# Vulnerabilities published in 2022


- [CVE-2022-50919](https://insights.sbomify.com/CVE-2022-50919/): Tdarr 2.00.15 - Command Injection (critical 9.3)
- [CVE-2022-50918](https://insights.sbomify.com/CVE-2022-50918/): VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path (high 8.5)
- [CVE-2022-50917](https://insights.sbomify.com/CVE-2022-50917/): ProtonVPN 1.26.0 - Unquoted Service Path (high 8.5)
- [CVE-2022-50916](https://insights.sbomify.com/CVE-2022-50916/): e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override (high 8.7)
- [CVE-2022-50915](https://insights.sbomify.com/CVE-2022-50915/): PTPublisher 2.3.4 - Unquoted Service Path (high 8.5)
- [CVE-2022-50914](https://insights.sbomify.com/CVE-2022-50914/): EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path (high 8.5)
- [CVE-2022-50913](https://insights.sbomify.com/CVE-2022-50913/): TCQ - 'ITeCProteccioAppServer.exe' Unquoted Service Path (high 8.5)
- [CVE-2022-50912](https://insights.sbomify.com/CVE-2022-50912/): ImpressCMS 1.4.4 - Unrestricted File Upload (critical 9.3)
- [CVE-2022-50910](https://insights.sbomify.com/CVE-2022-50910/): Beehive Forum - Account Takeover (high 8.5)
- [CVE-2022-50909](https://insights.sbomify.com/CVE-2022-50909/): Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated) (high 8.6)
- [CVE-2022-50908](https://insights.sbomify.com/CVE-2022-50908/): Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS) (medium 5.1)
- [CVE-2022-50907](https://insights.sbomify.com/CVE-2022-50907/): e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE (high 8.6)
- [CVE-2022-50906](https://insights.sbomify.com/CVE-2022-50906/): e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS (medium 4.8)
- [CVE-2022-50905](https://insights.sbomify.com/CVE-2022-50905/): e107 CMS v3.2.1 - Reflected XSS via Comment Flow (medium 6.1)
- [CVE-2022-50904](https://insights.sbomify.com/CVE-2022-50904/): Wondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service Path (high 8.5)
- [CVE-2022-50903](https://insights.sbomify.com/CVE-2022-50903/): Wondershare MobileTrans 3.5.9 - 'ElevationService' Unquoted Service Path (high 8.5)
- [CVE-2022-50902](https://insights.sbomify.com/CVE-2022-50902/): Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path (high 8.5)
- [CVE-2022-50901](https://insights.sbomify.com/CVE-2022-50901/): Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path (high 8.5)
- [CVE-2022-50900](https://insights.sbomify.com/CVE-2022-50900/): Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path (high 8.5)
- [CVE-2022-50899](https://insights.sbomify.com/CVE-2022-50899/): Geonetwork 4.2.0 - XML External Entity (XXE) (high 8.7)
- [CVE-2022-50898](https://insights.sbomify.com/CVE-2022-50898/): NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated) (high 8.6)
- [CVE-2022-50897](https://insights.sbomify.com/CVE-2022-50897/): mPDF 7.0 - Local File Inclusion (high 8.7)
- [CVE-2022-50896](https://insights.sbomify.com/CVE-2022-50896/): Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS) (medium 5.1)
- [CVE-2022-50895](https://insights.sbomify.com/CVE-2022-50895/): Aero CMS 0.0.1 - SQL Injection (high 8.8)
- [CVE-2022-50894](https://insights.sbomify.com/CVE-2022-50894/): VIAVIWEB Wallpaper Admin 1.0 SQL Injection via edit_gallery_image.php (high 7.1)
- [CVE-2022-50893](https://insights.sbomify.com/CVE-2022-50893/): VIAVIWEB Wallpaper Admin 1.0 - Code Execution via Image Upload (critical 9.3)
- [CVE-2022-50892](https://insights.sbomify.com/CVE-2022-50892/): VIAVIWEB Wallpaper Admin 1.0 - SQL Injection via Login Page (high 8.8)
- [CVE-2022-50891](https://insights.sbomify.com/CVE-2022-50891/): Owlfiles File Manager 12.0.1 Cross-Site Scripting via HTTP Server (medium 5.1)
- [CVE-2022-50890](https://insights.sbomify.com/CVE-2022-50890/): Owlfiles File Manager 12.0.1 - Path Traversal (high 8.7)
- [CVE-2022-50889](https://insights.sbomify.com/CVE-2022-50889/): dm integrity: Fix UAF in dm_integrity_dtr() (not scored)
- [CVE-2022-50888](https://insights.sbomify.com/CVE-2022-50888/): remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() (not scored)
- [CVE-2022-50887](https://insights.sbomify.com/CVE-2022-50887/): regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (not scored)
- [CVE-2022-50886](https://insights.sbomify.com/CVE-2022-50886/): mmc: toshsd: fix return value check of mmc_add_host() (not scored)
- [CVE-2022-50885](https://insights.sbomify.com/CVE-2022-50885/): RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (high 7.5)
