Total
420765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-38337 | 1 Rswag Project | 1 Rswag | 2026-06-17 | N/A | 7.5 HIGH |
| rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project. | |||||
| CVE-2023-38336 | 1 Netkit | 1 Netkit | 2026-06-17 | N/A | 9.8 CRITICAL |
| netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778. | |||||
| CVE-2023-38335 | 1 Omnis | 1 Studio | 2026-06-17 | N/A | 5.3 MEDIUM |
| Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation". | |||||
| CVE-2023-38334 | 1 Omnis | 1 Studio | 2026-06-17 | N/A | 6.5 MEDIUM |
| Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation." | |||||
| CVE-2023-38333 | 1 Zohocorp | 1 Manageengine Applications Manager | 2026-06-17 | N/A | 6.1 MEDIUM |
| Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. | |||||
| CVE-2023-38332 | 1 Zohocorp | 1 Manageengine Admanager Plus | 2026-06-17 | N/A | 6.5 MEDIUM |
| Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclosure. | |||||
| CVE-2023-38331 | 1 Zohocorp | 1 Manageengine Supportcenter Plus | 2026-06-17 | N/A | 5.4 MEDIUM |
| Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module. | |||||
| CVE-2023-38330 | 1 Oxid-esales | 1 Eshop | 2026-06-17 | N/A | 5.3 MEDIUM |
| OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. An attacker can upload a file with a modified header to create a HTTP Response Splitting attack. | |||||
| CVE-2023-38329 | 1 Egroupware | 1 Egroupware | 2026-06-17 | N/A | 6.1 MEDIUM |
| An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization. | |||||
| CVE-2023-38328 | 1 Egroupware | 1 Egroupware | 2026-06-17 | N/A | 4.9 MEDIUM |
| An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password. | |||||
| CVE-2023-38327 | 1 Egroupware | 1 Egroupware | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response. | |||||
| CVE-2023-38325 | 1 Cryptography.io | 1 Cryptography | 2026-06-17 | N/A | 7.5 HIGH |
| The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options. | |||||
| CVE-2023-38324 | 1 Opennds | 1 Captive Portal | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. | |||||
| CVE-2023-38323 | 1 Opennds | 1 Opennds | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. | |||||
| CVE-2023-38322 | 1 Opennds | 1 Captive Portal | 2026-06-17 | N/A | 7.5 HIGH |
| An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated, and can be triggered only when the BinAuth option is set. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. | |||||
| CVE-2023-38321 | 1 Sierrawireless | 6 Aleos, Lx40, Lx60 and 3 more | 2026-06-17 | N/A | 7.5 HIGH |
| OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token. | |||||
| CVE-2023-38320 | 1 Opennds | 1 Captive Portal | 2026-06-17 | N/A | 7.5 HIGH |
| An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). This problem was fixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on 28. August 2023 by updating OpenNDS to version 10.1.3. | |||||
| CVE-2023-38319 | 1 Opennds | 1 Opennds | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. | |||||
| CVE-2023-38318 | 1 Opennds | 1 Opennds | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. | |||||
| CVE-2023-38317 | 1 Opennds | 1 Opennds | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the network interface name entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands. | |||||