# CVEs published 2023-06-25 10 CVEs were published on June 25, 2023: 0 critical, 1 high. Days are UTC. - [CVE-2023-3396](https://cve.now/CVE-2023-3396.md): Campcodes Retro Cellphone Online Store index.php sql injection (CVSS 6.3, Campcodes Retro Cellphone Online Store) - [CVE-2015-20109](https://cve.now/CVE-2015-20109.md): end\_pattern (called from internal\_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to (no CVSS) - [CVE-2023-36612](https://cve.now/CVE-2023-36612.md): Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write ar (no CVSS) - [CVE-2023-36630](https://cve.now/CVE-2023-36630.md): In CloudPanel before 2.3.1, insecure file upload leads to privilege escalation and authentication bypass. (no CVSS) - [CVE-2023-36632](https://cve.now/CVE-2023-36632.md): The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exce (no CVSS) - [CVE-2023-36660](https://cve.now/CVE-2023-36660.md): The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption. (no CVSS) - [CVE-2023-36661](https://cve.now/CVE-2023-36661.md): Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (CVSS 7.5) - [CVE-2023-36663](https://cve.now/CVE-2023-36663.md): it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the (no CVSS) - [CVE-2023-36664](https://cve.now/CVE-2023-36664.md): Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix) (no CVSS) - [CVE-2023-36666](https://cve.now/CVE-2023-36666.md): INEX IXP-Manager before 6.3.1 allows XSS. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-06-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.