PT-2026-98198

Name of the Vulnerable Software and Affected Versions Wazuh versions 3.8.0 through 4.14.6 Description The getattributes function in src/os xml/os xml.c recursively processes XML attributes without a depth limit and allocates two large local buffers in each stack frame. An enrolled agent can submi...

Arbitrary Code Injection

Overview velocityjs is a Velocity Template LanguageVTL for JavaScript Affected versions of this package are vulnerable to Arbitrary Code Injection via the getAttributes function. An attacker can execute arbitrary code on the server by crafting malicious Velocity templates that access the...

CVE-2021-23907

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution...

Remote code execution

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution...

PT-2021-15604

Name of the Vulnerable Software and Affected Versions: Mercedes-Benz MBUX Infotainment System versions through 2021 Description: An issue in the Headunit NTG6 of the MBUX Infotainment System allows remote code execution due to the lack of count checks in the MultiSvGet, GetAttributes, and...

CVE-2021-23907: Undefined Security Weakness

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet, GetAttributes, and MultiSvSet is not checked in the HiQnet Protocol, leading to remote code execution...