# Vulnerabilities published in 2023


- [CVE-2023-52453](https://insights.sbomify.com/CVE-2023-52453/): hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resume (high 7.1)
- [CVE-2023-52452](https://insights.sbomify.com/CVE-2023-52452/): bpf: Fix accesses to uninit stack slots (high 7.8)
- [CVE-2023-52451](https://insights.sbomify.com/CVE-2023-52451/): powerpc/pseries/memhp: Fix access beyond end of drmem array (high 7.8)
- [CVE-2023-52450](https://insights.sbomify.com/CVE-2023-52450/): perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() (medium 5.5)
- [CVE-2023-5245](https://insights.sbomify.com/CVE-2023-5245/): Zip slip in mleap (high 7.5)
- [CVE-2023-52449](https://insights.sbomify.com/CVE-2023-52449/): mtd: Fix gluebi NULL pointer dereference caused by ftl notifier (medium 5.5)
- [CVE-2023-52448](https://insights.sbomify.com/CVE-2023-52448/): gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (medium 5.5)
- [CVE-2023-52447](https://insights.sbomify.com/CVE-2023-52447/): bpf: Defer the free of inner map when necessary (high 7.8)
- [CVE-2023-52446](https://insights.sbomify.com/CVE-2023-52446/): bpf: Fix a race condition between btf_put() and map_free() (high 7.8)
- [CVE-2023-52445](https://insights.sbomify.com/CVE-2023-52445/): media: pvrusb2: fix use after free on context disconnection (high 7.8)
- [CVE-2023-52444](https://insights.sbomify.com/CVE-2023-52444/): f2fs: fix to avoid dirent corruption (high 7.8)
- [CVE-2023-52443](https://insights.sbomify.com/CVE-2023-52443/): apparmor: avoid crash when parsed profile name is empty (medium 5.5)
- [CVE-2023-52442](https://insights.sbomify.com/CVE-2023-52442/): ksmbd: validate session id and tree id in compound request (critical 9.1)
- [CVE-2023-52441](https://insights.sbomify.com/CVE-2023-52441/): ksmbd: fix out of bounds in init_smb2_rsp_hdr() (critical 9.1)
- [CVE-2023-52440](https://insights.sbomify.com/CVE-2023-52440/): ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() (critical 9.8)
- [CVE-2023-5244](https://insights.sbomify.com/CVE-2023-5244/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (medium 5.0)
- [CVE-2023-52439](https://insights.sbomify.com/CVE-2023-52439/): uio: Fix use-after-free in uio_open (high 7.8)
- [CVE-2023-52438](https://insights.sbomify.com/CVE-2023-52438/): binder: fix use-after-free in shinker's callback (high 7.8)
- [CVE-2023-52436](https://insights.sbomify.com/CVE-2023-52436/): f2fs: explicitly null-terminate the xattr list (high 7.8)
- [CVE-2023-52435](https://insights.sbomify.com/CVE-2023-52435/): net: prevent mss overflow in skb_segment() (medium 5.5)
- [CVE-2023-52434](https://insights.sbomify.com/CVE-2023-52434/): smb: client: fix potential OOBs in smb2_parse_contexts() (high 8.1)
- [CVE-2023-52433](https://insights.sbomify.com/CVE-2023-52433/): netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction (high 7.8)
- [CVE-2023-52432](https://insights.sbomify.com/CVE-2023-52432/): Memory corruption in Samsung Mobile Devices (medium 5.9)
- [CVE-2023-52431](https://insights.sbomify.com/CVE-2023-52431/): Cross-site request forgery in plack\:\ (high 8.8)
- [CVE-2023-52430](https://insights.sbomify.com/CVE-2023-52430/): caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting (medium 5.4)
- [CVE-2023-5243](https://insights.sbomify.com/CVE-2023-5243/): Login screen manager <= 3.5.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2023-52429](https://insights.sbomify.com/CVE-2023-52429/): Integer overflow in fedoraproject:fedora (medium 5.5)
- [CVE-2023-52428](https://insights.sbomify.com/CVE-2023-52428/): Denial of Service in Connect2id Nimbus JOSE+JWT (high 7.5)
- [CVE-2023-52427](https://insights.sbomify.com/CVE-2023-52427/): Denial of service in objectcomputing:opendds (high 7.5)
- [CVE-2023-52426](https://insights.sbomify.com/CVE-2023-52426/): XML external entity in libexpat project:libexpat (medium 5.5)
- [CVE-2023-52425](https://insights.sbomify.com/CVE-2023-52425/): Denial of service in libexpat project:libexpat (high 7.5)
