# Vulnerabilities published in 2023


- [CVE-2023-53788](https://insights.sbomify.com/CVE-2023-53788/): ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (not scored)
- [CVE-2023-53787](https://insights.sbomify.com/CVE-2023-53787/): regulator: da9063: fix null pointer deref with partial DT config (not scored)
- [CVE-2023-53786](https://insights.sbomify.com/CVE-2023-53786/): dm flakey: fix a crash with invalid table line (not scored)
- [CVE-2023-53785](https://insights.sbomify.com/CVE-2023-53785/): mt76: mt7921: don't assume adequate headroom for SDIO headers (high 8.8)
- [CVE-2023-53784](https://insights.sbomify.com/CVE-2023-53784/): drm: bridge: dw_hdmi: fix connector access for scdc (not scored)
- [CVE-2023-53783](https://insights.sbomify.com/CVE-2023-53783/): blk-iocost: fix divide by 0 error in calc_lcoefs() (not scored)
- [CVE-2023-53782](https://insights.sbomify.com/CVE-2023-53782/): dccp: Fix out of bounds access in DCCP error handler (not scored)
- [CVE-2023-53781](https://insights.sbomify.com/CVE-2023-53781/): smc: Fix use-after-free in tcp_write_timer_handler(). (high 7.8)
- [CVE-2023-53780](https://insights.sbomify.com/CVE-2023-53780/): drm/amd/display: fix FCLK pstate change underflow (not scored)
- [CVE-2023-5378](https://insights.sbomify.com/CVE-2023-5378/): Stored XSS in SmodBIP and MegaBIP (high 8.8)
- [CVE-2023-53778](https://insights.sbomify.com/CVE-2023-53778/): accel/qaic: Clean up integer overflow checking in map_user_pages() (high 7.8)
- [CVE-2023-53777](https://insights.sbomify.com/CVE-2023-53777/): erofs: kill hooked chains to avoid loops on deduplicated compressed images (not scored)
- [CVE-2023-53776](https://insights.sbomify.com/CVE-2023-53776/): Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness (high 8.7)
- [CVE-2023-53775](https://insights.sbomify.com/CVE-2023-53775/): Screen SFT DAB 1.9.3 Authentication Bypass via Session Management Weakness (high 7.1)
- [CVE-2023-53774](https://insights.sbomify.com/CVE-2023-53774/): MiniDVBLinux 5.4 Simple VideoDiskRecorder Protocol Remote Code Execution (medium 6.9)
- [CVE-2023-53773](https://insights.sbomify.com/CVE-2023-53773/): MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh (high 8.7)
- [CVE-2023-53772](https://insights.sbomify.com/CVE-2023-53772/): MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page (high 8.7)
- [CVE-2023-53771](https://insights.sbomify.com/CVE-2023-53771/): MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup (critical 9.3)
- [CVE-2023-53770](https://insights.sbomify.com/CVE-2023-53770/): MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint (high 8.7)
- [CVE-2023-5377](https://insights.sbomify.com/CVE-2023-5377/): Out-of-bounds Read in gpac/gpac (medium 5.5)
- [CVE-2023-53769](https://insights.sbomify.com/CVE-2023-53769/): virt/coco/sev-guest: Double-buffer messages (critical 9.3)
- [CVE-2023-53768](https://insights.sbomify.com/CVE-2023-53768/): regmap-irq: Fix out-of-bounds access when allocating config buffers (high 7.8)
- [CVE-2023-53767](https://insights.sbomify.com/CVE-2023-53767/): wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work() (not scored)
- [CVE-2023-53766](https://insights.sbomify.com/CVE-2023-53766/): FS: JFS: Check for read-only mounted filesystem in txBegin (not scored)
- [CVE-2023-53765](https://insights.sbomify.com/CVE-2023-53765/): dm cache: free background tracker's queued work in btracker_destroy (not scored)
- [CVE-2023-53764](https://insights.sbomify.com/CVE-2023-53764/): wifi: ath12k: Handle lock during peer_id find (high 8.8)
- [CVE-2023-53763](https://insights.sbomify.com/CVE-2023-53763/): Revert "f2fs: fix to do sanity check on extent cache correctly" (high 7.8)
- [CVE-2023-53762](https://insights.sbomify.com/CVE-2023-53762/): Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (high 8.8)
- [CVE-2023-53761](https://insights.sbomify.com/CVE-2023-53761/): USB: usbtmc: Fix direction for 0-length ioctl control messages (not scored)
- [CVE-2023-53760](https://insights.sbomify.com/CVE-2023-53760/): scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue (not scored)
- [CVE-2023-5376](https://insights.sbomify.com/CVE-2023-5376/): TFTP Without Authentication (high 8.6)
- [CVE-2023-53759](https://insights.sbomify.com/CVE-2023-53759/): HID: hidraw: fix data race on device refcount (high 7.8)
- [CVE-2023-53758](https://insights.sbomify.com/CVE-2023-53758/): spi: atmel-quadspi: Free resources even if runtime resume failed in .remove() (not scored)
