Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by miro

    CVE-2024-23746 (GCVE-0-2024-23746)

    Vulnerability from cvelistv5 – Published: 2024-02-02 00:00 – Updated: 2025-06-04 15:23
    VLAI
    Summary
    Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • n/a
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:13:07.294Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://miro.com/about/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/louiselalanne/CVE-2024-23746"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.electronjs.org/blog/statement-run-as-node-cves"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-23746",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-09T18:05:01.196354Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-04T15:23:03.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-08T14:33:17.410Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection"
        },
        {
          "url": "https://miro.com/about/"
        },
        {
          "url": "https://github.com/louiselalanne/CVE-2024-23746"
        },
        {
          "url": "https://www.electronjs.org/blog/statement-run-as-node-cves"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-23746",
    "datePublished": "2024-02-02T00:00:00.000Z",
    "dateReserved": "2024-01-21T00:00:00.000Z",
    "dateUpdated": "2025-06-04T15:23:03.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2008-0984 (GCVE-0-2008-0984)

    Vulnerability from cvelistv5 – Published: 2008-02-26 19:00 – Updated: 2024-08-07 08:01
    VLAI
    Summary
    The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    URL Tags
    http://secunia.com/advisories/29122 third-party-advisoryx_refsource_SECUNIA
    http://secunia.com/advisories/29284 third-party-advisoryx_refsource_SECUNIA
    http://www.debian.org/security/2008/dsa-1543 vendor-advisoryx_refsource_DEBIAN
    http://secunia.com/advisories/29153 third-party-advisoryx_refsource_SECUNIA
    http://www.videolan.org/security/sa0802.html x_refsource_CONFIRM
    http://www.securityfocus.com/bid/28007 vdb-entryx_refsource_BID
    http://www.securitytracker.com/id?1019510 vdb-entryx_refsource_SECTRACK
    http://lists.grok.org.uk/pipermail/full-disclosur… mailing-listx_refsource_FULLDISC
    http://www.securityfocus.com/archive/1/488841/100… mailing-listx_refsource_BUGTRAQ
    http://secunia.com/advisories/29766 third-party-advisoryx_refsource_SECUNIA
    http://www.vupen.com/english/advisories/2008/0682 vdb-entryx_refsource_VUPEN
    http://www.coresecurity.com/?action=item&id=2147 x_refsource_MISC
    http://www.gentoo.org/security/en/glsa/glsa-20080… vendor-advisoryx_refsource_GENTOO
    Date Public
    2008-02-26 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:01:40.120Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "29122",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29122"
          },
          {
            "name": "29284",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29284"
          },
          {
            "name": "DSA-1543",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1543"
          },
          {
            "name": "29153",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29153"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.videolan.org/security/sa0802.html"
          },
          {
            "name": "28007",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28007"
          },
          {
            "name": "1019510",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019510"
          },
          {
            "name": "20080227 CORE-2008-0130: VLC media player chunk context validation error",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060481.html"
          },
          {
            "name": "20080227 CORE-2008-0130: VLC media player chunk context validation error",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/488841/100/0/threaded"
          },
          {
            "name": "29766",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29766"
          },
          {
            "name": "ADV-2008-0682",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0682"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.coresecurity.com/?action=item\u0026id=2147"
          },
          {
            "name": "GLSA-200803-13",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-02-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "29122",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29122"
        },
        {
          "name": "29284",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29284"
        },
        {
          "name": "DSA-1543",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1543"
        },
        {
          "name": "29153",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29153"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.videolan.org/security/sa0802.html"
        },
        {
          "name": "28007",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28007"
        },
        {
          "name": "1019510",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019510"
        },
        {
          "name": "20080227 CORE-2008-0130: VLC media player chunk context validation error",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060481.html"
        },
        {
          "name": "20080227 CORE-2008-0130: VLC media player chunk context validation error",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/488841/100/0/threaded"
        },
        {
          "name": "29766",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29766"
        },
        {
          "name": "ADV-2008-0682",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0682"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.coresecurity.com/?action=item\u0026id=2147"
        },
        {
          "name": "GLSA-200803-13",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-0984",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrary memory and execute arbitrary code via a malformed MP4 file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "29122",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29122"
            },
            {
              "name": "29284",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29284"
            },
            {
              "name": "DSA-1543",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1543"
            },
            {
              "name": "29153",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29153"
            },
            {
              "name": "http://www.videolan.org/security/sa0802.html",
              "refsource": "CONFIRM",
              "url": "http://www.videolan.org/security/sa0802.html"
            },
            {
              "name": "28007",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28007"
            },
            {
              "name": "1019510",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1019510"
            },
            {
              "name": "20080227 CORE-2008-0130: VLC media player chunk context validation error",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060481.html"
            },
            {
              "name": "20080227 CORE-2008-0130: VLC media player chunk context validation error",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/488841/100/0/threaded"
            },
            {
              "name": "29766",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29766"
            },
            {
              "name": "ADV-2008-0682",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/0682"
            },
            {
              "name": "http://www.coresecurity.com/?action=item\u0026id=2147",
              "refsource": "MISC",
              "url": "http://www.coresecurity.com/?action=item\u0026id=2147"
            },
            {
              "name": "GLSA-200803-13",
              "refsource": "GENTOO",
              "url": "http://www.gentoo.org/security/en/glsa/glsa-200803-13.xml"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-0984",
    "datePublished": "2008-02-26T19:00:00.000Z",
    "dateReserved": "2008-02-26T00:00:00.000Z",
    "dateUpdated": "2024-08-07T08:01:40.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}