- [CVE-2023-52424](https://insights.sbomify.com/CVE-2023-52424/): The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WE (high 7.4)
- [CVE-2023-5241](https://insights.sbomify.com/CVE-2023-5241/): Path traversal in WPBot – AI ChatBot for Live Support, Lead Generation, AI Services (critical 9.6)
- [CVE-2023-5240](https://insights.sbomify.com/CVE-2023-5240/): Missing authorization in Server (high 7.5)
- [CVE-2023-5239](https://insights.sbomify.com/CVE-2023-5239/): Security & Malware scan by CleanTalk < 2.121 - IP Spoofing (high 7.5)
- [CVE-2023-52389](https://insights.sbomify.com/CVE-2023-52389/): Integer overflow in pocoproject:poco (critical 9.8)
- [CVE-2023-52388](https://insights.sbomify.com/CVE-2023-52388/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52387](https://insights.sbomify.com/CVE-2023-52387/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-52386](https://insights.sbomify.com/CVE-2023-52386/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-52385](https://insights.sbomify.com/CVE-2023-52385/): Memory corruption in EMUI (medium 6.2)
- [CVE-2023-52384](https://insights.sbomify.com/CVE-2023-52384/): Memory corruption in EMUI (medium 4.7)
- [CVE-2023-52383](https://insights.sbomify.com/CVE-2023-52383/): Memory corruption in EMUI (medium 4.7)
- [CVE-2023-52381](https://insights.sbomify.com/CVE-2023-52381/): Code injection in EMUI (critical 9.8)
- [CVE-2023-52380](https://insights.sbomify.com/CVE-2023-52380/): Missing authorization in EMUI (medium 4.3)
- [CVE-2023-5238](https://insights.sbomify.com/CVE-2023-5238/): EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter (medium 6.1)
- [CVE-2023-52379](https://insights.sbomify.com/CVE-2023-52379/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52378](https://insights.sbomify.com/CVE-2023-52378/): Business logic in EMUI (critical 9.8)
- [CVE-2023-52377](https://insights.sbomify.com/CVE-2023-52377/): Memory corruption in EMUI (high 7.4)
- [CVE-2023-52376](https://insights.sbomify.com/CVE-2023-52376/): Information disclosure in EMUI (high 7.5)
- [CVE-2023-52375](https://insights.sbomify.com/CVE-2023-52375/): Missing authorization in EMUI (medium 5.5)
- [CVE-2023-52374](https://insights.sbomify.com/CVE-2023-52374/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52373](https://insights.sbomify.com/CVE-2023-52373/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52372](https://insights.sbomify.com/CVE-2023-52372/): Other in EMUI (high 7.5)
- [CVE-2023-52371](https://insights.sbomify.com/CVE-2023-52371/): Null dereference in EMUI (low 3.5)
- [CVE-2023-52370](https://insights.sbomify.com/CVE-2023-52370/): Memory corruption in EMUI (critical 9.8)
- [CVE-2023-5237](https://insights.sbomify.com/CVE-2023-5237/): Memberlite Shortcodes < 1.3.9 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2023-52369](https://insights.sbomify.com/CVE-2023-52369/): Memory corruption in EMUI (critical 9.1)
- [CVE-2023-52368](https://insights.sbomify.com/CVE-2023-52368/): Other in EMUI (medium 5.3)
- [CVE-2023-52367](https://insights.sbomify.com/CVE-2023-52367/): Missing authorization in EMUI (high 7.7)
- [CVE-2023-52366](https://insights.sbomify.com/CVE-2023-52366/): Memory corruption in EMUI (high 7.5)
- [CVE-2023-52365](https://insights.sbomify.com/CVE-2023-52365/): Memory corruption in EMUI (high 7.7)
- [CVE-2023-52364](https://insights.sbomify.com/CVE-2023-52364/): Memory corruption in EMUI (medium 6.3)
- [CVE-2023-52363](https://insights.sbomify.com/CVE-2023-52363/): Other in EMUI (medium 6.3)
- [CVE-2023-52362](https://insights.sbomify.com/CVE-2023-52362/): Misconfiguration in EMUI (high 7.5)
- [CVE-2023-52361](https://insights.sbomify.com/CVE-2023-52361/): Auth bypass in HarmonyOS (high 7.5)
- [CVE-2023-52360](https://insights.sbomify.com/CVE-2023-52360/): Business logic in EMUI (high 7.5)
- [CVE-2023-5236](https://insights.sbomify.com/CVE-2023-5236/): Infinispan: circular reference on marshalling leads to dos (medium 4.4)
- [CVE-2023-52359](https://insights.sbomify.com/CVE-2023-52359/): Missing authorization in EMUI (high 7.5)
