Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 141 of 430.
- CVE-2023-54345 Frappe Framework ERPNext 13.4.0 Remote Code Execution
- CVE-2023-54344 Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console
- CVE-2023-54343 QWE DL 2.0.1 Persistent XSS Vulnerability via Path Parameter
- CVE-2023-54342 Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution
- CVE-2023-54341 Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) via file Parameter
- CVE-2023-54340 WorkOrder CMS 0.1.0 - SQL Injection
- CVE-2023-5434 Superb slideshow gallery <= 13.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
- CVE-2023-54339 Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
- CVE-2023-54338 Tftpd32_SE 4.60 - 'Tftpd32_svc' Unquoted Service Path
- CVE-2023-54337 Sysax Multi Server 6.95 - 'Password' Denial of Service (PoC)
- CVE-2023-54336 Mediconta 3.7.27 - 'servermedicontservice' Unquoted Service Path
- CVE-2023-54335 eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)
- CVE-2023-54334 Explorer32++ 1.3.5.531 - Buffer overflow
- CVE-2023-54333 Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter
- CVE-2023-54332 Jetpack 11.4 - Cross Site Scripting (XSS)
- CVE-2023-54331 Outline 1.6.0 - Unquoted Service Path
- CVE-2023-54330 Inbit Messenger 4.9.0 - Unauthenticated Remote SEH Overflow
- CVE-2023-5433 Message ticker <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
- CVE-2023-54329 Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)
- CVE-2023-54328 AimOne Video Converter 2.04 Build 103 Buffer Overflow in Registration Form
- CVE-2023-54327 Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change
- CVE-2023-54326 misc: pci_endpoint_test: Free IRQs before removing the device
- CVE-2023-54325 crypto: qat - fix out-of-bounds read
- CVE-2023-54324 dm: fix a race condition in retrieve_deps
- CVE-2023-54323 cxl/pmem: Fix nvdimm registration races
- CVE-2023-54322 arm64: set __exception_irq_entry with __irq_entry as a default
- CVE-2023-54321 driver core: fix potential null-ptr-deref in device_add()
- CVE-2023-54320 platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()
- CVE-2023-5432 Jquery news ticker <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-54319 pinctrl: at91-pio4: check return value of devm_kasprintf()
- CVE-2023-54318 net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
- CVE-2023-54317 dm flakey: don't corrupt the zero page
- CVE-2023-54316 refscale: Fix uninitalized use of wait_queue_head_t
- CVE-2023-54315 powerpc/powernv/sriov: perform null check on iov before dereferencing iov
- CVE-2023-54314 media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
- CVE-2023-54313 ovl: fix null pointer dereference in ovl_get_acl_rcu()
- CVE-2023-54312 samples/bpf: Fix buffer overflow in tcp_basertt
- CVE-2023-54311 ext4: fix deadlock when converting an inline directory in nojournal mode
- CVE-2023-54310 scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
- CVE-2023-5431 Left right image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
- CVE-2023-54309 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
- CVE-2023-54308 ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
- CVE-2023-54307 ptp_qoriq: fix memory leak in probe()
- CVE-2023-54306 net: tls: avoid hanging tasks on the tx_lock
- CVE-2023-54305 ext4: refuse to create ea block when umounted
- CVE-2023-54304 firmware: meson_sm: fix to avoid potential NULL pointer dereference
- CVE-2023-54303 bpf: Disable preemption in bpf_perf_event_output
- CVE-2023-54302 RDMA/irdma: Fix data race on CQP completion stats
- CVE-2023-54301 serial: 8250_bcm7271: fix leak in `brcmuart_probe`
- CVE-2023-54300 wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
- CVE-2023-5430 Jquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
- CVE-2023-54299 usb: typec: bus: verify partner exists in typec_altmode_attention
- CVE-2023-54298 thermal: intel: quark_dts: fix error pointer dereference
- CVE-2023-54297 btrfs: zoned: fix memory leak after finding block group with super blocks
- CVE-2023-54296 KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration
- CVE-2023-54295 mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
- CVE-2023-54294 md/raid10: fix memleak of md thread
- CVE-2023-54293 bcache: fixup btree_cache_wait list damage
- CVE-2023-54292 RDMA/irdma: Fix data race on CQP request done
- CVE-2023-54291 vduse: fix NULL pointer dereference
- CVE-2023-5429 Information Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
- CVE-2023-54289 scsi: qedf: Fix NULL dereference in error handling
- CVE-2023-54288 wifi: mac80211: fortify the spinlock against deadlock by interrupt
- CVE-2023-54287 tty: serial: imx: disable Ageing Timer interrupt request irq
- CVE-2023-54286 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
- CVE-2023-54285 iomap: Fix possible overflow condition in iomap_write_delalloc_scan
- CVE-2023-54284 media: av7110: prevent underflow in write_ts_to_decoder()
- CVE-2023-54283 bpf: Address KCSAN report on bpf_lru_list
- CVE-2023-54282 media: tuners: qt1010: replace BUG_ON with a regular error
- CVE-2023-54281 btrfs: release path before inode lookup during the ino lookup ioctl
- CVE-2023-54280 cifs: fix potential race when tree connecting ipc
- CVE-2023-5428 Image vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
- CVE-2023-54279 MIPS: fw: Allow firmware to pass a empty env
- CVE-2023-54278 s390/vmem: split pages when debug pagealloc is enabled
- CVE-2023-54277 fbdev: udlfb: Fix endpoint check
- CVE-2023-54276 nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
- CVE-2023-54275 wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
- CVE-2023-54274 RDMA/srpt: Add a check for valid 'mad_agent' pointer
- CVE-2023-54273 xfrm: Fix leak of dev tracker
- CVE-2023-54272 fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
- CVE-2023-54271 blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init
- CVE-2023-54270 media: usb: siano: Fix use after free bugs caused by do_submit_urb
- CVE-2023-5427 Mali GPU Kernel Driver allows improper GPU processing operations
- CVE-2023-54269 SUNRPC: double free xprt_ctxt while still in use
- CVE-2023-54268 debugobjects: Don't wake up kswapd from fill_pool()
- CVE-2023-54267 powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
- CVE-2023-54266 media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
- CVE-2023-54265 ipv6: Fix an uninit variable access bug in __ip6_make_skb()
- CVE-2023-54264 fs/sysv: Null check to prevent null-ptr-deref bug
- CVE-2023-54263 drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
- CVE-2023-54262 net/mlx5e: Don't clone flow post action attributes second time
- CVE-2023-54261 drm/amdkfd: Add missing gfx11 MQD manager callbacks
- CVE-2023-54260 cifs: Fix lost destroy smbd connection when MR allocate failed
- CVE-2023-5426 Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion
- CVE-2023-54259 soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow
- CVE-2023-54258 cifs: fix potential oops in cifs_oplock_break
- CVE-2023-54257 net: macb: fix a memory corruption in extended buffer descriptor mode
- CVE-2023-54255 sh: dma: Fix DMA channel offset calculation
- CVE-2023-54254 drm/ttm: Don't leak a resource on eviction error
- CVE-2023-54253 btrfs: set page extent mapped after read_folio in relocate_one_page