First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2023-31890

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/glazedlists/glazedlists/issues/709Exploit, Issue Tracking, Third Party Advisory
https://github.com/glazedlists/glazedlists/issues/709Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-318937.5Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.CVE-2023-31904.6Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-319029.8RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).CVE-2023-319039.8GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.CVE-2023-319047.5savysoda Wifi HD Wireless Disk Drive 11 is vulnerable to Local File Inclusion.CVE-2023-319067.8Jerryscript 3.0.0(commit 1a2c047) was discovered to contain a heap-buffer-overflow via the component lexer_compare_identifier_to_chars at /j CVE-2023-319077.8Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via the component scanner_literal_is_created at /jerry-core/parser/js/js-CVE-2023-319087.8Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component ecma_builtin_typedarray_prototype_sort.CVE-2023-31915.4Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-319107.8Jerryscript 3.0 (commit 05dbbd1) was discovered to contain a heap-buffer-overflow via the component parser_parse_function_statement at /jerr CVE-2023-319135.5Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js CVE-2023-319145.5Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc.