Total
403909 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-49339 | 1 Ellucian | 1 Banner | 2026-06-17 | N/A | 6.5 MEDIUM |
| Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retrieveData endpoint. | |||||
| CVE-2023-49338 | 1 Couchbase | 1 Couchbase Server | 2026-06-17 | N/A | 7.5 HIGH |
| Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost. | |||||
| CVE-2023-49337 | 1 Concretecms | 1 Concrete Cms | 2026-06-17 | N/A | 2.4 LOW |
| Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.) | |||||
| CVE-2023-49335 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details. | |||||
| CVE-2023-49334 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report. | |||||
| CVE-2023-49333 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature. | |||||
| CVE-2023-49332 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares. | |||||
| CVE-2023-49331 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option. | |||||
| CVE-2023-49330 | 1 Zohocorp | 1 Manageengine Adaudit Plus | 2026-06-17 | N/A | 8.3 HIGH |
| Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data. | |||||
| CVE-2023-49329 | 1 Anomali | 1 Match | 2026-06-17 | N/A | 7.2 HIGH |
| Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlying operating system. The fixed versions are 4.4.5, 4.5.4, and 4.6.2. The earliest affected version is 4.3. | |||||
| CVE-2023-49328 | 2 Linux, Wolterskluwer | 2 Linux Kernel, B.point | 2026-06-17 | N/A | 7.2 HIGH |
| On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module. | |||||
| CVE-2023-49322 | 4 Apple, F-secure, Linux and 1 more | 10 Macos, Atlant, Client Security and 7 more | 2026-06-17 | N/A | 7.5 HIGH |
| Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, WithSecure Linux Security 64 12.0, WithSecure Linux Protection 12.0, and WithSecure Atlant 1.0.35-1. | |||||
| CVE-2023-49321 | 4 Apple, F-secure, Linux and 1 more | 10 Macos, Atlant, Client Security and 7 more | 2026-06-17 | N/A | 5.3 MEDIUM |
| Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, WithSecure Linux Security 64 12.0, WithSecure Linux Protection 12.0, and WithSecure Atlant 1.0.35-1. | |||||
| CVE-2023-49316 | 1 Phpseclib | 1 Phpseclib | 2026-06-17 | N/A | 7.5 HIGH |
| In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively large degrees can lead to a denial of service. | |||||
| CVE-2023-49314 | 2 Apple, Asana | 2 Macos, Desktop | 2026-06-17 | N/A | 7.8 HIGH |
| Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack. | |||||
| CVE-2023-49313 | 1 Horsicq | 1 Xmachoviewer | 2026-06-17 | N/A | 9.8 CRITICAL |
| A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data. | |||||
| CVE-2023-49312 | 1 Precisionbridge | 1 Precision Bridge | 2026-06-17 | N/A | 9.1 CRITICAL |
| Precision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity violation in which the same license key is used on multiple systems, via vectors involving a Process Hacker memory dump, error message inspection, and modification of a MAC address. | |||||
| CVE-2023-49299 | 1 Apache | 1 Dolphinscheduler | 2026-06-17 | N/A | 8.8 HIGH |
| Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue. | |||||
| CVE-2023-49298 | 2 Freebsd, Openzfs | 2 Freebsd, Openzfs | 2026-06-17 | N/A | 7.5 HIGH |
| OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions. | |||||
| CVE-2023-49297 | 1 Iterative | 1 Pydrive2 | 2026-06-17 | N/A | 3.3 LOW |
| PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||