https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:27:03 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cnvd-2024-39156 cnvd-2024-39156 https://cve.radiocsirt.org/vuln/cnvd-2024-39156 https://cve.radiocsirt.org/vuln/euvd-2026-216578 EUVD-2026-216578 https://cve.radiocsirt.org/vuln/euvd-2026-216578 https://cve.radiocsirt.org/vuln/fkie_cve-2023-35701 <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache Hive.</p> <p>The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability.</p> <p>The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.</p> <p>Users are recommended to upgrade to version 4.0.0, which fixes the issue.</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache Hive.</p> <p>The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability.</p> <p>The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.</p> <p>Users are recommended to upgrade to version 4.0.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-35701 https://cve.radiocsirt.org/vuln/ghsa-vpw3-3prf-3974 <p><strong>Affected:</strong> Maven: org.apache.hive:hive-jdbc</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache Hive.</p> <p>The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability.</p> <p>The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.</p> <p>Users are recommended to upgrade to version 4.0.0, which fixes the issue.</p> <p><strong>Affected:</strong> Maven: org.apache.hive:hive-jdbc</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache Hive.</p> <p>The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability.</p> <p>The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.</p> <p>Users are recommended to upgrade to version 4.0.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-vpw3-3prf-3974 https://cve.radiocsirt.org/vuln/gsd-2023-35701 gsd-2023-35701 https://cve.radiocsirt.org/vuln/gsd-2023-35701