- [CVE-2022-50884](https://insights.sbomify.com/CVE-2022-50884/): drm: Prevent drm_copy_field() to attempt copying a NULL pointer (not scored)
- [CVE-2022-50883](https://insights.sbomify.com/CVE-2022-50883/): bpf: Prevent decl_tag from being referenced in func_proto arg (not scored)
- [CVE-2022-50882](https://insights.sbomify.com/CVE-2022-50882/): media: uvcvideo: Fix memory leak in uvc_gpio_parse (not scored)
- [CVE-2022-50881](https://insights.sbomify.com/CVE-2022-50881/): wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() (not scored)
- [CVE-2022-50880](https://insights.sbomify.com/CVE-2022-50880/): wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (high 8.8)
- [CVE-2022-50879](https://insights.sbomify.com/CVE-2022-50879/): objtool: Fix SEGFAULT (not scored)
- [CVE-2022-50878](https://insights.sbomify.com/CVE-2022-50878/): gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() (not scored)
- [CVE-2022-50877](https://insights.sbomify.com/CVE-2022-50877/): net: broadcom: bcm4908_enet: update TX stats after actual transmission (not scored)
- [CVE-2022-50876](https://insights.sbomify.com/CVE-2022-50876/): usb: musb: Fix musb_gadget.c rxstate overflow bug (not scored)
- [CVE-2022-50875](https://insights.sbomify.com/CVE-2022-50875/): of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() (not scored)
- [CVE-2022-50874](https://insights.sbomify.com/CVE-2022-50874/): RDMA/erdma: Fix refcount leak in erdma_mmap (not scored)
- [CVE-2022-50873](https://insights.sbomify.com/CVE-2022-50873/): vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove (not scored)
- [CVE-2022-50872](https://insights.sbomify.com/CVE-2022-50872/): ARM: OMAP2+: Fix memory leak in realtime_counter_init() (not scored)
- [CVE-2022-50871](https://insights.sbomify.com/CVE-2022-50871/): wifi: ath11k: Fix qmi_msg_handler data structure initialization (high 7.8)
- [CVE-2022-50870](https://insights.sbomify.com/CVE-2022-50870/): powerpc/rtas: avoid device tree lookups in rtas_os_term() (not scored)
- [CVE-2022-50869](https://insights.sbomify.com/CVE-2022-50869/): fs/ntfs3: Fix slab-out-of-bounds in r_page (high 7.8)
- [CVE-2022-50868](https://insights.sbomify.com/CVE-2022-50868/): hwrng: amd - Fix PCI device refcount leak (not scored)
- [CVE-2022-50867](https://insights.sbomify.com/CVE-2022-50867/): drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usage (high 7.8)
- [CVE-2022-50866](https://insights.sbomify.com/CVE-2022-50866/): ASoC: pxa: fix null-pointer dereference in filter() (not scored)
- [CVE-2022-50865](https://insights.sbomify.com/CVE-2022-50865/): tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (high 7.5)
- [CVE-2022-50864](https://insights.sbomify.com/CVE-2022-50864/): nilfs2: fix shift-out-of-bounds due to too large exponent of block size (not scored)
- [CVE-2022-50863](https://insights.sbomify.com/CVE-2022-50863/): wifi: rtw89: free unused skb to prevent memory leak (not scored)
- [CVE-2022-50862](https://insights.sbomify.com/CVE-2022-50862/): bpf: prevent decl_tag from being referenced in func_proto (not scored)
- [CVE-2022-50861](https://insights.sbomify.com/CVE-2022-50861/): NFSD: Finish converting the NFSv2 GETACL result encoder (high 7.5)
- [CVE-2022-50860](https://insights.sbomify.com/CVE-2022-50860/): apparmor: Fix memleak in alloc_ns() (high 7.8)
- [CVE-2022-50859](https://insights.sbomify.com/CVE-2022-50859/): cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message (not scored)
- [CVE-2022-50858](https://insights.sbomify.com/CVE-2022-50858/): mmc: alcor: fix return value check of mmc_add_host() (not scored)
- [CVE-2022-50857](https://insights.sbomify.com/CVE-2022-50857/): rapidio: rio: fix possible name leak in rio_register_mport() (not scored)
- [CVE-2022-50856](https://insights.sbomify.com/CVE-2022-50856/): cifs: Fix xid leak in cifs_ses_add_channel() (not scored)
- [CVE-2022-50855](https://insights.sbomify.com/CVE-2022-50855/): bpf: prevent leak of lsm program after failed attach (not scored)
- [CVE-2022-50854](https://insights.sbomify.com/CVE-2022-50854/): nfc: virtual_ncidev: Fix memory leak in virtual_nci_send() (not scored)
- [CVE-2022-50853](https://insights.sbomify.com/CVE-2022-50853/): NFSv4: Fix a credential leak in _nfs4_discover_trunking() (not scored)
- [CVE-2022-50852](https://insights.sbomify.com/CVE-2022-50852/): wifi: mt76: mt7921: fix use after free in mt7921_acpi_read() (not scored)