- [CVE-2023-53757](https://insights.sbomify.com/CVE-2023-53757/): irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe (not scored)
- [CVE-2023-53756](https://insights.sbomify.com/CVE-2023-53756/): KVM: VMX: Fix crash due to uninitialized current_vmcs (not scored)
- [CVE-2023-53755](https://insights.sbomify.com/CVE-2023-53755/): dmaengine: ptdma: check for null desc before calling pt_cmd_callback (not scored)
- [CVE-2023-53754](https://insights.sbomify.com/CVE-2023-53754/): scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() (not scored)
- [CVE-2023-53753](https://insights.sbomify.com/CVE-2023-53753/): drm/amd/display: fix mapping to non-allocated address (high 7.8)
- [CVE-2023-53752](https://insights.sbomify.com/CVE-2023-53752/): net: deal with integer overflows in kmalloc_reserve() (high 7.8)
- [CVE-2023-53751](https://insights.sbomify.com/CVE-2023-53751/): cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (critical 9.8)
- [CVE-2023-53750](https://insights.sbomify.com/CVE-2023-53750/): pinctrl: freescale: Fix a memory out of bounds when num_configs is 1 (not scored)
- [CVE-2023-5375](https://insights.sbomify.com/CVE-2023-5375/): Open Redirect in mosparo/mosparo (medium 4.3)
- [CVE-2023-53748](https://insights.sbomify.com/CVE-2023-53748/): media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup (high 7.1)
- [CVE-2023-53747](https://insights.sbomify.com/CVE-2023-53747/): vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (high 7.8)
- [CVE-2023-53746](https://insights.sbomify.com/CVE-2023-53746/): s390/vfio-ap: fix memory leak in vfio_ap device driver (not scored)
- [CVE-2023-53745](https://insights.sbomify.com/CVE-2023-53745/): um: vector: Fix memory leak in vector_config (not scored)
- [CVE-2023-53744](https://insights.sbomify.com/CVE-2023-53744/): soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe (not scored)
- [CVE-2023-53743](https://insights.sbomify.com/CVE-2023-53743/): PCI: Free released resource after coalescing (not scored)
- [CVE-2023-53742](https://insights.sbomify.com/CVE-2023-53742/): kcsan: Avoid READ_ONCE() in read_instrumented_memory() (not scored)
- [CVE-2023-53741](https://insights.sbomify.com/CVE-2023-53741/): Screen SFT DAB 1.9.3 Authentication Bypass via IP Session Management (medium 5.1)
- [CVE-2023-53740](https://insights.sbomify.com/CVE-2023-53740/): Screen SFT DAB 1.9.3 Authentication Bypass via Admin Password Change (high 8.6)
- [CVE-2023-5374](https://insights.sbomify.com/CVE-2023-5374/): SourceCodester Online Computer and Laptop Store products.php sql injection (medium 6.3)
- [CVE-2023-53739](https://insights.sbomify.com/CVE-2023-53739/): Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure (critical 9.9)
- [CVE-2023-53738](https://insights.sbomify.com/CVE-2023-53738/): Kentico Xperience <= 13.0.109 Page Preview Reflected XSS (medium 5.1)
- [CVE-2023-53737](https://insights.sbomify.com/CVE-2023-53737/): Kentico Xperience <= 13.0.101 Localization Application Stored XSS (medium 5.1)
- [CVE-2023-53736](https://insights.sbomify.com/CVE-2023-53736/): Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS (medium 5.1)
- [CVE-2023-53735](https://insights.sbomify.com/CVE-2023-53735/): WEBIGniter 28.7.23 Cross-Site Scripting (XSS) in User Creation Process (medium 5.3)
- [CVE-2023-53734](https://insights.sbomify.com/CVE-2023-53734/): dawa-pharma-1.0 - SQL Injection via Email Parameter (high 8.7)
- [CVE-2023-53733](https://insights.sbomify.com/CVE-2023-53733/): net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode (high 7.8)
- [CVE-2023-53732](https://insights.sbomify.com/CVE-2023-53732/): fs/ntfs3: Fix NULL dereference in ni_write_inode (not scored)
- [CVE-2023-53731](https://insights.sbomify.com/CVE-2023-53731/): netlink: fix potential deadlock in netlink_set_err() (not scored)
- [CVE-2023-53730](https://insights.sbomify.com/CVE-2023-53730/): blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost (not scored)
- [CVE-2023-5373](https://insights.sbomify.com/CVE-2023-5373/): SourceCodester Online Computer and Laptop Store Master.php register sql injection (high 7.3)
- [CVE-2023-53729](https://insights.sbomify.com/CVE-2023-53729/): soc: qcom: qmi_encdec: Restrict string length in decode (high 7.8)
- [CVE-2023-53728](https://insights.sbomify.com/CVE-2023-53728/): posix-timers: Ensure timer ID search-loop limit is valid (not scored)
- [CVE-2023-53727](https://insights.sbomify.com/CVE-2023-53727/): net/sched: fq_pie: avoid stalls in fq_pie_timer() (not scored)
- [CVE-2023-53726](https://insights.sbomify.com/CVE-2023-53726/): arm64: csum: Fix OoB access in IP checksum code for negative lengths (high 7.1)
