Total
424539 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-24513 | 5 Amazon, Arista, Equinix and 2 more | 6 Aws Marketplace, Cloudeos, Dca-200-veos and 3 more | 2026-06-17 | N/A | 6.5 MEDIUM |
| On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic. | |||||
| CVE-2023-24512 | 1 Arista | 110 32qd, 48ehs, 48lbas and 107 more | 2026-06-17 | N/A | 8.8 HIGH |
| On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision | |||||
| CVE-2023-24511 | 1 Arista | 111 7010t, 7010t-48, 7010tx-48 and 108 more | 2026-06-17 | N/A | 5.3 MEDIUM |
| On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system. | |||||
| CVE-2023-24510 | 1 Arista | 97 7010t, 7010t-48, 7010tx-48 and 94 more | 2026-06-17 | N/A | 7.5 HIGH |
| On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart. | |||||
| CVE-2023-24509 | 1 Arista | 21 704x3, 7304x, 7304x3 and 18 more | 2026-06-17 | N/A | 9.3 CRITICAL |
| On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability. | |||||
| CVE-2023-24508 | 1 Baicells | 6 Nova227, Nova233, Nova243 and 3 more | 2026-06-17 | N/A | 8.1 HIGH |
| Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB and Nova 246 devices with firmware through RTS/RTD 3.6.6 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods below have been tested and validated by a 3rd party analyst and has been confirmed exploitable special thanks to Rustam Amin for providing the steps to reproduce. | |||||
| CVE-2023-24507 | 1 Agilepoint | 1 Agilepoint Nx | 2026-06-17 | N/A | 8.8 HIGH |
| AgilePoint NX v8.0 SU2.2 & SU2.3 – Insecure File Upload - Vulnerability allows insecure file upload, by an unspecified request. | |||||
| CVE-2023-24506 | 1 Milesight | 2 Ncr\/camera, Ncr\/camera Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request. | |||||
| CVE-2023-24505 | 1 Milesight | 2 Ncr\/camera, Ncr\/camera Firmware | 2026-06-17 | N/A | 5.3 MEDIUM |
| Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request. | |||||
| CVE-2023-24504 | 1 Electra-air | 2 Central Ac Unit, Central Ac Unit Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update server. | |||||
| CVE-2023-24503 | 1 Electra-air | 1 Smart Kit For Split Ac | 2026-06-17 | N/A | 7.5 HIGH |
| Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. | |||||
| CVE-2023-24502 | 1 Electra-air | 2 Central Ac Unit, Central Ac Unit Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| Electra Central AC unit – The unit opens an AP with an easily calculated password. | |||||
| CVE-2023-24501 | 1 Electra-air | 2 Central Ac Unit, Central Ac Unit Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit. | |||||
| CVE-2023-24500 | 1 Electra-air | 2 Central Ac Unit, Central Ac Unit Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW. | |||||
| CVE-2023-24499 | 1 Butterfly-button Project | 1 Butterfly-button | 2026-06-17 | N/A | 4.3 MEDIUM |
| Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spouse knowing about its use. | |||||
| CVE-2023-24498 | 1 Netgear | 2 Prosafe Fs726tp, Prosafe Fs726tp Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text. | |||||
| CVE-2023-24497 | 1 O | 1 Milesight | 2026-06-17 | N/A | 4.7 MEDIUM |
| Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the remote_subnet field of the database | |||||
| CVE-2023-24496 | 1 Milesight | 1 Milesightvpn | 2026-06-17 | N/A | 4.7 MEDIUM |
| Cross-site scripting (xss) vulnerabilities exist in the requestHandlers.js detail_device functionality of Milesight VPN v2.0.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger these vulnerabilities.This XSS is exploited through the name field of the database. | |||||
| CVE-2023-24495 | 1 Tenable | 1 Tenable.sc | 2026-06-17 | N/A | 6.5 MEDIUM |
| A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly. | |||||
| CVE-2023-24494 | 1 Tenable | 1 Tenable.sc | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session. | |||||