# Vulnerabilities published in 2023


- [CVE-2023-53510](https://insights.sbomify.com/CVE-2023-53510/): scsi: ufs: core: Fix handling of lrbp->cmd (high 7.8)
- [CVE-2023-5351](https://insights.sbomify.com/CVE-2023-5351/): Cross-site Scripting (XSS) - Stored in salesagility/suitecrm (high 8.9)
- [CVE-2023-53509](https://insights.sbomify.com/CVE-2023-53509/): qed: allow sleep in qed_mcp_trace_dump() (medium 5.5)
- [CVE-2023-53508](https://insights.sbomify.com/CVE-2023-53508/): ublk: fail to start device if queue setup is interrupted (high 7.8)
- [CVE-2023-53507](https://insights.sbomify.com/CVE-2023-53507/): net/mlx5: Unregister devlink params in case interface is down (high 7.8)
- [CVE-2023-53506](https://insights.sbomify.com/CVE-2023-53506/): udf: Do not bother merging very long extents (high 7.8)
- [CVE-2023-53505](https://insights.sbomify.com/CVE-2023-53505/): clk: tegra: tegra124-emc: Fix potential memory leak (medium 5.5)
- [CVE-2023-53504](https://insights.sbomify.com/CVE-2023-53504/): RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF (high 7.8)
- [CVE-2023-53503](https://insights.sbomify.com/CVE-2023-53503/): ext4: allow ext4_get_group_info() to fail (medium 5.5)
- [CVE-2023-53501](https://insights.sbomify.com/CVE-2023-53501/): iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind (medium 4.7)
- [CVE-2023-53500](https://insights.sbomify.com/CVE-2023-53500/): xfrm: fix slab-use-after-free in decode_session6 (high 7.3)
- [CVE-2023-5350](https://insights.sbomify.com/CVE-2023-5350/): SQL Injection in salesagility/suitecrm (medium 6.4)
- [CVE-2023-53499](https://insights.sbomify.com/CVE-2023-53499/): virtio_net: Fix error unwinding of XDP initialization (high 7.0)
- [CVE-2023-53498](https://insights.sbomify.com/CVE-2023-53498/): drm/amd/display: Fix potential null dereference (medium 5.5)
- [CVE-2023-53497](https://insights.sbomify.com/CVE-2023-53497/): media: vsp1: Replace vb2_is_streaming() with vb2_start_streaming_called() (medium 5.5)
- [CVE-2023-53496](https://insights.sbomify.com/CVE-2023-53496/): x86/platform/uv: Use alternate source for socket to node data (medium 5.5)
- [CVE-2023-53495](https://insights.sbomify.com/CVE-2023-53495/): net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() (high 7.8)
- [CVE-2023-53494](https://insights.sbomify.com/CVE-2023-53494/): crypto: xts - Handle EBUSY correctly (high 7.8)
- [CVE-2023-53493](https://insights.sbomify.com/CVE-2023-53493/): accel/qaic: tighten bounds checking in decode_message() (high 8.4)
- [CVE-2023-53492](https://insights.sbomify.com/CVE-2023-53492/): netfilter: nf_tables: do not ignore genmask when looking up chain by id (high 7.8)
- [CVE-2023-53491](https://insights.sbomify.com/CVE-2023-53491/): start_kernel: Add __no_stack_protector function attribute (high 7.5)
- [CVE-2023-53490](https://insights.sbomify.com/CVE-2023-53490/): mptcp: fix disconnect vs accept race (high 7.8)
- [CVE-2023-5349](https://insights.sbomify.com/CVE-2023-5349/): Draw while calling getdrawinfo() (medium 5.3)
- [CVE-2023-53489](https://insights.sbomify.com/CVE-2023-53489/): tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. (medium 5.5)
- [CVE-2023-53488](https://insights.sbomify.com/CVE-2023-53488/): IB/hfi1: Fix possible panic during hotplug remove (medium 5.5)
- [CVE-2023-53487](https://insights.sbomify.com/CVE-2023-53487/): powerpc/rtas_flash: allow user copy to flash block cache objects (high 7.8)
- [CVE-2023-53486](https://insights.sbomify.com/CVE-2023-53486/): fs/ntfs3: Enhance the attribute size check (high 7.8)
- [CVE-2023-53485](https://insights.sbomify.com/CVE-2023-53485/): fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (high 7.8)
- [CVE-2023-53484](https://insights.sbomify.com/CVE-2023-53484/): lib: cpu_rmap: Avoid use after free on rmap->obj array entries (high 7.8)
- [CVE-2023-53483](https://insights.sbomify.com/CVE-2023-53483/): ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() (medium 5.5)
- [CVE-2023-53482](https://insights.sbomify.com/CVE-2023-53482/): iommu: Fix error unwind in iommu_group_alloc() (medium 5.5)
- [CVE-2023-53481](https://insights.sbomify.com/CVE-2023-53481/): ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed (high 7.8)
- [CVE-2023-53480](https://insights.sbomify.com/CVE-2023-53480/): kobject: Add sanity check for kset->kobj.ktype in kset_register() (medium 5.5)
