# Vulnerabilities published in 2022


- [CVE-2022-49693](https://insights.sbomify.com/CVE-2022-49693/): drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (medium 5.5)
- [CVE-2022-49692](https://insights.sbomify.com/CVE-2022-49692/): net: phy: at803x: fix NULL pointer dereference on AR9331 PHY (medium 5.5)
- [CVE-2022-49691](https://insights.sbomify.com/CVE-2022-49691/): erspan: do not assume transport header is always set (medium 5.5)
- [CVE-2022-4969](https://insights.sbomify.com/CVE-2022-4969/): bwoodsend rockhopper Binary Parser ragged_array.c count_rows buffer overflow (medium 4.8)
- [CVE-2022-49688](https://insights.sbomify.com/CVE-2022-49688/): afs: Fix dynamic root getattr (medium 5.5)
- [CVE-2022-49687](https://insights.sbomify.com/CVE-2022-49687/): virtio_net: fix xdp_rxq_info bug after suspend/resume (high 7.1)
- [CVE-2022-49686](https://insights.sbomify.com/CVE-2022-49686/): usb: gadget: uvc: fix list double add in uvcg_video_pump (high 7.8)
- [CVE-2022-49685](https://insights.sbomify.com/CVE-2022-49685/): iio: trigger: sysfs: fix use-after-free on remove (high 7.8)
- [CVE-2022-49684](https://insights.sbomify.com/CVE-2022-49684/): iio: adc: aspeed: Fix refcount leak in aspeed_adc_set_trim_data (medium 5.5)
- [CVE-2022-49683](https://insights.sbomify.com/CVE-2022-49683/): iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client (medium 5.5)
- [CVE-2022-49682](https://insights.sbomify.com/CVE-2022-49682/): xtensa: Fix refcount leak bug in time.c (medium 5.5)
- [CVE-2022-49681](https://insights.sbomify.com/CVE-2022-49681/): xtensa: xtfpga: Fix refcount leak bug in setup (medium 5.5)
- [CVE-2022-49680](https://insights.sbomify.com/CVE-2022-49680/): ARM: exynos: Fix refcount leak in exynos_map_pmu (medium 5.5)
- [CVE-2022-4968](https://insights.sbomify.com/CVE-2022-4968/): Information disclosure in Netplan (medium 6.5)
- [CVE-2022-49679](https://insights.sbomify.com/CVE-2022-49679/): ARM: Fix refcount leak in axxia_boot_secondary (medium 5.5)
- [CVE-2022-49678](https://insights.sbomify.com/CVE-2022-49678/): soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe (medium 5.5)
- [CVE-2022-49677](https://insights.sbomify.com/CVE-2022-49677/): ARM: cns3xxx: Fix refcount leak in cns3xxx_init (medium 5.5)
- [CVE-2022-49676](https://insights.sbomify.com/CVE-2022-49676/): memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings (medium 5.5)
- [CVE-2022-49675](https://insights.sbomify.com/CVE-2022-49675/): tick/nohz: unexport __init-annotated tick_nohz_full_setup() (medium 5.5)
- [CVE-2022-49674](https://insights.sbomify.com/CVE-2022-49674/): dm raid: fix accesses beyond end of raid member array (high 7.1)
- [CVE-2022-49673](https://insights.sbomify.com/CVE-2022-49673/): dm raid: fix KASAN warning in raid5_add_disks (medium 5.5)
- [CVE-2022-49672](https://insights.sbomify.com/CVE-2022-49672/): net: tun: unlink NAPI from device on destruction (high 7.8)
- [CVE-2022-49671](https://insights.sbomify.com/CVE-2022-49671/): RDMA/cm: Fix memory leak in ib_cm_insert_listen (medium 5.5)
- [CVE-2022-49670](https://insights.sbomify.com/CVE-2022-49670/): linux/dim: Fix divide by 0 in RDMA DIM (high 7.5)
- [CVE-2022-4967](https://insights.sbomify.com/CVE-2022-4967/): Auth bypass in strongSwan (high 7.7)
