Total
404454 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-47261 | 1 Dokmee | 1 Enterprise Content Management | 2026-06-17 | N/A | 9.8 CRITICAL |
| Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled. | |||||
| CVE-2023-47260 | 1 Redmine | 1 Redmine | 2026-06-17 | N/A | 6.1 MEDIUM |
| Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails. | |||||
| CVE-2023-47259 | 1 Redmine | 1 Redmine | 2026-06-17 | N/A | 6.1 MEDIUM |
| Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. | |||||
| CVE-2023-47258 | 1 Redmine | 1 Redmine | 2026-06-17 | N/A | 6.1 MEDIUM |
| Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. | |||||
| CVE-2023-47257 | 1 Connectwise | 2 Automate, Screenconnect | 2026-06-17 | N/A | 8.1 HIGH |
| ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages. | |||||
| CVE-2023-47256 | 1 Connectwise | 2 Automate, Screenconnect | 2026-06-17 | N/A | 5.5 MEDIUM |
| ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings | |||||
| CVE-2023-47254 | 1 Draytek | 2 Vigor167, Vigor167 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface. | |||||
| CVE-2023-47253 | 1 Qualitor | 1 Qualitor | 2026-06-17 | N/A | 9.8 CRITICAL |
| Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter. | |||||
| CVE-2023-47252 | 1 Insyde | 1 Kernel | 2026-06-17 | N/A | 6.3 MEDIUM |
| An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds access in the SMM communication buffer, leading to tampering. The PNP-related SMI sub-functions do not verify data size before getting it from the communication buffer, which could lead to possible circumstances where the data immediately following the command buffer could be destroyed with a fixed value. This is fixed in kernel 5.2 v05.28.45, kernel 5.3 v05.37.45, kernel 5.4 v05.45.45, kernel 5.5 v05.53.45, and kernel 5.6 v05.60.45. | |||||
| CVE-2023-47251 | 1 M-privacy | 2 Mprivacy-tools, Tightgatevnc | 2026-06-17 | N/A | 6.5 MEDIUM |
| In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers (with access to a VNC session) to automatically transfer malicious PDF documents by moving them into the .spool directory, and then sending a signal to the VNC service, which automatically transfers them to the connected VNC client's filesystem. | |||||
| CVE-2023-47250 | 1 M-privacy | 3 Mprivacy-tools, Rsbac-policy-tgpro, Tightgatevnc | 2026-06-17 | N/A | 8.8 HIGH |
| In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop, including the ability to inject keystrokes and perform a keylogging attack. | |||||
| CVE-2023-47249 | 1 Color | 1 Demoiccmax | 2026-06-17 | N/A | 6.5 MEDIUM |
| In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-of-bounds read. | |||||
| CVE-2023-47248 | 1 Apache | 1 Pyarrow | 2026-06-17 | N/A | 9.8 CRITICAL |
| Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions. | |||||
| CVE-2023-47247 | 1 Sysaid | 1 Sysaid | 2026-06-17 | N/A | 4.3 MEDIUM |
| In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102. | |||||
| CVE-2023-47245 | 1 Marcomilesi | 1 Anac Xml Viewer | 2026-06-17 | N/A | 5.9 MEDIUM |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Viewer plugin <= 1.7 versions. | |||||
| CVE-2023-47244 | 1 Omnisend | 1 Email Marketing For Woocommerce | 2026-06-17 | N/A | 5.3 MEDIUM |
| Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8. | |||||
| CVE-2023-47243 | 1 Codemshop | 1 Mshop My Site | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-Site Request Forgery (CSRF) vulnerability in CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE.This issue affects 코드엠샵 마이사이트 – MSHOP MY SITE: from n/a through 1.1.6. | |||||
| CVE-2023-47242 | 1 Marcomilesi | 1 Anac Xml Bandi Di Gara | 2026-06-17 | N/A | 6.5 MEDIUM |
| Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions. | |||||
| CVE-2023-47241 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2. | |||||
| CVE-2023-47240 | 1 Codeboxr | 1 Cbx Map | 2026-06-17 | N/A | 6.5 MEDIUM |
| Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin <= 1.1.11 versions. | |||||