- [CVE-2023-53725](https://insights.sbomify.com/CVE-2023-53725/): clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe (not scored)
- [CVE-2023-53724](https://insights.sbomify.com/CVE-2023-53724/): mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() (not scored)
- [CVE-2023-53723](https://insights.sbomify.com/CVE-2023-53723/): drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend (not scored)
- [CVE-2023-53722](https://insights.sbomify.com/CVE-2023-53722/): md: raid1: fix potential OOB in raid1_remove_disk() (not scored)
- [CVE-2023-53721](https://insights.sbomify.com/CVE-2023-53721/): wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan() (not scored)
- [CVE-2023-53720](https://insights.sbomify.com/CVE-2023-53720/): net/mlx5e: Release the label when replacing existing ct entry (not scored)
- [CVE-2023-5372](https://insights.sbomify.com/CVE-2023-5372/): Command injection in NAS326 firmware (high 7.2)
- [CVE-2023-53719](https://insights.sbomify.com/CVE-2023-53719/): serial: arc_uart: fix of_iomap leak in `arc_serial_probe` (not scored)
- [CVE-2023-53718](https://insights.sbomify.com/CVE-2023-53718/): ring-buffer: Do not swap cpu_buffer during resize process (high 7.8)
- [CVE-2023-53717](https://insights.sbomify.com/CVE-2023-53717/): wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (not scored)
- [CVE-2023-53716](https://insights.sbomify.com/CVE-2023-53716/): net: fix skb leak in __skb_tstamp_tx() (not scored)
- [CVE-2023-53715](https://insights.sbomify.com/CVE-2023-53715/): wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (not scored)
- [CVE-2023-53714](https://insights.sbomify.com/CVE-2023-53714/): drm/stm: ltdc: fix late dereference check (not scored)
- [CVE-2023-53713](https://insights.sbomify.com/CVE-2023-53713/): arm64: sme: Use STR P to clear FFR context field in streaming SVE mode (high 7.8)
- [CVE-2023-53712](https://insights.sbomify.com/CVE-2023-53712/): ARM: 9317/1: kexec: Make smp stop calls asynchronous (not scored)
- [CVE-2023-53711](https://insights.sbomify.com/CVE-2023-53711/): NFS: Fix a potential data corruption (high 8.2)
- [CVE-2023-53710](https://insights.sbomify.com/CVE-2023-53710/): wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read (not scored)
- [CVE-2023-5371](https://insights.sbomify.com/CVE-2023-5371/): Memory Allocation with Excessive Size Value in Wireshark (medium 5.3)
- [CVE-2023-53709](https://insights.sbomify.com/CVE-2023-53709/): ring-buffer: Handle race between rb_move_tail and rb_check_pages (not scored)
- [CVE-2023-53708](https://insights.sbomify.com/CVE-2023-53708/): ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects (not scored)
- [CVE-2023-53707](https://insights.sbomify.com/CVE-2023-53707/): drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 (high 7.8)
- [CVE-2023-53706](https://insights.sbomify.com/CVE-2023-53706/): mm/vmemmap/devdax: fix kernel crash when probing devdax devices (not scored)
- [CVE-2023-53705](https://insights.sbomify.com/CVE-2023-53705/): ipv6: Fix out-of-bounds access in ipv6_find_tlv() (high 8.2)
- [CVE-2023-53704](https://insights.sbomify.com/CVE-2023-53704/): clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() (not scored)
- [CVE-2023-53703](https://insights.sbomify.com/CVE-2023-53703/): HID: amd_sfh: Fix for shift-out-of-bounds (not scored)
- [CVE-2023-53702](https://insights.sbomify.com/CVE-2023-53702/): s390/crypto: use vector instructions only if available for ChaCha20 (not scored)
- [CVE-2023-53700](https://insights.sbomify.com/CVE-2023-53700/): media: max9286: Fix memleak in max9286_v4l2_register() (not scored)
- [CVE-2023-5370](https://insights.sbomify.com/CVE-2023-5370/): arm64 boot CPUs may lack speculative execution protections (medium 5.5)
- [CVE-2023-53699](https://insights.sbomify.com/CVE-2023-53699/): riscv: move memblock_allow_resize() after linear mapping is ready (not scored)
- [CVE-2023-53698](https://insights.sbomify.com/CVE-2023-53698/): xsk: fix refcount underflow in error path (high 7.8)
- [CVE-2023-53697](https://insights.sbomify.com/CVE-2023-53697/): nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() (not scored)
- [CVE-2023-53696](https://insights.sbomify.com/CVE-2023-53696/): scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() (not scored)
- [CVE-2023-53695](https://insights.sbomify.com/CVE-2023-53695/): udf: Detect system inodes linked into directory hierarchy (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/147/