2023 CVEs (page 14)
Page 14 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-53171 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of locked_vm via exec() When a vfio container is preserved… |
CVE-2023-53170 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: Removed unneeded of_node_put in felix_parse_ports_node Remove unnecessary of_no… |
CVE-2023-53169 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear staged_config[] before and after it is used As a temporary storage, st… |
CVE-2023-53168 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec… |
CVE-2023-53167 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix null pointer dereference in tracing_err_log_open() Fix an issue in function… |
CVE-2023-53166 | Medium | 4.7 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix external_power_changed race bq25890_charger_external_power_ch… |
CVE-2023-53165 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . an… |
CVE-2023-53164 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe of_irq_find_parent() re… |
CVE-2023-53163 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: don't hold ni_lock when calling truncate_setsize() syzbot is reporting hung tas… |
CVE-2023-53153 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset… |
CVE-2023-53152 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini The following call trace is observ… |
CVE-2023-53151 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/… |
CVE-2023-53150 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returne… |
CVE-2023-53149 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid deadlock in fs reclaim with page writeback Ext4 has a filesystem wide lock pr… |
CVE-2023-53148 | High | 7.8 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to… |
CVE-2023-53147 | Medium | 5.5 | 2025-09-15 | In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn… |
CVE-2023-31365 | Low | 3.9 | 2025-09-06 | An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of inte… |
CVE-2023-31351 | Medium | 5.3 | 2025-09-06 | Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integrity. |
CVE-2023-31330 | Low | 2.5 | 2025-09-06 | An out-of-bounds read in the ASP could allow a privileged attacker with access to a malicious bootloader to potentially read sensitive memory resulting in loss… |
CVE-2023-31326 | Low | 2.8 | 2025-09-06 | Use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driver, potentially lead… |
CVE-2023-31325 | High | 7.2 | 2025-09-06 | Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reserved DRAM region potent… |
CVE-2023-31322 | High | 8.7 | 2025-09-06 | Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted application (RAS TA… |
CVE-2023-31306 | Low | 3.3 | 2025-09-06 | Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic power management (… |
CVE-2023-20516 | Low | 3.3 | 2025-09-06 | Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentially resulting in… |
CVE-2023-35657 | Medium | 4.0 | 2025-09-04 | In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead to local information disclosure with no a… |
CVE-2023-3666 | Low | 3.3 | 2025-09-03 | The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-21483 | Medium | 6.4 | 2025-09-03 | Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exported service. |
CVE-2023-21482 | Medium | 6.1 | 2025-09-03 | Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical… |
CVE-2023-21481 | Medium | 5.4 | 2025-09-03 | Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information. |
CVE-2023-21480 | High | 8.5 | 2025-09-03 | Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities. |
CVE-2023-21479 | Medium | 5.3 | 2025-09-03 | Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a sche… |
CVE-2023-21478 | Medium | 6.0 | 2025-09-03 | Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21477 | High | 7.9 | 2025-09-03 | Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. |
CVE-2023-21476 | High | 8.0 | 2025-09-03 | Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-21475 | High | 8.0 | 2025-09-03 | Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-21474 | Medium | 6.3 | 2025-09-03 | Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege. |
CVE-2023-21473 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21472 | Medium | 6.8 | 2025-09-03 | Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary code in bootloader. |
CVE-2023-21471 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system permission. |
CVE-2023-21470 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung… |
CVE-2023-21469 | Medium | 4.0 | 2025-09-03 | Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information using com.samsung… |
CVE-2023-21468 | Medium | 5.9 | 2025-09-03 | Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permission. |
CVE-2023-21467 | Medium | 4.6 | 2025-09-03 | Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message. |
CVE-2023-21466 | Medium | 5.3 | 2025-09-03 | PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access contentProvider withou… |
CVE-2023-41471 | High | 7.8 | 2025-08-29 | Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS funct… |
CVE-2023-7309 | | 2025-08-27 | A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management… | |
CVE-2023-7308 | High | 7.5 | 2025-08-27 | SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet… |
CVE-2023-7307 | | 2025-08-27 | Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection… | |
CVE-2023-21125 | High | 8.0 | 2025-08-26 | In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege… |
CVE-2023-47799 | High | 7.5 | 2025-08-25 | Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or vi… |
