CVEs from 2023
Total
6,473
critical
critical 223
high
high 1,549
medium
medium 1,298
low
low 28
% Critical
3.4%
% with KEV
2.5%
% with exploit
3.0%
Top products
- office 29
- office_long_term_servicing_channel 15
- 365_apps 14
- registrationmagic 6
- codeready_linux_builder_for_ibm_z_systems_eus 6
- cbot_panel 6
- codeready_linux_builder_eus 6
- openstack_platform 6
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-6610 | high | — | 8.0 | 2y ago | An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel i… | |||
| CVE-2023-6536 | high | — | 8.0 | 2y ago | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to … | |||
| CVE-2023-6535 | high | — | 8.0 | 2y ago | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to … | |||
| CVE-2023-51042 | high | — | 8.0 | 2y ago | In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free. | |||
| CVE-2023-6356 | high | — | 8.0 | 2y ago | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to … | |||
| CVE-2023-5717 | high | — | 8.0 | 2y ago | A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called… | |||
| CVE-2023-6606 | high | — | 8.0 | 2y ago | An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel inform… | |||
| CVE-2023-46589 | high | — | 8.0 | 2y ago | Apache Tomcat Improper Input Validation vulnerability | |||
| CVE-2023-45230 | high | — | 8.0 | 2y ago | Important: edk2 security update | |||
| CVE-2023-41056 | high | — | 8.0 | 2y ago | Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code e… | |||
| CVE-2023-45234 | high | — | 8.0 | 2y ago | Important: edk2 security update | |||
| CVE-2023-50387 | high | — | 8.0 | 2y ago | Important: bind security update | |||
| CVE-2023-50868 | high | — | 8.0 | 2y ago | Important: bind security update | |||
| CVE-2023-4921 | high | — | 8.0 | 2y ago | A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sen… | |||
| CVE-2023-44444 | high | — | 8.0 | 2y ago | Important: gimp security update | |||
| CVE-2023-44442 | high | — | 8.0 | 2y ago | Important: gimp security update | |||
| CVE-2023-44441 | high | — | 8.0 | 2y ago | Important: gimp security update | |||
| CVE-2023-44443 | high | — | 8.0 | 2y ago | Important: gimp security update | |||
| CVE-2023-6679 | high | — | 8.0 | 2y ago | A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked Loop (DPLL) subsystem in the Linux kernel. This issue could… | |||
| CVE-2023-3777 | high | — | 8.0 | 2y ago | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is no… | |||
| CVE-2023-4015 | high | — | 8.0 | 2y ago | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating im… | |||
| CVE-2023-46813 | high | — | 8.0 | 2y ago | An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of… | |||
| CVE-2023-2166 | high | — | 8.0 | 2y ago | A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this… | |||
| CVE-2023-40283 | high | — | 8.0 | 2y ago | An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. | |||
| CVE-2023-2176 | high | — | 8.0 | 2y ago | A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize t… | |||
| CVE-2023-5633 | high | — | 8.0 | 2y ago | The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surfa… | |||
| CVE-2023-42753 | high | — | 8.0 | 2y ago | An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the pr… | |||
| CVE-2023-3812 | high | — | 8.0 | 2y ago | An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. Thi… | |||
| CVE-2023-5178 | high | — | 8.0 | 2y ago | A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious … | |||
| CVE-2023-4622 | high | — | 8.0 | 2y ago | A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb i… | |||
| CVE-2023-4623 | high | — | 8.0 | 2y ago | A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing… | |||
| CVE-2023-50447 | high | — | 8.0 | 2y ago | Important: python-pillow security update | |||
| CVE-2023-2162 | high | — | 8.0 | 2y ago | A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal info… | |||
| CVE-2023-46233 | high | — | 8.0 | 2y ago | crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard | |||
| CVE-2023-49286 | high | — | 8.0 | 2y ago | Important: squid security update | |||
| CVE-2023-46724 | high | — | 8.0 | 2y ago | Important: squid security update | |||
| CVE-2023-46728 | high | — | 8.0 | 2y ago | Important: squid security update | |||
| CVE-2023-49285 | high | — | 8.0 | 2y ago | Important: squid security update | |||
| CVE-2023-6864 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6862 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6867 | high | — | 8.0 | 2y ago | Important: firefox security update | |||
| CVE-2023-6858 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6861 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6856 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6863 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-50762 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6860 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6857 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6865 | high | — | 8.0 | 2y ago | Important: firefox security update | |||
| CVE-2023-50761 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-6859 | high | — | 8.0 | 2y ago | Important: thunderbird security update | |||
| CVE-2023-5869 | high | — | 8.0 | 3y ago | Important: postgresql:10 security update | |||