- [CVE-2023-5348](https://insights.sbomify.com/CVE-2023-5348/): Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Stored XSS via Arbitrary Setting Update (medium 6.1)
- [CVE-2023-53479](https://insights.sbomify.com/CVE-2023-53479/): cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() (high 7.8)
- [CVE-2023-53478](https://insights.sbomify.com/CVE-2023-53478/): tracing/synthetic: Fix races on freeing last_cmd (high 7.8)
- [CVE-2023-53477](https://insights.sbomify.com/CVE-2023-53477/): ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (medium 5.5)
- [CVE-2023-53476](https://insights.sbomify.com/CVE-2023-53476/): iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (medium 5.5)
- [CVE-2023-53475](https://insights.sbomify.com/CVE-2023-53475/): usb: xhci: tegra: fix sleep in atomic call (medium 5.5)
- [CVE-2023-53474](https://insights.sbomify.com/CVE-2023-53474/): x86/MCE/AMD: Use an u64 for bank_map (high 7.8)
- [CVE-2023-53473](https://insights.sbomify.com/CVE-2023-53473/): ext4: improve error handling from ext4_dirhash() (high 7.8)
- [CVE-2023-53472](https://insights.sbomify.com/CVE-2023-53472/): pwm: lpc32xx: Remove handling of PWM channels (medium 5.5)
- [CVE-2023-53471](https://insights.sbomify.com/CVE-2023-53471/): drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras (high 7.8)
- [CVE-2023-53470](https://insights.sbomify.com/CVE-2023-53470/): ionic: catch failure from devlink_alloc (medium 5.5)
- [CVE-2023-5347](https://insights.sbomify.com/CVE-2023-5347/): Unauthenticated Firmware Upgrade (critical 9.8)
- [CVE-2023-53468](https://insights.sbomify.com/CVE-2023-53468/): ubifs: Fix memory leak in alloc_wbufs() (medium 5.5)
- [CVE-2023-53467](https://insights.sbomify.com/CVE-2023-53467/): wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie() (medium 5.5)
- [CVE-2023-53466](https://insights.sbomify.com/CVE-2023-53466/): wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit (medium 5.5)
- [CVE-2023-53465](https://insights.sbomify.com/CVE-2023-53465/): soundwire: qcom: fix storing port config out-of-bounds (high 7.8)
- [CVE-2023-53464](https://insights.sbomify.com/CVE-2023-53464/): scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() (medium 5.5)
- [CVE-2023-53463](https://insights.sbomify.com/CVE-2023-53463/): ibmvnic: Do not reset dql stats on NON_FATAL err (high 7.5)
- [CVE-2023-53462](https://insights.sbomify.com/CVE-2023-53462/): hsr: Fix uninit-value access in fill_frame_info() (high 7.1)
- [CVE-2023-53461](https://insights.sbomify.com/CVE-2023-53461/): io_uring: wait interruptibly for request completions on exit (medium 5.5)
- [CVE-2023-53460](https://insights.sbomify.com/CVE-2023-53460/): wifi: rtw88: fix memory leak in rtw_usb_probe() (medium 5.5)
- [CVE-2023-5346](https://insights.sbomify.com/CVE-2023-5346/): Memory corruption in Chrome (high 8.8)
- [CVE-2023-53459](https://insights.sbomify.com/CVE-2023-53459/): HID: mcp-2221: prevent UAF in delayed work (high 7.8)
- [CVE-2023-53458](https://insights.sbomify.com/CVE-2023-53458/): media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() (medium 5.5)
- [CVE-2023-53457](https://insights.sbomify.com/CVE-2023-53457/): FS: JFS: Fix null-ptr-deref Read in txBegin (medium 5.5)
- [CVE-2023-53456](https://insights.sbomify.com/CVE-2023-53456/): scsi: qla4xxx: Add length check when parsing nlattrs (medium 5.5)
- [CVE-2023-53455](https://insights.sbomify.com/CVE-2023-53455/): drm/vc4: drop all currently held locks if deadlock happens (medium 5.5)
- [CVE-2023-53454](https://insights.sbomify.com/CVE-2023-53454/): HID: multitouch: Correct devm device reference for hidinput input_dev name (high 8.8)
- [CVE-2023-53453](https://insights.sbomify.com/CVE-2023-53453/): drm/radeon: free iio for atombios when driver shutdown (medium 5.5)
- [CVE-2023-53452](https://insights.sbomify.com/CVE-2023-53452/): wifi: rtw89: fix potential race condition between napi_init and napi_enable (medium 4.7)
- [CVE-2023-53451](https://insights.sbomify.com/CVE-2023-53451/): scsi: qla2xxx: Fix potential NULL pointer dereference (medium 5.5)
- [CVE-2023-53450](https://insights.sbomify.com/CVE-2023-53450/): ext4: remove a BUG_ON in ext4_mb_release_group_pa() (medium 5.5)
- [CVE-2023-5345](https://insights.sbomify.com/CVE-2023-5345/): Use-after-free in Linux kernel's fs/smb/client component (high 7.8)
- [CVE-2023-53449](https://insights.sbomify.com/CVE-2023-53449/): s390/dasd: Fix potential memleak in dasd_eckd_init() (medium 5.5)
