2023-26323 Xiaomi App Market has a code execution vulnerability

A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code...

PT-2024-12096 · Xiaomi · Xiaomi App Market

Name of the Vulnerable Software and Affected Versions: Xiaomi App Market product affected versions not specified Description: A code execution vulnerability exists in the Xiaomi App market product due to unsafe configuration, allowing attackers to execute arbitrary code. The vulnerability can be...

The vulnerability of the NET-SNMP-VACM-MIB() function in the Net-SNMP software suite for the Linux operating system allows a attacker to compromise the integrity of the system.

The vulnerability of the NET-SNMP-VACM-MIB function in the Net-SNMP software suite for the Linux operating system is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the system...

log4j: Unsafe deserialization flaw in Chainsaw log viewer

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

The vulnerability of the PSM Windows Resource Manager service on Windows operating systems allows attackers to increase their privileges.

The vulnerability of the PSM Windows Resource Manager service in the Windows operating system is related to the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

GO-2022-0291 Unsafe inline XSS in pasting DOM element into chat in github.com/owncast/owncast

Unsafe inline XSS in pasting DOM element into chat in github.com/owncast/owncast...

GO-2023-2134 Artifact Hub allows unsafe rego built-in in github.com/artifacthub/hub

Artifact Hub allows unsafe rego built-in in github.com/artifacthub/hub...

The vulnerability of the Netcat module in CMS systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the messaging module in the CMS system Netcat is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to the protected information from the database...

The vulnerability of the Windows operating system’s kernel allows attackers to enhance their privileges.

The vulnerability of Windows operating system kernels is related to the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the clipboard data exchange service between devices via the Windows operating system’s Clipboard Virtual Channel Extension allows a hacker to execute arbitrary code.

The vulnerability of the clipboard service between devices under the Windows operating system’s Virtual Channel Extension relies on the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2024-42362

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...

CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...

CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...

CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...

CVE-2024-42363 GHSL-2023-136_Samson

Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parsefile method where it is unsafely deserialized using the YAML.loadstream...