Total
420880 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-37625 | 1 Netbox | 1 Netbox | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates. | |||||
| CVE-2023-37624 | 1 Netdisco | 1 Netdisco | 2026-06-17 | N/A | 6.1 MEDIUM |
| Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. | |||||
| CVE-2023-37623 | 1 Netdisco | 1 Netdisco | 2026-06-17 | N/A | 4.8 MEDIUM |
| Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm. | |||||
| CVE-2023-37613 | 1 Assemblysoftware | 1 Trialworks | 2026-06-17 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the asset src parameter. | |||||
| CVE-2023-37611 | 1 Neos | 1 Neos Cms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file to the neos/management/media component. | |||||
| CVE-2023-37605 | 1 Baramundi | 1 Enterprise Mobility Management | 2026-06-17 | N/A | 5.5 MEDIUM |
| Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of service via a crafted request to the password parameter. | |||||
| CVE-2023-37602 | 1 Alkacon | 1 Opencms | 2026-06-17 | N/A | 6.1 MEDIUM |
| An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file. | |||||
| CVE-2023-37601 | 1 Mobisystems | 1 Office Suite | 2026-06-17 | N/A | 7.5 HIGH |
| Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts. | |||||
| CVE-2023-37600 | 1 Mobisystems | 1 Office Suite | 2026-06-17 | N/A | 6.1 MEDIUM |
| Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /api?path=profile. | |||||
| CVE-2023-37599 | 1 Issabel | 1 Pbx | 2026-06-17 | N/A | 7.5 HIGH |
| An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory | |||||
| CVE-2023-37598 | 1 Issabel | 1 Pbx | 2026-06-17 | N/A | 4.5 MEDIUM |
| A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function. | |||||
| CVE-2023-37597 | 1 Issabel | 1 Pbx | 2026-06-17 | N/A | 8.1 HIGH |
| Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function. | |||||
| CVE-2023-37596 | 1 Issabel | 1 Pbx | 2026-06-17 | N/A | 8.1 HIGH |
| Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function. | |||||
| CVE-2023-37582 | 1 Apache | 1 Rocketmq | 2026-06-17 | N/A | 9.8 CRITICAL |
| The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks. | |||||
| CVE-2023-37581 | 1 Apache | 1 Roller | 2026-06-17 | N/A | 5.4 MEDIUM |
| Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature. | |||||
| CVE-2023-37580 | 1 Synacor | 1 Zimbra Collaboration Suite | 2026-06-17 | N/A | 6.1 MEDIUM |
| Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. | |||||
| CVE-2023-37579 | 1 Apache | 1 Pulsar | 2026-06-17 | N/A | 8.2 HIGH |
| Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability. The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.4. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.1. 3.0 Pulsar Function Worker users are unaffected. Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions. | |||||
| CVE-2023-37578 | 1 Tonybybell | 1 Gtkwave | 2026-06-17 | N/A | 7.8 HIGH |
| Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility. | |||||
| CVE-2023-37577 | 1 Tonybybell | 1 Gtkwave | 2026-06-17 | N/A | 7.8 HIGH |
| Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt2 conversion utility. | |||||
| CVE-2023-37576 | 1 Tonybybell | 1 Gtkwave | 2026-06-17 | N/A | 7.8 HIGH |
| Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility. | |||||