# Vulnerabilities published in 2022


- [CVE-2022-50817](https://insights.sbomify.com/CVE-2022-50817/): net: hsr: avoid possible NULL deref in skb_clone() (not scored)
- [CVE-2022-50816](https://insights.sbomify.com/CVE-2022-50816/): ipv6: ensure sane device mtu in tunnels (not scored)
- [CVE-2022-50815](https://insights.sbomify.com/CVE-2022-50815/): ext2: Add sanity checks for group and filesystem size (not scored)
- [CVE-2022-50814](https://insights.sbomify.com/CVE-2022-50814/): crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr (not scored)
- [CVE-2022-50813](https://insights.sbomify.com/CVE-2022-50813/): drivers: mcb: fix resource leak in mcb_probe() (not scored)
- [CVE-2022-50812](https://insights.sbomify.com/CVE-2022-50812/): security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6 (not scored)
- [CVE-2022-50811](https://insights.sbomify.com/CVE-2022-50811/): erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails (not scored)
- [CVE-2022-50810](https://insights.sbomify.com/CVE-2022-50810/): rapidio: devices: fix missing put_device in mport_cdev_open (not scored)
- [CVE-2022-50809](https://insights.sbomify.com/CVE-2022-50809/): xhci: dbc: Fix memory leak in xhci_alloc_dbc() (not scored)
- [CVE-2022-50808](https://insights.sbomify.com/CVE-2022-50808/): CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path (high 8.5)
- [CVE-2022-50806](https://insights.sbomify.com/CVE-2022-50806/): 4images 1.9 - Remote Command Execution (RCE) (high 8.6)
- [CVE-2022-50805](https://insights.sbomify.com/CVE-2022-50805/): Senayan Library Management System 9.0.0 - SQL Injection (high 8.8)
- [CVE-2022-50804](https://insights.sbomify.com/CVE-2022-50804/): JM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) Vulnerability (medium 5.1)
- [CVE-2022-50803](https://insights.sbomify.com/CVE-2022-50803/): JM-DATA ONU JF511-TV 1.0.67 Default Credentials Vulnerability (critical 9.3)
- [CVE-2022-50802](https://insights.sbomify.com/CVE-2022-50802/): ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter (medium 5.1)
- [CVE-2022-50801](https://insights.sbomify.com/CVE-2022-50801/): JM-DATA ONU JF511-TV 1.0.67 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability (medium 5.1)
- [CVE-2022-50800](https://insights.sbomify.com/CVE-2022-50800/): H3C SSL VPN n/a Username Enumeration via Login Script Credential Verification (medium 6.9)
- [CVE-2022-50799](https://insights.sbomify.com/CVE-2022-50799/): Fetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of Service (high 7.1)
- [CVE-2022-50797](https://insights.sbomify.com/CVE-2022-50797/): Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings (medium 5.1)
- [CVE-2022-50796](https://insights.sbomify.com/CVE-2022-50796/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi (critical 9.3)
- [CVE-2022-50795](https://insights.sbomify.com/CVE-2022-50795/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php (high 8.5)
- [CVE-2022-50794](https://insights.sbomify.com/CVE-2022-50794/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username (critical 9.3)
- [CVE-2022-50793](https://insights.sbomify.com/CVE-2022-50793/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.php (high 8.7)
- [CVE-2022-50792](https://insights.sbomify.com/CVE-2022-50792/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated File Disclosure Vulnerability (high 8.7)
- [CVE-2022-50791](https://insights.sbomify.com/CVE-2022-50791/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.php (high 8.5)
- [CVE-2022-50790](https://insights.sbomify.com/CVE-2022-50790/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Radio Stream Disclosure (medium 6.9)
- [CVE-2022-50789](https://insights.sbomify.com/CVE-2022-50789/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.php (high 8.5)
- [CVE-2022-50788](https://insights.sbomify.com/CVE-2022-50788/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log Directory (medium 6.9)
- [CVE-2022-50787](https://insights.sbomify.com/CVE-2022-50787/): SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Stored Cross-Site Scripting (medium 5.3)
- [CVE-2022-50786](https://insights.sbomify.com/CVE-2022-50786/): media: s5p-mfc: Clear workbit to handle error condition (not scored)
- [CVE-2022-50785](https://insights.sbomify.com/CVE-2022-50785/): fsi: occ: Prevent use after free (high 7.8)
- [CVE-2022-50784](https://insights.sbomify.com/CVE-2022-50784/): wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone (not scored)