| CVE-2023-39417 | high | — | 8.0 | 3y ago | Important: postgresql:15 security update | |||
| CVE-2023-39418 | high | — | 8.0 | 3y ago | Important: postgresql:15 security update | |||
| CVE-2023-5868 | high | — | 8.0 | 3y ago | Important: postgresql:15 security update | |||
| CVE-2023-44429 | high | — | 8.0 | 3y ago | Important: gstreamer1-plugins-bad-free security update | |||
| CVE-2023-5870 | high | — | 8.0 | 3y ago | Important: postgresql:15 security update | |||
| CVE-2023-44446 | high | — | 8.0 | 3y ago | Important: gstreamer1-plugins-bad-free security update | |||
| CVE-2023-54170 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's assoc_array When making a DNS query inside the kernel using dns_query(), the req… | |||
| CVE-2023-45871 | high | — | 8.0 | 3y ago | An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. | |||
| CVE-2023-1192 | high | — | 8.0 | 3y ago | A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory re… | |||
| CVE-2023-53996 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, wh… | |||
| CVE-2023-5345 | high | — | 8.0 | 3y ago | A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password… | |||
| CVE-2023-53657 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: ice: Don't tx before switchdev is fully configured There is possibility that ice_eswitch_port_start_xmit might be called while so… | |||
| CVE-2023-5557 | high | — | 8.0 | 3y ago | Important: tracker-miners security update | |||
| CVE-2023-2163 | high | — | 8.0 | 3y ago | Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, … | |||
| CVE-2023-6206 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-6204 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-6212 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-6205 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-6209 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-6208 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-6207 | high | — | 8.0 | 3y ago | Important: firefox security update | |||
| CVE-2023-5824 | high | — | 8.0 | 3y ago | Important: squid security update | |||
| CVE-2023-49288 | high | — | 8.0 | 3y ago | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed… | |||
| CVE-2023-34058 | high | — | 8.0 | 3y ago | Important: open-vm-tools security update | |||
| CVE-2023-34059 | high | — | 8.0 | 3y ago | Important: open-vm-tools security update | |||
| CVE-2023-23455 | high | — | 8.0 | 3y ago | atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_S… | |||
| CVE-2023-28772 | high | — | 8.0 | 3y ago | An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. | |||
| CVE-2023-3611 | high | — | 8.0 | 3y ago | An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c a… | |||
| CVE-2023-28328 | high | — | 8.0 | 3y ago | A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into … | |||
| CVE-2023-39434 | high | — | 8.0 | 3y ago | Important: webkit2gtk3 security and bug fix update | |||
| CVE-2023-1118 | high | — | 8.0 | 3y ago | A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potent… | |||
| CVE-2023-39332 | high | — | 8.0 | 3y ago | Important: nodejs:20 security update | |||
| CVE-2023-4132 | high | — | 8.0 | 3y ago | A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user… | |||
| CVE-2023-31084 | high | — | 8.0 | 3y ago | An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interrup… | |||
| CVE-2023-31436 | high | — | 8.0 | 3y ago | qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. | |||
| CVE-2023-35824 | high | — | 8.0 | 3y ago | An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. | |||
| CVE-2023-4732 | high | — | 8.0 | 3y ago | A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG… | |||
| CVE-2023-35823 | high | — | 8.0 | 3y ago | An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. | |||
| CVE-2023-53366 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: block: be a bit more careful in checking for NULL bdev while polling Wei reports a crash with an application using polled IO: PG… | |||
| CVE-2023-53390 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: drivers: base: dd: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called o… | |||
| CVE-2023-53392 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix kernel panic during warm reset During warm reset device->fw_client is set to NULL. If a bus driver is reg… | |||
| CVE-2023-53121 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context tcp_rtx_synack() now could be called in process context as explained in… | |||
| CVE-2023-53120 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix config page DMA memory leak A fix for: DMA-API: pci 0000:83:00.0: device driver has pending DMA allocations wh… | |||
| CVE-2023-53197 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: USB: uhci: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, ot… | |||
| CVE-2023-53398 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use… | |||
| CVE-2023-53031 | high | — | 8.0 | 3y ago | In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Fix use of mutex in IRQs disabled section Current imc-pmu code triggers a WARNING with CONFIG_DEBUG_ATOMIC_SLEEP… | |||
| CVE-2023-3640 | high | — | 8.0 | 3y ago | A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important… | |||
| CVE-2023-3609 | high | — | 8.0 | 3y ago | A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediatel… |