- [CVE-2023-53448](https://insights.sbomify.com/CVE-2023-53448/): fbdev: imxfb: Removed unneeded release_mem_region (medium 5.5)
- [CVE-2023-53447](https://insights.sbomify.com/CVE-2023-53447/): f2fs: don't reset unchangable mount option in f2fs_remount() (medium 4.7)
- [CVE-2023-53446](https://insights.sbomify.com/CVE-2023-53446/): PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free (high 7.8)
- [CVE-2023-53445](https://insights.sbomify.com/CVE-2023-53445/): net: qrtr: Fix a refcount bug in qrtr_recvmsg() (high 7.8)
- [CVE-2023-53444](https://insights.sbomify.com/CVE-2023-53444/): drm/ttm: fix bulk_move corruption when adding a entry (medium 5.5)
- [CVE-2023-53443](https://insights.sbomify.com/CVE-2023-53443/): mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak (medium 5.5)
- [CVE-2023-53442](https://insights.sbomify.com/CVE-2023-53442/): ice: Block switchdev mode when ADQ is active and vice versa (medium 5.5)
- [CVE-2023-53441](https://insights.sbomify.com/CVE-2023-53441/): bpf: cpumap: Fix memory leak in cpu_map_update_elem (medium 5.5)
- [CVE-2023-53440](https://insights.sbomify.com/CVE-2023-53440/): nilfs2: fix sysfs interface lifetime (high 7.8)
- [CVE-2023-5344](https://insights.sbomify.com/CVE-2023-5344/): Heap-based Buffer Overflow in vim/vim (medium 4.0)
- [CVE-2023-53439](https://insights.sbomify.com/CVE-2023-53439/): net: skb_partial_csum_set() fix against transport header magic value (medium 5.5)
- [CVE-2023-53438](https://insights.sbomify.com/CVE-2023-53438/): x86/MCE: Always save CS register on AMD Zen IF Poison errors (medium 5.5)
- [CVE-2023-53437](https://insights.sbomify.com/CVE-2023-53437/): media: uvcvideo: Handle cameras with invalid descriptors (medium 5.5)
- [CVE-2023-53436](https://insights.sbomify.com/CVE-2023-53436/): scsi: snic: Fix possible memory leak if device_add() fails (medium 5.5)
- [CVE-2023-53435](https://insights.sbomify.com/CVE-2023-53435/): cassini: Fix a memory leak in the error handling path of cas_init_one() (medium 5.5)
- [CVE-2023-53434](https://insights.sbomify.com/CVE-2023-53434/): remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores (medium 5.5)
- [CVE-2023-53433](https://insights.sbomify.com/CVE-2023-53433/): net: add vlan_get_protocol_and_depth() helper (medium 5.5)
- [CVE-2023-53432](https://insights.sbomify.com/CVE-2023-53432/): firewire: net: fix use after free in fwnet_finish_incoming_packet() (high 8.8)
- [CVE-2023-53431](https://insights.sbomify.com/CVE-2023-53431/): scsi: ses: Handle enclosure with just a primary component gracefully (high 8.8)
- [CVE-2023-53430](https://insights.sbomify.com/CVE-2023-53430/): wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup (medium 5.5)
- [CVE-2023-5343](https://insights.sbomify.com/CVE-2023-5343/): Popup Box < 3.7.9 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-53429](https://insights.sbomify.com/CVE-2023-53429/): btrfs: don't check PageError in __extent_writepage (high 7.8)
- [CVE-2023-53428](https://insights.sbomify.com/CVE-2023-53428/): powercap: arm_scmi: Remove recursion while parsing zones (medium 5.5)
- [CVE-2023-53427](https://insights.sbomify.com/CVE-2023-53427/): cifs: Fix warning and UAF when destroy the MR list (high 7.8)
- [CVE-2023-53426](https://insights.sbomify.com/CVE-2023-53426/): xsk: Fix xsk_diag use-after-free error during socket cleanup (high 7.8)
- [CVE-2023-53425](https://insights.sbomify.com/CVE-2023-53425/): media: platform: mediatek: vpu: fix NULL ptr dereference (medium 5.5)
- [CVE-2023-53424](https://insights.sbomify.com/CVE-2023-53424/): clk: mediatek: fix of_iomap memory leak (medium 5.5)
- [CVE-2023-53423](https://insights.sbomify.com/CVE-2023-53423/): objtool: Fix memory leak in create_static_call_sections() (medium 5.5)
- [CVE-2023-53422](https://insights.sbomify.com/CVE-2023-53422/): wifi: iwlwifi: fw: fix memory leak in debugfs (medium 5.5)
- [CVE-2023-53421](https://insights.sbomify.com/CVE-2023-53421/): blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (medium 5.5)
- [CVE-2023-53420](https://insights.sbomify.com/CVE-2023-53420/): ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() (high 7.1)
- [CVE-2023-5342](https://insights.sbomify.com/CVE-2023-5342/): Shim: expired secure boot certificate (medium 4.1)
- [CVE-2023-53419](https://insights.sbomify.com/CVE-2023-53419/): rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/150/