- [CVE-2022-50783](https://insights.sbomify.com/CVE-2022-50783/): mptcp: use proper req destructor for IPv6 (not scored)
- [CVE-2022-50782](https://insights.sbomify.com/CVE-2022-50782/): ext4: fix bug_on in __es_tree_search caused by bad quota inode (not scored)
- [CVE-2022-50781](https://insights.sbomify.com/CVE-2022-50781/): amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() (not scored)
- [CVE-2022-50780](https://insights.sbomify.com/CVE-2022-50780/): net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (high 7.8)
- [CVE-2022-50779](https://insights.sbomify.com/CVE-2022-50779/): orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() (not scored)
- [CVE-2022-50778](https://insights.sbomify.com/CVE-2022-50778/): fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL (not scored)
- [CVE-2022-50777](https://insights.sbomify.com/CVE-2022-50777/): net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (not scored)
- [CVE-2022-50776](https://insights.sbomify.com/CVE-2022-50776/): clk: st: Fix memory leak in st_of_quadfs_setup() (not scored)
- [CVE-2022-50775](https://insights.sbomify.com/CVE-2022-50775/): RDMA/hns: Fix refcount leak in hns_roce_mmap (not scored)
- [CVE-2022-50774](https://insights.sbomify.com/CVE-2022-50774/): crypto: qat - fix DMA transfer direction (not scored)
- [CVE-2022-50773](https://insights.sbomify.com/CVE-2022-50773/): ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt (not scored)
- [CVE-2022-50772](https://insights.sbomify.com/CVE-2022-50772/): netdevsim: fix memory leak in nsim_bus_dev_new() (not scored)
- [CVE-2022-50771](https://insights.sbomify.com/CVE-2022-50771/): rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() (not scored)
- [CVE-2022-50770](https://insights.sbomify.com/CVE-2022-50770/): ocfs2: fix memory leak in ocfs2_mount_volume() (not scored)
- [CVE-2022-50769](https://insights.sbomify.com/CVE-2022-50769/): mmc: mxcmmc: fix return value check of mmc_add_host() (not scored)
- [CVE-2022-50768](https://insights.sbomify.com/CVE-2022-50768/): scsi: smartpqi: Correct device removal for multi-actuator devices (not scored)
- [CVE-2022-50767](https://insights.sbomify.com/CVE-2022-50767/): fbdev: smscufx: Fix several use-after-free bugs (not scored)
- [CVE-2022-50766](https://insights.sbomify.com/CVE-2022-50766/): btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer (not scored)
- [CVE-2022-50765](https://insights.sbomify.com/CVE-2022-50765/): RISC-V: kexec: Fix memory leak of elf header buffer (not scored)
- [CVE-2022-50764](https://insights.sbomify.com/CVE-2022-50764/): ipv6/sit: use DEV_STATS_INC() to avoid data-races (not scored)
- [CVE-2022-50763](https://insights.sbomify.com/CVE-2022-50763/): crypto: marvell/octeontx - prevent integer overflows (not scored)
- [CVE-2022-50762](https://insights.sbomify.com/CVE-2022-50762/): fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() (not scored)
- [CVE-2022-50761](https://insights.sbomify.com/CVE-2022-50761/): x86/xen: Fix memory leak in xen_init_lock_cpu() (not scored)
- [CVE-2022-50760](https://insights.sbomify.com/CVE-2022-50760/): drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (not scored)
- [CVE-2022-50759](https://insights.sbomify.com/CVE-2022-50759/): media: i2c: ov5648: Free V4L2 fwnode data on unbind (not scored)
- [CVE-2022-50758](https://insights.sbomify.com/CVE-2022-50758/): staging: vt6655: fix potential memory leak (high 7.8)
- [CVE-2022-50757](https://insights.sbomify.com/CVE-2022-50757/): media: camss: Clean up received buffers on failed start of streaming (high 7.8)
- [CVE-2022-50756](https://insights.sbomify.com/CVE-2022-50756/): nvme-pci: fix mempool alloc size (high 7.8)
- [CVE-2022-50755](https://insights.sbomify.com/CVE-2022-50755/): udf: Avoid double brelse() in udf_rename() (high 7.8)
- [CVE-2022-50754](https://insights.sbomify.com/CVE-2022-50754/): apparmor: fix a memleak in multi_transaction_new() (not scored)
- [CVE-2022-50753](https://insights.sbomify.com/CVE-2022-50753/): f2fs: fix to do sanity check on summary info (high 7.8)
- [CVE-2022-50752](https://insights.sbomify.com/CVE-2022-50752/): md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() (high 7.8)
- [CVE-2022-50751](https://insights.sbomify.com/CVE-2022-50751/): configfs: fix possible memory leak in configfs_create_dir() (not scored)
- [CVE-2022-50750](https://insights.sbomify.com/CVE-2022-50750/): drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure (high 7.8)
