Total
423897 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-28879 | 2 Artifex, Debian | 2 Ghostscript, Debian Linux | 2026-06-17 | N/A | 9.8 CRITICAL |
| In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. | |||||
| CVE-2023-28877 | 1 Vtex | 1 Apps-graphql | 2026-06-17 | N/A | 7.5 HIGH |
| The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by this issue.) | |||||
| CVE-2023-28876 | 1 Afian | 1 Filerun | 2026-06-17 | N/A | 4.3 MEDIUM |
| A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users. | |||||
| CVE-2023-28875 | 1 Afian | 1 Filerun | 2026-06-17 | N/A | 5.4 MEDIUM |
| A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link. | |||||
| CVE-2023-28874 | 1 Seafile | 1 Seafile | 2026-06-17 | N/A | 6.1 MEDIUM |
| The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. | |||||
| CVE-2023-28873 | 1 Seafile | 1 Seafile | 2026-06-17 | N/A | 5.4 MEDIUM |
| An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. | |||||
| CVE-2023-28872 | 1 Ncp-e | 1 Secure Enterprise Client | 2026-06-17 | N/A | 8.8 HIGH |
| Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location. | |||||
| CVE-2023-28871 | 1 Ncp-e | 1 Secure Enterprise Client | 2026-06-17 | N/A | 4.3 MEDIUM |
| Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link. | |||||
| CVE-2023-28870 | 1 Ncp-e | 1 Secure Enterprise Client | 2026-06-17 | N/A | 6.5 MEDIUM |
| Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts. | |||||
| CVE-2023-28869 | 1 Ncp-e | 1 Secure Enterprise Client | 2026-06-17 | N/A | 6.5 MEDIUM |
| Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symbolic link. | |||||
| CVE-2023-28868 | 1 Ncp-e | 1 Secure Enterprise Client | 2026-06-17 | N/A | 8.1 HIGH |
| Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link. | |||||
| CVE-2023-28867 | 1 Graphql-java | 1 Graphql-java | 2026-06-17 | N/A | 7.5 HIGH |
| In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135. | |||||
| CVE-2023-28866 | 1 Linux | 1 Linux Kernel | 2026-06-17 | N/A | 5.3 MEDIUM |
| In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. | |||||
| CVE-2023-28865 | 1 Dieboldnixdorf | 1 Vynamic Security Suite | 2026-06-17 | N/A | 6.6 MEDIUM |
| Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected hash sum) during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk. | |||||
| CVE-2023-28864 | 1 Progress | 1 Chef Infra Server | 2026-06-17 | N/A | 5.5 MEDIUM |
| Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command. | |||||
| CVE-2023-28863 | 1 Ami | 1 Megarac Sp-x | 2026-06-17 | N/A | 9.1 CRITICAL |
| AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity. | |||||
| CVE-2023-28862 | 1 Lemonldap-ng | 1 Lemonldap\ | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session. | |||||
| CVE-2023-28859 | 1 Redis | 1 Redis-py | 2026-06-17 | N/A | 6.5 MEDIUM |
| redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request. (This could, for example, happen for a non-pipeline operation.) NOTE: the solutions for CVE-2023-28859 address data leakage across AsyncIO connections in general. | |||||
| CVE-2023-28858 | 1 Redis | 1 Redis-py | 2026-06-17 | N/A | 3.7 LOW |
| redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to the client of an unrelated request in an off-by-one manner. NOTE: this CVE Record was initially created in response to reports about ChatGPT, and 4.3.6, 4.4.3, and 4.5.3 were released (changing the behavior for pipeline operations); however, please see CVE-2023-28859 about addressing data leakage across AsyncIO connections in general. | |||||
| CVE-2023-28857 | 1 Apereo | 1 Central Authentication Service | 2026-06-17 | N/A | 4.0 MEDIUM |
| Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points” extension of the certificate, which are taken from the certificate itself and therefore can be controlled by a malicious user. If the CAS server is configured to use an LDAP server for x509 authentication with a password, for example by setting a “cas.authn.x509.ldap.ldap-url” and “cas.authn.x509.ldap.bind-credential” properties, X509CredentialsAuthenticationHandler fetches revocation URLs from the certificate, which can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially configured LDAP server, which can lead to a password leak. An unauthenticated user can leak the password used to LDAP connection configured on server. This issue has been addressed in version 6.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||