- [CVE-2022-49669](https://insights.sbomify.com/CVE-2022-49669/): mptcp: fix race on unaccepted mptcp sockets (high 7.8)
- [CVE-2022-49668](https://insights.sbomify.com/CVE-2022-49668/): PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (medium 5.5)
- [CVE-2022-49667](https://insights.sbomify.com/CVE-2022-49667/): net: bonding: fix use-after-free after 802.3ad slave unbind (high 7.8)
- [CVE-2022-49666](https://insights.sbomify.com/CVE-2022-49666/): powerpc/memhotplug: Add add_pages override for PPC (medium 5.5)
- [CVE-2022-49665](https://insights.sbomify.com/CVE-2022-49665/): platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource (medium 5.5)
- [CVE-2022-49664](https://insights.sbomify.com/CVE-2022-49664/): tipc: move bc link creation back to tipc_node_create (high 7.5)
- [CVE-2022-49663](https://insights.sbomify.com/CVE-2022-49663/): tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() (medium 5.5)
- [CVE-2022-49662](https://insights.sbomify.com/CVE-2022-49662/): ipv6: fix lockdep splat in in6_dump_addrs() (medium 5.5)
- [CVE-2022-49661](https://insights.sbomify.com/CVE-2022-49661/): can: gs_usb: gs_usb_open/close(): fix memory leak (medium 5.5)
- [CVE-2022-4966](https://insights.sbomify.com/CVE-2022-4966/): sequentech admin-console Election Description cross site scripting (low 3.5)
- [CVE-2022-49659](https://insights.sbomify.com/CVE-2022-49659/): can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits (medium 5.5)
- [CVE-2022-49658](https://insights.sbomify.com/CVE-2022-49658/): bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals (medium 5.5)
- [CVE-2022-49657](https://insights.sbomify.com/CVE-2022-49657/): usbnet: fix memory leak in error case (medium 5.5)
- [CVE-2022-49656](https://insights.sbomify.com/CVE-2022-49656/): ARM: meson: Fix refcount leak in meson_smp_prepare_cpus (medium 5.5)
- [CVE-2022-49655](https://insights.sbomify.com/CVE-2022-49655/): fscache: Fix invalidation/lookup race (medium 4.7)
- [CVE-2022-49654](https://insights.sbomify.com/CVE-2022-49654/): net: dsa: qca8k: reset cpu port on MTU change (medium 5.5)
- [CVE-2022-49653](https://insights.sbomify.com/CVE-2022-49653/): i2c: piix4: Fix a memory leak in the EFCH MMIO support (medium 5.5)
- [CVE-2022-49652](https://insights.sbomify.com/CVE-2022-49652/): dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (medium 5.5)
- [CVE-2022-49651](https://insights.sbomify.com/CVE-2022-49651/): srcu: Tighten cleanup_srcu_struct() GP checks (high 7.8)
- [CVE-2022-49650](https://insights.sbomify.com/CVE-2022-49650/): dmaengine: qcom: bam_dma: fix runtime PM underflow (medium 5.5)
- [CVE-2022-4965](https://insights.sbomify.com/CVE-2022-4965/): Invitation Code Content Restriction Plugin from CreativeMinds <= 1.5.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-49649](https://insights.sbomify.com/CVE-2022-49649/): xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue (medium 5.5)
- [CVE-2022-49648](https://insights.sbomify.com/CVE-2022-49648/): tracing/histograms: Fix memory leak problem (medium 5.5)
- [CVE-2022-49647](https://insights.sbomify.com/CVE-2022-49647/): cgroup: Use separate src/dst nodes when preloading css_sets for migration (high 7.8)
- [CVE-2022-49646](https://insights.sbomify.com/CVE-2022-49646/): wifi: mac80211: fix queue selection for mesh/OCB interfaces (medium 5.5)
