https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:31:30 +0000 https://cve.radiocsirt.org/vuln/cve-2023-35701 <p><strong>Affected:</strong> Apache Software Foundation Apache Hive, apache hive</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache Hive.</p> <p>The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability.</p> <p>The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.</p> <p>Users are recommended to upgrade to version 4.0.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Hive, apache hive</p> <p>Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache Hive.</p> <p>The vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability.</p> <p>The attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.</p> <p>Users are recommended to upgrade to version 4.0.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2023-35701