CVE-2019-6743

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

Heap overflow

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

CVE-2019-6743

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

CVE-2019-6743

The CVE-2019-6743 entry relates to Xiaomi Mi6 Browser prior to 10.4.0, with a flaw in WebAssembly.Instance due to improper validation that can cause a heap-based write overflow. This enables remote code execution when a user visits a malicious page or opens a malicious file and requires user inte...

CVE-2019-12500

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking...

CVE-2019-12500

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking...

Authentication flaw

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking...

CVE-2019-12500

The CVE-2019-12500 entry concerns the Xiaomi M365 scooter. The vulnerability is rooted in Bluetooth Low Energy commands lacking server-side authentication, enabling spoofing of critical controls such as a sudden acceleration, braking, locking, and unlocking. Affected firmware is prior to 1.5.1. D...

CVE-2019-12500

The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no server-side authentication check. Other affected commands include suddenly braking, locking, and unlocking...

Xiaomi Yeelight Smart AI Speaker Access Control Error Vulnerability

Xiaomi Yeelight Smart AI Speaker is a smart speaker from Chinese company Xiaomi Technology Xiaomi. An access control error vulnerability exists in Xiaomi Yeelight Smart AI Speaker version 3.3.100074. The vulnerability stems from a network system or product not properly restricting access to...

Code injection

The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service resonance and false data via a 20.4 kHz audio signal, aka a MEMS ultrasound attack...

CVE-2018-20823

The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service resonance and false data via a 20.4 kHz audio signal, aka a MEMS ultrasound attack...

CVE-2018-20823

The CVE-2018-20823 issue affects the gyroscope on Xiaomi Mi 5s devices, where a 20.4 kHz MEMS ultrasonic signal can cause resonance, producing false data and a denial-of-service condition. This vulnerability is documented across multiple sources (NVD, Red Hat, CVE listings, PT-Security, etc.), id...

CVE-2018-20823

The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service resonance and false data via a 20.4 kHz audio signal, aka a MEMS ultrasound attack...

PT-2019-10262 · Xiaomi · Xiaomi Mi 5S

Name of the Vulnerable Software and Affected Versions: Xiaomi Mi 5s affected versions not specified Description: The issue concerns the gyroscope on Xiaomi Mi 5s devices, which can be exploited by attackers to cause a denial of service. This can be achieved by using a 20.4 kHz audio signal, also...

Unauthorized access vulnerability in Xiaomi ai speakers

Xiaomi ai speaker is a smart speaker product from Xiaomi. Xiaomi ai speaker has an unauthorized access vulnerability that can be exploited by an attacker to control the speaker to play remote and local arbitrary audio files...

Xiaomi Mi6 Browser Information Disclosure Vulnerability

Xiaomi Mi6 Browser is a web browser from Xiaomi Technology Xiaomi, a Chinese company. An information disclosure vulnerability exists in the 'CollectValuesOrEntriesImpl' function in Xiaomi Mi6 Browser. A remote attacker can exploit this vulnerability to execute arbitrary code in the context of the...

(Pwn2Own) Xiaomi Mi6 V8 CollectValuesOrEntriesImpl Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Xiaomi Mi6 Browser Remote Code Execution Vulnerability

Xiaomi Mi6 Browser is a web browser from Xiaomi Technology Xiaomi, a Chinese company. A remote code execution vulnerability exists in Xiaomi Mi6 Browser, which arises from a network system or product that does not properly validate incoming data and can be exploited by remote attackers to execute...

Xiaomi Mi6 Browser Out-of-Bounds Write Vulnerability

Xiaomi Mi6 Browser is a web browser from Xiaomi Technology Xiaomi, a Chinese company. An out-of-bounds write vulnerability exists in Xiaomi Mi6 Browser, which arises from a networked system or product that does not properly validate data boundaries when performing operations in memory, and can be...