- [CVE-2022-49645](https://insights.sbomify.com/CVE-2022-49645/): drm/panfrost: Fix shrinker list corruption by madvise IOCTL (high 7.8)
- [CVE-2022-49644](https://insights.sbomify.com/CVE-2022-49644/): drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() (medium 5.5)
- [CVE-2022-49643](https://insights.sbomify.com/CVE-2022-49643/): ima: Fix a potential integer overflow in ima_appraise_measurement (high 7.1)
- [CVE-2022-49642](https://insights.sbomify.com/CVE-2022-49642/): net: stmmac: dwc-qos: Disable split header for Tegra194 (medium 5.5)
- [CVE-2022-49641](https://insights.sbomify.com/CVE-2022-49641/): sysctl: Fix data races in proc_douintvec(). (medium 4.7)
- [CVE-2022-49640](https://insights.sbomify.com/CVE-2022-49640/): sysctl: Fix data races in proc_douintvec_minmax(). (medium 4.7)
- [CVE-2022-4964](https://insights.sbomify.com/CVE-2022-4964/): Misconfiguration in Ubuntu pipewire-pulse (medium 5.5)
- [CVE-2022-49639](https://insights.sbomify.com/CVE-2022-49639/): cipso: Fix data-races around sysctl. (medium 4.7)
- [CVE-2022-49638](https://insights.sbomify.com/CVE-2022-49638/): icmp: Fix data-races around sysctl. (medium 4.7)
- [CVE-2022-49637](https://insights.sbomify.com/CVE-2022-49637/): ipv4: Fix a data-race around sysctl_fib_sync_mem. (medium 4.7)
- [CVE-2022-49636](https://insights.sbomify.com/CVE-2022-49636/): vlan: fix memory leak in vlan_newlink() (medium 5.5)
- [CVE-2022-49635](https://insights.sbomify.com/CVE-2022-49635/): drm/i915/selftests: fix subtraction overflow bug (high 7.8)
- [CVE-2022-49634](https://insights.sbomify.com/CVE-2022-49634/): sysctl: Fix data-races in proc_dou8vec_minmax(). (medium 4.7)
- [CVE-2022-49633](https://insights.sbomify.com/CVE-2022-49633/): icmp: Fix data-races around sysctl_icmp_echo_enable_probe. (medium 4.7)
- [CVE-2022-49632](https://insights.sbomify.com/CVE-2022-49632/): icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. (medium 4.7)
- [CVE-2022-49631](https://insights.sbomify.com/CVE-2022-49631/): raw: Fix a data-race around sysctl_raw_l3mdev_accept. (medium 4.7)
- [CVE-2022-49630](https://insights.sbomify.com/CVE-2022-49630/): tcp: Fix a data-race around sysctl_tcp_ecn_fallback. (medium 4.7)
- [CVE-2022-4963](https://insights.sbomify.com/CVE-2022-4963/): Folio Spring Module Core Schema Name HibernateSchemaService.java dropSchema sql injection (medium 5.5)
- [CVE-2022-49629](https://insights.sbomify.com/CVE-2022-49629/): nexthop: Fix data-races around nexthop_compat_mode. (medium 4.7)
- [CVE-2022-49628](https://insights.sbomify.com/CVE-2022-49628/): net: stmmac: fix leaks in probe (medium 5.5)
- [CVE-2022-49627](https://insights.sbomify.com/CVE-2022-49627/): ima: Fix potential memory leak in ima_init_crypto() (medium 5.5)
- [CVE-2022-49626](https://insights.sbomify.com/CVE-2022-49626/): sfc: fix use after free when disabling sriov (high 7.8)
- [CVE-2022-49625](https://insights.sbomify.com/CVE-2022-49625/): sfc: fix kernel panic when creating VF (medium 5.5)
- [CVE-2022-49624](https://insights.sbomify.com/CVE-2022-49624/): net: atlantic: remove aq_nic_deinit() when resume (medium 5.5)
- [CVE-2022-49623](https://insights.sbomify.com/CVE-2022-49623/): powerpc/xive/spapr: correct bitmap allocation size (high 7.1)
