# Vulnerabilities published in 2023


- [CVE-2023-53234](https://insights.sbomify.com/CVE-2023-53234/): watchdog: Fix kmemleak in watchdog_cdev_register (medium 5.5)
- [CVE-2023-53233](https://insights.sbomify.com/CVE-2023-53233/): net/smc: fix deadlock triggered by cancel_delayed_work_syn() (medium 5.5)
- [CVE-2023-53232](https://insights.sbomify.com/CVE-2023-53232/): mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data (high 7.1)
- [CVE-2023-53231](https://insights.sbomify.com/CVE-2023-53231/): erofs: Fix detection of atomic context (medium 5.5)
- [CVE-2023-53230](https://insights.sbomify.com/CVE-2023-53230/): smb: client: fix warning in cifs_smb3_do_mount() (medium 5.5)
- [CVE-2023-5323](https://insights.sbomify.com/CVE-2023-5323/): Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr (medium 5.4)
- [CVE-2023-53229](https://insights.sbomify.com/CVE-2023-53229/): wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta (high 7.1)
- [CVE-2023-53228](https://insights.sbomify.com/CVE-2023-53228/): drm/amdgpu: drop redundant sched job cleanup when cs is aborted (medium 5.5)
- [CVE-2023-53226](https://insights.sbomify.com/CVE-2023-53226/): wifi: mwifiex: Fix OOB and integer underflow when rx packets (high 8.8)
- [CVE-2023-53225](https://insights.sbomify.com/CVE-2023-53225/): spi: imx: Don't skip cleanup in remove's error path (medium 5.5)
- [CVE-2023-53224](https://insights.sbomify.com/CVE-2023-53224/): ext4: Fix function prototype mismatch for ext4_feat_ktype (medium 5.5)
- [CVE-2023-53223](https://insights.sbomify.com/CVE-2023-53223/): drm/msm/dsi: Add missing check for alloc_ordered_workqueue (medium 5.5)
- [CVE-2023-53222](https://insights.sbomify.com/CVE-2023-53222/): jfs: jfs_dmap: Validate db_l2nbperpage while mounting (high 7.8)
- [CVE-2023-53221](https://insights.sbomify.com/CVE-2023-53221/): bpf: Fix memleak due to fentry attach failure (medium 5.5)
- [CVE-2023-53220](https://insights.sbomify.com/CVE-2023-53220/): media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() (medium 5.5)
- [CVE-2023-5322](https://insights.sbomify.com/CVE-2023-5322/): D-Link DAR-7000 edit_manageadmin.php sql injection (medium 4.7)
- [CVE-2023-53219](https://insights.sbomify.com/CVE-2023-53219/): media: netup_unidvb: fix use-after-free at del_timer() (high 7.8)
- [CVE-2023-53218](https://insights.sbomify.com/CVE-2023-53218/): rxrpc: Make it so that a waiting process can be aborted (high 7.8)
- [CVE-2023-53217](https://insights.sbomify.com/CVE-2023-53217/): nubus: Partially revert proc_create_single_data() conversion (high 7.8)
- [CVE-2023-53216](https://insights.sbomify.com/CVE-2023-53216/): arm64: efi: Make efi_rt_lock a raw_spinlock (high 7.8)
- [CVE-2023-53215](https://insights.sbomify.com/CVE-2023-53215/): sched/fair: Don't balance task to its current running CPU (high 7.8)
- [CVE-2023-53214](https://insights.sbomify.com/CVE-2023-53214/): f2fs: fix to avoid potential memory corruption in __update_iostat_latency() (high 7.0)
- [CVE-2023-53213](https://insights.sbomify.com/CVE-2023-53213/): wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() (high 8.1)
- [CVE-2023-53211](https://insights.sbomify.com/CVE-2023-53211/): driver core: location: Free struct acpi_pld_info *pld before return false (medium 5.5)
- [CVE-2023-53210](https://insights.sbomify.com/CVE-2023-53210/): md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() (medium 5.5)
- [CVE-2023-5321](https://insights.sbomify.com/CVE-2023-5321/): Missing Authorization in hamza417/inure (medium 5.1)
- [CVE-2023-53209](https://insights.sbomify.com/CVE-2023-53209/): wifi: mac80211_hwsim: Fix possible NULL dereference (medium 5.5)
- [CVE-2023-53208](https://insights.sbomify.com/CVE-2023-53208/): KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state (medium 5.5)
- [CVE-2023-53207](https://insights.sbomify.com/CVE-2023-53207/): ublk: fail to recover device if queue setup is interrupted (medium 5.5)
- [CVE-2023-53206](https://insights.sbomify.com/CVE-2023-53206/): hwmon: (pmbus_core) Fix NULL pointer dereference (medium 5.5)
- [CVE-2023-53205](https://insights.sbomify.com/CVE-2023-53205/): KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (high 7.3)
- [CVE-2023-53204](https://insights.sbomify.com/CVE-2023-53204/): af_unix: Fix data-races around user->unix_inflight. (medium 4.7)
- [CVE-2023-53203](https://insights.sbomify.com/CVE-2023-53203/): wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val (medium 5.5)