- [CVE-2022-50851](https://insights.sbomify.com/CVE-2022-50851/): vhost_vdpa: fix the crash in unmap a large memory (not scored)
- [CVE-2022-50850](https://insights.sbomify.com/CVE-2022-50850/): scsi: ipr: Fix WARNING in ipr_init() (not scored)
- [CVE-2022-50849](https://insights.sbomify.com/CVE-2022-50849/): pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP (not scored)
- [CVE-2022-50848](https://insights.sbomify.com/CVE-2022-50848/): drivers: dio: fix possible memory leak in dio_init() (not scored)
- [CVE-2022-50847](https://insights.sbomify.com/CVE-2022-50847/): drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe (not scored)
- [CVE-2022-50846](https://insights.sbomify.com/CVE-2022-50846/): mmc: via-sdmmc: fix return value check of mmc_add_host() (not scored)
- [CVE-2022-50845](https://insights.sbomify.com/CVE-2022-50845/): ext4: fix inode leak in ext4_xattr_inode_create() on an error path (not scored)
- [CVE-2022-50844](https://insights.sbomify.com/CVE-2022-50844/): drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback (not scored)
- [CVE-2022-50843](https://insights.sbomify.com/CVE-2022-50843/): dm clone: Fix UAF in clone_dtr() (not scored)
- [CVE-2022-50842](https://insights.sbomify.com/CVE-2022-50842/): drm/virtio: Check whether transferred 2D BO is shmem (not scored)
- [CVE-2022-50841](https://insights.sbomify.com/CVE-2022-50841/): fs/ntfs3: Add overflow check for attribute size (high 7.8)
- [CVE-2022-50840](https://insights.sbomify.com/CVE-2022-50840/): scsi: snic: Fix possible UAF in snic_tgt_create() (not scored)
- [CVE-2022-50839](https://insights.sbomify.com/CVE-2022-50839/): jbd2: fix potential buffer head reference count leak (not scored)
- [CVE-2022-50838](https://insights.sbomify.com/CVE-2022-50838/): net: stream: purge sk_error_queue in sk_stream_kill_queues() (not scored)
- [CVE-2022-50837](https://insights.sbomify.com/CVE-2022-50837/): net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path (not scored)
- [CVE-2022-50836](https://insights.sbomify.com/CVE-2022-50836/): remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() (not scored)
- [CVE-2022-50835](https://insights.sbomify.com/CVE-2022-50835/): jbd2: add miss release buffer head in fc_do_one_pass() (not scored)
- [CVE-2022-50834](https://insights.sbomify.com/CVE-2022-50834/): nfc: Fix potential resource leaks (not scored)
- [CVE-2022-50833](https://insights.sbomify.com/CVE-2022-50833/): Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works (not scored)
- [CVE-2022-50832](https://insights.sbomify.com/CVE-2022-50832/): wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() (not scored)
- [CVE-2022-50830](https://insights.sbomify.com/CVE-2022-50830/): auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() (not scored)
- [CVE-2022-50829](https://insights.sbomify.com/CVE-2022-50829/): wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() (not scored)
- [CVE-2022-50828](https://insights.sbomify.com/CVE-2022-50828/): clk: zynqmp: Fix stack-out-of-bounds in strncpy` (not scored)
- [CVE-2022-50827](https://insights.sbomify.com/CVE-2022-50827/): scsi: lpfc: Fix memory leak in lpfc_create_port() (not scored)
- [CVE-2022-50826](https://insights.sbomify.com/CVE-2022-50826/): ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection() (not scored)
- [CVE-2022-50825](https://insights.sbomify.com/CVE-2022-50825/): usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() (not scored)
- [CVE-2022-50824](https://insights.sbomify.com/CVE-2022-50824/): tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak (not scored)
- [CVE-2022-50823](https://insights.sbomify.com/CVE-2022-50823/): clk: tegra: Fix refcount leak in tegra114_clock_init (not scored)
- [CVE-2022-50822](https://insights.sbomify.com/CVE-2022-50822/): RDMA/restrack: Release MR restrack when delete (high 7.8)
- [CVE-2022-50821](https://insights.sbomify.com/CVE-2022-50821/): SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails (not scored)
- [CVE-2022-50820](https://insights.sbomify.com/CVE-2022-50820/): perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() (not scored)
- [CVE-2022-50819](https://insights.sbomify.com/CVE-2022-50819/): udmabuf: Set ubuf->sg = NULL if the creation of sg table fails (not scored)
- [CVE-2022-50818](https://insights.sbomify.com/CVE-2022-50818/): scsi: pm8001: Fix running_req for internal abort commands (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/170/