CVE-2023-4515 | Critical | 9.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command pay… |
CVE-2023-4130 | High | 8.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple… |
CVE-2023-3867 | Critical | 9.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that… |
CVE-2023-3866 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate sessio… |
CVE-2023-3865 | High | 8.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bound read in smb2_write ksmbd_smb2_check_message doesn't validate hdr-… |
CVE-2023-32249 | Critical | 9.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if bin… |
CVE-2023-32246 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: call rcu_barrier() in ksmbd_server_exit() racy issue is triggered the bug by racin… |
CVE-2023-43687 | Medium | 6.5 | 2025-08-14 | An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). There is a Race condition that leads to code… |
CVE-2023-43692 | High | 7.5 | 2025-08-14 | An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). Out-of-bound reads in strings detection utili… |
CVE-2023-43683 | Medium | 6.5 | 2025-08-14 | An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). A Stack buffer out-of-bounds access exists because o… |
CVE-2023-43694 | Medium | 5.2 | 2025-08-14 | An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). An Out of bounds read in several disa… |
CVE-2023-5342 | Medium | 4.1 | 2025-08-14 | The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded. |
CVE-2023-45584 | Medium | 6.6 | 2025-08-12 | A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versi… |
CVE-2023-41532 | High | 8.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php. |
CVE-2023-41531 | High | 8.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 parameters. |
CVE-2023-41530 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php. |
CVE-2023-41529 | Medium | 6.1 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters. |
CVE-2023-41528 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters. |
CVE-2023-41527 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php. |
CVE-2023-41526 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters. |
CVE-2023-41525 | Critical | 9.8 | 2025-08-07 | Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php. |
CVE-2023-41524 | High | 8.8 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php. |
CVE-2023-41523 | High | 8.8 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php. |
CVE-2023-41522 | High | 8.8 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admis… |
CVE-2023-41521 | High | 8.8 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessi… |
CVE-2023-41520 | High | 8.8 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmNam… |
CVE-2023-41519 | Medium | 6.1 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm… |
CVE-2023-40992 | Medium | 6.5 | 2025-08-07 | Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter. |
CVE-2023-32255 | Medium | 5.3 | 2025-08-02 | A flaw was found in the Linux kernel's ksmbd component. A memory leak can occur if a client sends a session setup request with an unknown NTLMSSP message type… |
CVE-2023-32253 | Medium | 5.9 | 2025-08-02 | A flaw was found in the Linux kernel's ksmbd component. A deadlock is triggered by sending multiple concurrent session setup requests, possibly leading to a de… |
CVE-2023-32256 | High | 7.5 | 2025-08-01 | A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a… |
CVE-2023-44976 | Low | 3.2 | 2025-08-01 | Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with… |
CVE-2023-32251 | Low | 3.7 | 2025-07-31 | A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks… |
CVE-2023-2593 | Medium | 5.9 | 2025-07-30 | A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This v… |
CVE-2023-53161 | Low | 2.9 | 2025-07-28 | The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic. |
CVE-2023-53160 | Low | 2.9 | 2025-07-28 | The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic. |
CVE-2023-53159 | Medium | 4.5 | 2025-07-28 | The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host. |
CVE-2023-53158 | Medium | 4.1 | 2025-07-28 | The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered… |
CVE-2023-53157 | Medium | 5.3 | 2025-07-28 | The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet. |
CVE-2023-53156 | Medium | 4.5 | 2025-07-27 | The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments. |
CVE-2023-53155 | High | 7.2 | 2025-07-25 | goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter. |
CVE-2023-7306 | High | 7.5 | 2025-07-25 | The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_… |
CVE-2023-47356 | High | 8.8 | 2025-07-17 | Mingyu Security Gateway before v3.0-5.3p was discovered to contain a remote command execution (RCE) vulnerability via the log_type parameter at /log/fw_securit… |
CVE-2023-41566 | High | 8.1 | 2025-07-17 | OA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. This vulnerability allows attacker… |
CVE-2023-39339 | Medium | 4.9 | 2025-07-12 | A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a malic… |
CVE-2023-39338 | Medium | 6.8 | 2025-07-12 | Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to acces… |
CVE-2023-38036 | Critical | 9.8 | 2025-07-12 | A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could resu… |
CVE-2023-38329 | Medium | 6.1 | 2025-07-11 | An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthe… |
CVE-2023-38327 | Medium | 5.3 | 2025-07-11 | An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote a… |
CVE-2023-50458 | Low | 3.5 | 2025-07-10 | In Dradis before 4.11.0, the Output Console shows a job queue that may contain information about other users' jobs. |