- [CVE-2023-52358](https://insights.sbomify.com/CVE-2023-52358/): Misconfiguration in EMUI (medium 6.2)
- [CVE-2023-52357](https://insights.sbomify.com/CVE-2023-52357/): Deserialization in EMUI (medium 6.2)
- [CVE-2023-52356](https://insights.sbomify.com/CVE-2023-52356/): Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service (high 7.5)
- [CVE-2023-52355](https://insights.sbomify.com/CVE-2023-52355/): Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom (high 7.5)
- [CVE-2023-52354](https://insights.sbomify.com/CVE-2023-52354/): chasquid HTTP Request/Response Smuggling vulnerability (high 7.5)
- [CVE-2023-52353](https://insights.sbomify.com/CVE-2023-52353/): Security feature bypass in arm:mbed tls (high 7.5)
- [CVE-2023-52352](https://insights.sbomify.com/CVE-2023-52352/): Missing authorization in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 6.2)
- [CVE-2023-52351](https://insights.sbomify.com/CVE-2023-52351/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (high 7.8)
- [CVE-2023-52350](https://insights.sbomify.com/CVE-2023-52350/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-5235](https://insights.sbomify.com/CVE-2023-5235/): Ovic Responsive WPBakery < 1.2.9 - Subscriber+ Option Update (high 8.8)
- [CVE-2023-52349](https://insights.sbomify.com/CVE-2023-52349/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.6)
- [CVE-2023-52348](https://insights.sbomify.com/CVE-2023-52348/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-52347](https://insights.sbomify.com/CVE-2023-52347/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-52346](https://insights.sbomify.com/CVE-2023-52346/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2023-52345](https://insights.sbomify.com/CVE-2023-52345/): Denial of service in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 6.0)
- [CVE-2023-52344](https://insights.sbomify.com/CVE-2023-52344/): Null dereference in T760/T770/T820/S8000 (medium 5.3)
- [CVE-2023-52343](https://insights.sbomify.com/CVE-2023-52343/): Information disclosure in T760/T770/T820/S8000 (medium 5.5)
- [CVE-2023-52342](https://insights.sbomify.com/CVE-2023-52342/): Information disclosure in T760/T770/T820/S8000 (high 7.5)
- [CVE-2023-52341](https://insights.sbomify.com/CVE-2023-52341/): Missing authorization in T760/T770/T820/S8000 (high 7.5)
- [CVE-2023-52340](https://insights.sbomify.com/CVE-2023-52340/): Denial of service in linux:linux kernel (high 7.5)
- [CVE-2023-5234](https://insights.sbomify.com/CVE-2023-5234/): Related Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-52339](https://insights.sbomify.com/CVE-2023-52339/): Integer overflow in matroska:libebml (medium 6.5)
- [CVE-2023-52338](https://insights.sbomify.com/CVE-2023-52338/): Privilege escalation in Trend Micro Deep Security Agent (high 7.8)
- [CVE-2023-52337](https://insights.sbomify.com/CVE-2023-52337/): Privilege escalation in Trend Micro Deep Security Agent (high 7.8)
- [CVE-2023-52335](https://insights.sbomify.com/CVE-2023-52335/): Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-52334](https://insights.sbomify.com/CVE-2023-52334/): Allegra downloadAttachmentGlobal Directory Traversal Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-52333](https://insights.sbomify.com/CVE-2023-52333/): Allegra saveFile Directory Traversal Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2023-52332](https://insights.sbomify.com/CVE-2023-52332/): Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability (high 7.5)
- [CVE-2023-52331](https://insights.sbomify.com/CVE-2023-52331/): Server-side request forgery in Trend Micro Apex Central (high 7.1)
- [CVE-2023-52330](https://insights.sbomify.com/CVE-2023-52330/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)
- [CVE-2023-5233](https://insights.sbomify.com/CVE-2023-5233/): Font Awesome Integration <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2023-52329](https://insights.sbomify.com/CVE-2023-52329/): Cross-site scripting in Trend Micro Apex Central (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/161/