- [CVE-2023-53202](https://insights.sbomify.com/CVE-2023-53202/): PM: domains: fix memory leak with using debugfs_lookup() (medium 5.5)
- [CVE-2023-53201](https://insights.sbomify.com/CVE-2023-53201/): RDMA/bnxt_re: wraparound mbox producer index (medium 5.5)
- [CVE-2023-53200](https://insights.sbomify.com/CVE-2023-53200/): netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (medium 5.5)
- [CVE-2023-5320](https://insights.sbomify.com/CVE-2023-5320/): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (critical 9.0)
- [CVE-2023-53199](https://insights.sbomify.com/CVE-2023-53199/): wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails (medium 5.5)
- [CVE-2023-53198](https://insights.sbomify.com/CVE-2023-53198/): raw: Fix NULL deref in raw_get_next(). (medium 5.5)
- [CVE-2023-53197](https://insights.sbomify.com/CVE-2023-53197/): USB: uhci: fix memory leak with using debugfs_lookup() (medium 5.5)
- [CVE-2023-53196](https://insights.sbomify.com/CVE-2023-53196/): usb: dwc3: qcom: Fix potential memory leak (medium 5.5)
- [CVE-2023-53195](https://insights.sbomify.com/CVE-2023-53195/): mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init (medium 5.5)
- [CVE-2023-53194](https://insights.sbomify.com/CVE-2023-53194/): fs/ntfs3: Add length check in indx_get_root (high 8.4)
- [CVE-2023-53193](https://insights.sbomify.com/CVE-2023-53193/): drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini (medium 5.5)
- [CVE-2023-53192](https://insights.sbomify.com/CVE-2023-53192/): vxlan: Fix nexthop hash size (critical 9.8)
- [CVE-2023-53191](https://insights.sbomify.com/CVE-2023-53191/): irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (medium 5.5)
- [CVE-2023-53190](https://insights.sbomify.com/CVE-2023-53190/): vxlan: Fix memory leaks in error path (medium 5.5)
- [CVE-2023-5319](https://insights.sbomify.com/CVE-2023-5319/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.3)
- [CVE-2023-53189](https://insights.sbomify.com/CVE-2023-53189/): ipv6/addrconf: fix a potential refcount underflow for idev (high 7.8)
- [CVE-2023-53188](https://insights.sbomify.com/CVE-2023-53188/): net: openvswitch: fix race on port output (medium 4.7)
- [CVE-2023-53187](https://insights.sbomify.com/CVE-2023-53187/): btrfs: fix use-after-free of new block group that became unused (high 7.8)
- [CVE-2023-53186](https://insights.sbomify.com/CVE-2023-53186/): skbuff: Fix a race between coalescing and releasing SKBs (high 8.1)
- [CVE-2023-53185](https://insights.sbomify.com/CVE-2023-53185/): wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (medium 5.5)
- [CVE-2023-53184](https://insights.sbomify.com/CVE-2023-53184/): arm64/sme: Set new vector length before reallocating (high 7.8)
- [CVE-2023-53182](https://insights.sbomify.com/CVE-2023-53182/): ACPICA: Avoid undefined behavior: applying zero offset to null pointer (medium 5.5)
- [CVE-2023-53181](https://insights.sbomify.com/CVE-2023-53181/): dma-buf/dma-resv: Stop leaking on krealloc() failure (medium 5.5)
- [CVE-2023-53180](https://insights.sbomify.com/CVE-2023-53180/): wifi: ath12k: Avoid NULL pointer access during management transmit cleanup (medium 5.5)
- [CVE-2023-5318](https://insights.sbomify.com/CVE-2023-5318/): Use of Hard-coded Credentials in microweber/microweber (medium 5.8)
- [CVE-2023-53179](https://insights.sbomify.com/CVE-2023-53179/): netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (high 7.8)
- [CVE-2023-53178](https://insights.sbomify.com/CVE-2023-53178/): mm: fix zswap writeback race condition (high 7.8)
- [CVE-2023-53177](https://insights.sbomify.com/CVE-2023-53177/): media: hi846: fix usage of pm_runtime_get_if_in_use() (medium 5.5)
- [CVE-2023-53176](https://insights.sbomify.com/CVE-2023-53176/): serial: 8250: Reinit port->pm on port specific driver unbind (high 7.8)
- [CVE-2023-53175](https://insights.sbomify.com/CVE-2023-53175/): PCI: hv: Fix a crash in hv_pci_restore_msi_msg() during hibernation (medium 5.5)
- [CVE-2023-53174](https://insights.sbomify.com/CVE-2023-53174/): scsi: core: Fix possible memory leak if device_add() fails (medium 5.5)
- [CVE-2023-53173](https://insights.sbomify.com/CVE-2023-53173/): tty: pcn_uart: fix memory leak with using debugfs_lookup() (medium 5.5)
- [CVE-2023-53172](https://insights.sbomify.com/CVE-2023-53172/): fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds (medium 5.5)
- [CVE-2023-53171](https://insights.sbomify.com/CVE-2023-53171/): vfio/type1: prevent underflow of locked_vm via exec() (medium 5.5)
