Total
664 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-40762 | 1 Phpjabbers | 1 Fundraising Script | 2026-06-17 | N/A | 9.8 CRITICAL |
| User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2023-40761 | 1 Phpjabbers | 1 Yacht Listing Script | 2026-06-17 | N/A | 9.8 CRITICAL |
| User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2023-40760 | 1 Phpjabbers | 1 Hotel Booking System | 2026-06-17 | N/A | 9.8 CRITICAL |
| User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2023-40759 | 1 Phpjabbers | 1 Restaurant Booking Script | 2026-06-17 | N/A | 9.8 CRITICAL |
| User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2023-40758 | 1 Phpjabbers | 1 Document Creator | 2026-06-17 | N/A | 9.8 CRITICAL |
| User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2023-40757 | 1 Phpjabbers | 1 Food Delivery Script | 2026-06-17 | N/A | 9.8 CRITICAL |
| User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2023-40725 | 1 Siemens | 1 Qms Automotive | 2026-06-17 | N/A | 4.0 MEDIUM |
| A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames. | |||||
| CVE-2023-40457 | 2026-06-17 | N/A | N/A | ||
| The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service (BGP session reset) because of BGP attribute error mishandling (for attribute 21 and 25). NOTE: the vendor disputes this because it is "evaluating support for RFC 7606 as a future feature" and believes that "customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks." | |||||
| CVE-2023-40171 | 1 Netflix | 1 Dispatch | 2026-06-17 | N/A | 9.1 CRITICAL |
| Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for authentication may be impacted, allowing for any account to be taken over within their own instance. This could be done by using the secret to sign attacker crafted JWTs. If you think that you may be impacted, we strongly suggest you to rotate the secret stored in the `DISPATCH_JWT_SECRET` envvar in the `.env` file. This issue has been addressed in commit `b1942a4319` which has been included in the `20230817` release. users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-3362 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 5.3 MEDIUM |
| An information disclosure issue in GitLab CE/EE affecting all versions from 16.0 prior to 16.0.6, and version 16.1.0 allows unauthenticated actors to access the import error information if a project was imported from GitHub. | |||||
| CVE-2023-39264 | 1 Apache | 1 Superset | 2026-06-17 | N/A | 4.3 MEDIUM |
| By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0. | |||||
| CVE-2023-38716 | 1 Ibm | 1 Cloud Pak System | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system. | |||||
| CVE-2023-38714 | 1 Ibm | 1 Cloud Pak System | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system. | |||||
| CVE-2023-38713 | 1 Ibm | 1 Cloud Pak System | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system. | |||||
| CVE-2023-38281 | 1 Ibm | 2 Cloud Pak System, Os Image For Red Hat Linux Systems | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. | |||||
| CVE-2023-38017 | 1 Ibm | 2 Cloud Pak System, Os Image For Red Hat Linux Systems | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2023-38010 | 1 Ibm | 2 Cloud Pak System, Os Image For Red Hat Linux Systems | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system. | |||||
| CVE-2023-37489 | 1 Sap | 1 Businessobjects Business Intelligence | 2026-06-17 | N/A | 5.3 MEDIUM |
| Due to the lack of validation, SAP BusinessObjects Business Intelligence Platform (Version Management System) - version 403, permits an unauthenticated user to read the code snippet through the UI, which leads to low impact on confidentiality and no impact on the application's availability or integrity. | |||||
| CVE-2023-37260 | 1 Thephpleague | 1 Oauth2-server | 2026-06-17 | N/A | 8.2 HIGH |
| league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string. | |||||
| CVE-2023-35124 | 1 Openautomationsoftware | 1 Oas Platform | 2026-06-17 | N/A | 3.1 LOW |
| An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of requests to trigger this vulnerability. | |||||