- [CVE-2022-49622](https://insights.sbomify.com/CVE-2022-49622/): netfilter: nf_tables: avoid skb access on nf_stolen (high 7.8)
- [CVE-2022-49621](https://insights.sbomify.com/CVE-2022-49621/): cpufreq: pmac32-cpufreq: Fix refcount leak bug (medium 5.5)
- [CVE-2022-49620](https://insights.sbomify.com/CVE-2022-49620/): net: tipc: fix possible refcount leak in tipc_sk_create() (medium 5.5)
- [CVE-2022-4962](https://insights.sbomify.com/CVE-2022-4962/): Apollo Configuration Center users improper authorization (medium 4.3)
- [CVE-2022-49619](https://insights.sbomify.com/CVE-2022-49619/): net: sfp: fix memory leak in sfp_probe() (medium 5.5)
- [CVE-2022-49618](https://insights.sbomify.com/CVE-2022-49618/): pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() (medium 5.5)
- [CVE-2022-49617](https://insights.sbomify.com/CVE-2022-49617/): ASoC: Intel: sof_sdw: handle errors on card registration (medium 5.5)
- [CVE-2022-49616](https://insights.sbomify.com/CVE-2022-49616/): ASoC: rt7*-sdw: harden jack_detect_handler (medium 5.5)
- [CVE-2022-49615](https://insights.sbomify.com/CVE-2022-49615/): ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error (medium 5.5)
- [CVE-2022-49613](https://insights.sbomify.com/CVE-2022-49613/): serial: 8250: Fix PM usage_count for console handover (medium 5.5)
- [CVE-2022-49612](https://insights.sbomify.com/CVE-2022-49612/): power: supply: core: Fix boundary conditions in interpolation (high 7.8)
- [CVE-2022-49611](https://insights.sbomify.com/CVE-2022-49611/): x86/speculation: Fill RSB on vmexit for IBRS (medium 5.5)
- [CVE-2022-49610](https://insights.sbomify.com/CVE-2022-49610/): KVM: VMX: Prevent RSB underflow before vmenter (medium 5.5)
- [CVE-2022-4961](https://insights.sbomify.com/CVE-2022-4961/): Weitong Mall OrderDao.xml sql injection (medium 5.5)
- [CVE-2022-49609](https://insights.sbomify.com/CVE-2022-49609/): power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe (medium 5.5)
- [CVE-2022-49608](https://insights.sbomify.com/CVE-2022-49608/): pinctrl: ralink: Check for null return of devm_kcalloc (medium 5.5)
- [CVE-2022-49607](https://insights.sbomify.com/CVE-2022-49607/): perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() (medium 4.7)
- [CVE-2022-49606](https://insights.sbomify.com/CVE-2022-49606/): RDMA/irdma: Fix sleep from invalid context BUG (medium 5.5)
- [CVE-2022-49605](https://insights.sbomify.com/CVE-2022-49605/): igc: Reinstate IGC_REMOVED logic and implement it properly (medium 5.5)
- [CVE-2022-49604](https://insights.sbomify.com/CVE-2022-49604/): ip: Fix data-races around sysctl_ip_fwd_use_pmtu. (medium 4.7)
- [CVE-2022-49603](https://insights.sbomify.com/CVE-2022-49603/): ip: Fix data-races around sysctl_ip_fwd_update_priority. (medium 4.7)
- [CVE-2022-49602](https://insights.sbomify.com/CVE-2022-49602/): ip: Fix a data-race around sysctl_fwmark_reflect. (medium 4.7)
- [CVE-2022-49601](https://insights.sbomify.com/CVE-2022-49601/): tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. (medium 4.7)
- [CVE-2022-49600](https://insights.sbomify.com/CVE-2022-49600/): ip: Fix a data-race around sysctl_ip_autobind_reuse. (medium 4.7)
- [CVE-2022-4960](https://insights.sbomify.com/CVE-2022-4960/): cloudfavorites favorites-web Nickname cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/182/