Total
421097 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-33268 | 1 Dts | 1 Monitoring | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in DTS Monitoring 3.57.0. The parameter port within the SSL Certificate check function is vulnerable to OS command injection (blind). | |||||
| CVE-2023-33265 | 1 Hazelcast | 2 Hazelcast, Imdg | 2026-06-17 | N/A | 8.8 HIGH |
| In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted. | |||||
| CVE-2023-33264 | 1 Hazelcast | 1 Hazelcast | 2026-06-17 | N/A | 4.3 MEDIUM |
| In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets. | |||||
| CVE-2023-33263 | 1 Wftpd Project | 1 Wftpd | 2026-06-17 | N/A | 7.5 HIGH |
| In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the WFTPD directory. NOTE: this is a product from 2006. | |||||
| CVE-2023-33257 | 1 Verint | 1 Engagement Management | 2026-06-17 | N/A | 5.4 MEDIUM |
| Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat. | |||||
| CVE-2023-33255 | 1 Uthscsa | 1 Papaya Viewer | 2026-06-17 | N/A | 6.1 MEDIUM |
| An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application. | |||||
| CVE-2023-33254 | 1 Quest | 1 Kace Systems Deployment Appliance | 2026-06-17 | N/A | 6.5 MEDIUM |
| There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain. To exploit this, an authenticated attacker edits the user-authentication settings to specify an attacker-controlled LDAP server, clicks the Test Settings button, and captures the cleartext credentials. | |||||
| CVE-2023-33253 | 1 Agilebio | 1 Labcollector | 2026-06-17 | N/A | 8.8 HIGH |
| LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file (such as shell.jpg.php.shell) being sent. | |||||
| CVE-2023-33252 | 1 0kims | 1 Snarkjs | 2026-06-17 | N/A | 7.5 HIGH |
| iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus. | |||||
| CVE-2023-33251 | 2 Lightbend, Linux | 2 Akka Http, Linux Kernel | 2026-06-17 | N/A | 4.7 MEDIUM |
| When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has too weak permissions: it is readable by other users on Linux or UNIX, a similar issue to CVE-2022-41946. | |||||
| CVE-2023-33250 | 2 Linux, Netapp | 9 Linux Kernel, H300s, H300s Firmware and 6 more | 2026-06-17 | N/A | 4.4 MEDIUM |
| The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c. | |||||
| CVE-2023-33248 | 1 Amazon | 2 Alexa, Echo Dot | 2026-06-17 | N/A | 7.6 HIGH |
| Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful. | |||||
| CVE-2023-33247 | 1 Talend | 1 Data Catalog | 2026-06-17 | N/A | 7.5 HIGH |
| Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.) | |||||
| CVE-2023-33246 | 1 Apache | 1 Rocketmq | 2026-06-17 | N/A | 9.8 CRITICAL |
| For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x . | |||||
| CVE-2023-33245 | 1 Minecraft | 1 Minecraft | 2026-06-17 | N/A | 8.8 HIGH |
| Minecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world data that contains a symlink. | |||||
| CVE-2023-33244 | 1 Obsidian | 1 Obsidian | 2026-06-17 | N/A | 8.2 HIGH |
| Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page. | |||||
| CVE-2023-33243 | 1 Starface | 1 Starface | 2026-06-17 | N/A | 8.1 HIGH |
| RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash. | |||||
| CVE-2023-33242 | 1 Lindell17 Project | 1 Lindell17 | 2026-06-17 | N/A | 9.6 CRITICAL |
| Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed signature. | |||||
| CVE-2023-33241 | 2 Gg18 Project, Gg20 Project | 2 Gg18, Gg20 | 2026-06-17 | N/A | 9.6 CRITICAL |
| Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signatures or more fully exfiltrate the other parties' private key shares. | |||||
| CVE-2023-33240 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2026-06-17 | N/A | 7.8 HIGH |
| Foxit PDF Reader (12.1.1.15289 and earlier) and Foxit PDF Editor (12.1.1.15289 and all previous 12.x versions, 11.2.5.53785 and all previous 11.x versions, and 10.1.11.37866 and earlier) on Windows allows Local Privilege Escalation when installed to a non-default directory because unprivileged users have access to an executable file of a system service. This is fixed in 12.1.2. | |||||