- [CVE-2023-53170](https://insights.sbomify.com/CVE-2023-53170/): net: dsa: Removed unneeded of_node_put in felix_parse_ports_node (high 7.8)
- [CVE-2023-5317](https://insights.sbomify.com/CVE-2023-5317/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (medium 6.3)
- [CVE-2023-53169](https://insights.sbomify.com/CVE-2023-53169/): x86/resctrl: Clear staged_config[] before and after it is used (medium 5.5)
- [CVE-2023-53168](https://insights.sbomify.com/CVE-2023-53168/): usb: ucsi_acpi: Increase the command completion timeout (medium 5.5)
- [CVE-2023-53167](https://insights.sbomify.com/CVE-2023-53167/): tracing: Fix null pointer dereference in tracing_err_log_open() (medium 5.5)
- [CVE-2023-53166](https://insights.sbomify.com/CVE-2023-53166/): power: supply: bq25890: Fix external_power_changed race (medium 4.7)
- [CVE-2023-53165](https://insights.sbomify.com/CVE-2023-53165/): udf: Fix uninitialized array access for some pathnames (medium 5.5)
- [CVE-2023-53164](https://insights.sbomify.com/CVE-2023-53164/): irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe (medium 5.5)
- [CVE-2023-53163](https://insights.sbomify.com/CVE-2023-53163/): fs/ntfs3: don't hold ni_lock when calling truncate_setsize() (medium 5.5)
- [CVE-2023-53161](https://insights.sbomify.com/CVE-2023-53161/): buffered-reader vulnerable to out-of-bounds array access leading to panic (low 2.9)
- [CVE-2023-53160](https://insights.sbomify.com/CVE-2023-53160/): sequoia-openpgp vulnerable to out-of-bounds array access leading to panic (low 2.9)
- [CVE-2023-5316](https://insights.sbomify.com/CVE-2023-5316/): Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq (critical 9.1)
- [CVE-2023-53159](https://insights.sbomify.com/CVE-2023-53159/): `openssl` `X509VerifyParamRef::set_host` buffer over-read (medium 4.5)
- [CVE-2023-53158](https://insights.sbomify.com/CVE-2023-53158/): gix-transport code execution vulnerability (medium 4.1)
- [CVE-2023-53157](https://insights.sbomify.com/CVE-2023-53157/): Remotely exploitable denial of service in Rosenpass (medium 5.3)
- [CVE-2023-53156](https://insights.sbomify.com/CVE-2023-53156/): transpose: Buffer overflow due to integer overflow (medium 4.5)
- [CVE-2023-53155](https://insights.sbomify.com/CVE-2023-53155/): Cross-site scripting in GoAhead (high 7.2)
- [CVE-2023-53154](https://insights.sbomify.com/CVE-2023-53154/): Memory corruption in cJSON (low 2.9)
- [CVE-2023-53153](https://insights.sbomify.com/CVE-2023-53153/): wifi: cfg80211: Fix use after free for wext (high 7.8)
- [CVE-2023-53152](https://insights.sbomify.com/CVE-2023-53152/): drm/amdgpu: fix calltrace warning in amddrm_buddy_fini (medium 5.5)
- [CVE-2023-53151](https://insights.sbomify.com/CVE-2023-53151/): md/raid10: prevent soft lockup while flush writes (medium 5.5)
- [CVE-2023-53150](https://insights.sbomify.com/CVE-2023-53150/): scsi: qla2xxx: Pointer may be dereferenced (medium 5.5)
- [CVE-2023-5315](https://insights.sbomify.com/CVE-2023-5315/): Google Maps made Simple <= 0.6 - Authenticated (Subscriber+) SQL Injection via Shortcode (high 8.8)
- [CVE-2023-53149](https://insights.sbomify.com/CVE-2023-53149/): ext4: avoid deadlock in fs reclaim with page writeback (medium 5.5)
- [CVE-2023-53148](https://insights.sbomify.com/CVE-2023-53148/): igb: Fix igb_down hung on surprise removal (high 7.8)
- [CVE-2023-53147](https://insights.sbomify.com/CVE-2023-53147/): xfrm: add NULL check in xfrm_update_ae_params (medium 5.5)
- [CVE-2023-53146](https://insights.sbomify.com/CVE-2023-53146/): media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() (medium 5.5)
- [CVE-2023-53145](https://insights.sbomify.com/CVE-2023-53145/): Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (high 7.8)
- [CVE-2023-53144](https://insights.sbomify.com/CVE-2023-53144/): erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms (medium 5.5)
- [CVE-2023-53143](https://insights.sbomify.com/CVE-2023-53143/): ext4: fix another off-by-one fsmap error on 1k block filesystems (medium 5.5)
- [CVE-2023-53142](https://insights.sbomify.com/CVE-2023-53142/): ice: copy last block omitted in ice_get_module_eeprom() (high 7.8)
- [CVE-2023-53141](https://insights.sbomify.com/CVE-2023-53141/): ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (medium 5.5)
- [CVE-2023-53140](https://insights.sbomify.com/CVE-2023-53140/): scsi: core: Remove the /proc/scsi/${proc_name} directory earlier (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/153/