- [CVE-2022-50749](https://insights.sbomify.com/CVE-2022-50749/): acct: fix potential integer overflow in encode_comp_t() (not scored)
- [CVE-2022-50748](https://insights.sbomify.com/CVE-2022-50748/): ipc: mqueue: fix possible memory leak in init_mqueue_fs() (not scored)
- [CVE-2022-50747](https://insights.sbomify.com/CVE-2022-50747/): hfs: Fix OOB Write in hfs_asc2mac (high 7.8)
- [CVE-2022-50746](https://insights.sbomify.com/CVE-2022-50746/): erofs: validate the extent length for uncompressed pclusters (high 8.4)
- [CVE-2022-50745](https://insights.sbomify.com/CVE-2022-50745/): staging: media: tegra-video: fix device_node use after free (high 7.8)
- [CVE-2022-50744](https://insights.sbomify.com/CVE-2022-50744/): scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs (not scored)
- [CVE-2022-50743](https://insights.sbomify.com/CVE-2022-50743/): erofs: Fix pcluster memleak when its block address is zero (not scored)
- [CVE-2022-50742](https://insights.sbomify.com/CVE-2022-50742/): misc: ocxl: fix possible refcount leak in afu_ioctl() (not scored)
- [CVE-2022-50741](https://insights.sbomify.com/CVE-2022-50741/): media: imx-jpeg: Disable useless interrupt to avoid kernel panic (not scored)
- [CVE-2022-50740](https://insights.sbomify.com/CVE-2022-50740/): wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (not scored)
- [CVE-2022-50739](https://insights.sbomify.com/CVE-2022-50739/): fs/ntfs3: Add null pointer check for inode operations (not scored)
- [CVE-2022-50738](https://insights.sbomify.com/CVE-2022-50738/): vhost-vdpa: fix an iotlb memory leak (not scored)
- [CVE-2022-50737](https://insights.sbomify.com/CVE-2022-50737/): fs/ntfs3: Validate index root when initialize NTFS security (high 7.8)
- [CVE-2022-50736](https://insights.sbomify.com/CVE-2022-50736/): RDMA/siw: Fix immediate work request flush to completion queue (high 7.1)
- [CVE-2022-50735](https://insights.sbomify.com/CVE-2022-50735/): wifi: mt76: do not run mt76u_status_worker if the device is not running (not scored)
- [CVE-2022-50734](https://insights.sbomify.com/CVE-2022-50734/): nvmem: core: Fix memleak in nvmem_register() (not scored)
- [CVE-2022-50733](https://insights.sbomify.com/CVE-2022-50733/): usb: idmouse: fix an uninit-value in idmouse_open (not scored)
- [CVE-2022-50732](https://insights.sbomify.com/CVE-2022-50732/): staging: rtl8192u: Fix use after free in ieee80211_rx() (high 8.8)
- [CVE-2022-50731](https://insights.sbomify.com/CVE-2022-50731/): crypto: akcipher - default implementation for setting a private key (not scored)
- [CVE-2022-50730](https://insights.sbomify.com/CVE-2022-50730/): ext4: silence the warning when evicting inode with dioread_nolock (not scored)
- [CVE-2022-50729](https://insights.sbomify.com/CVE-2022-50729/): ksmbd: Fix resource leak in ksmbd_session_rpc_open() (not scored)
- [CVE-2022-50728](https://insights.sbomify.com/CVE-2022-50728/): s390/lcs: Fix return type of lcs_start_xmit() (not scored)
- [CVE-2022-50727](https://insights.sbomify.com/CVE-2022-50727/): scsi: efct: Fix possible memleak in efct_device_init() (not scored)
- [CVE-2022-50726](https://insights.sbomify.com/CVE-2022-50726/): net/mlx5: Fix possible use-after-free in async command interface (high 7.8)
- [CVE-2022-50725](https://insights.sbomify.com/CVE-2022-50725/): media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() (not scored)
- [CVE-2022-50724](https://insights.sbomify.com/CVE-2022-50724/): regulator: core: fix resource leak in regulator_register() (not scored)
- [CVE-2022-50723](https://insights.sbomify.com/CVE-2022-50723/): bnxt_en: fix memory leak in bnxt_nvm_test() (not scored)
- [CVE-2022-50722](https://insights.sbomify.com/CVE-2022-50722/): media: ipu3-imgu: Fix NULL pointer dereference in active selection access (not scored)
- [CVE-2022-50721](https://insights.sbomify.com/CVE-2022-50721/): dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg (not scored)
- [CVE-2022-50720](https://insights.sbomify.com/CVE-2022-50720/): x86/apic: Don't disable x2APIC if locked (not scored)
- [CVE-2022-50719](https://insights.sbomify.com/CVE-2022-50719/): ALSA: line6: fix stack overflow in line6_midi_transmit (high 7.8)
- [CVE-2022-50718](https://insights.sbomify.com/CVE-2022-50718/): drm/amdgpu: fix pci device refcount leak (not scored)
- [CVE-2022-50717](https://insights.sbomify.com/CVE-2022-50717/): nvmet-tcp: add bounds check on Transfer Tag (critical 9.8)
- [CVE-2022-50716](https://insights.sbomify.com/CVE-2022-50716/): wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/171/