Total
407319 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-49234 | 2026-06-17 | N/A | 6.3 MEDIUM | ||
| An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server. | |||||
| CVE-2023-49233 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of configured credentials and potentially elevate their privileges to administrator level. | |||||
| CVE-2023-49232 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users. | |||||
| CVE-2023-49231 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token. | |||||
| CVE-2023-49230 | 1 Peplink | 2 Balance Two, Balance Two Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication. | |||||
| CVE-2023-49229 | 1 Peplink | 2 Balance Two, Balance Two Firmware | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration. | |||||
| CVE-2023-49228 | 1 Peplink | 2 Balance Two, Balance Two Firmware | 2026-06-17 | N/A | 6.4 MEDIUM |
| An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root. | |||||
| CVE-2023-49226 | 1 Peplink | 2 Balance Two, Balance Two Firmware | 2026-06-17 | N/A | 7.2 HIGH |
| An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root. | |||||
| CVE-2023-49225 | 2 Commscope, Ruckuswireless | 74 Ruckus Smartzone, C110, C110 Firmware and 71 more | 2026-06-17 | N/A | 6.1 MEDIUM |
| A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section. | |||||
| CVE-2023-49224 | 2026-06-17 | N/A | 8.0 HIGH | ||
| Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root privileges. | |||||
| CVE-2023-49223 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obtain sensitive information. | |||||
| CVE-2023-49222 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privileges. | |||||
| CVE-2023-49221 | 2026-06-17 | N/A | 7.8 HIGH | ||
| Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code. | |||||
| CVE-2023-49216 | 1 Usedesk | 1 Usedesk | 2026-06-17 | N/A | 5.4 MEDIUM |
| Usedesk before 1.7.57 allows profile stored XSS. | |||||
| CVE-2023-49215 | 1 Usedesk | 1 Usedesk | 2026-06-17 | N/A | 6.1 MEDIUM |
| Usedesk before 1.7.57 allows filter reflected XSS. | |||||
| CVE-2023-49214 | 1 Usedesk | 1 Usedesk | 2026-06-17 | N/A | 9.8 CRITICAL |
| Usedesk before 1.7.57 allows chat template injection. | |||||
| CVE-2023-49213 | 1 Ironmansoftware | 1 Powershell Universal | 2026-06-17 | N/A | 8.8 HIGH |
| The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1. | |||||
| CVE-2023-49210 | 1 Node-openssl Project | 1 Node-openssl | 2026-06-17 | N/A | 9.8 CRITICAL |
| The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2023-49208 | 1 Glewlwyd Sso Server Project | 1 Glewlwyd Sso Server | 2026-06-17 | N/A | 9.8 CRITICAL |
| scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration. | |||||
| CVE-2023-49203 | 1 Technitium | 1 Dnsserver | 2026-06-17 | N/A | 7.5 HIGH |
| Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb manipulation causes accumulation of low-rate DNS queries such that there is a large-sized response in a burst of traffic. | |||||