# Vulnerabilities published in 2022


- [CVE-2022-48763](https://insights.sbomify.com/CVE-2022-48763/): KVM: x86: Forcibly leave nested virt when SMM state is toggled (medium 5.5)
- [CVE-2022-48762](https://insights.sbomify.com/CVE-2022-48762/): arm64: extable: fix load_unaligned_zeropad() reg indices (high 7.8)
- [CVE-2022-48761](https://insights.sbomify.com/CVE-2022-48761/): usb: xhci-plat: fix crash when suspend if remote wake enable (medium 5.3)
- [CVE-2022-48760](https://insights.sbomify.com/CVE-2022-48760/): USB: core: Fix hang in usb_kill_urb by adding memory barriers (high 7.1)
- [CVE-2022-4876](https://insights.sbomify.com/CVE-2022-4876/): Kaltura mwEmbed DefaultSettings.php cross site scripting (low 3.5)
- [CVE-2022-48759](https://insights.sbomify.com/CVE-2022-48759/): rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev (high 7.8)
- [CVE-2022-48758](https://insights.sbomify.com/CVE-2022-48758/): scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (medium 5.5)
- [CVE-2022-48757](https://insights.sbomify.com/CVE-2022-48757/): net: fix information leakage in /proc/net/ptype (high 7.1)
- [CVE-2022-48756](https://insights.sbomify.com/CVE-2022-48756/): drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (medium 5.5)
- [CVE-2022-48755](https://insights.sbomify.com/CVE-2022-48755/): powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 (medium 5.5)
- [CVE-2022-48754](https://insights.sbomify.com/CVE-2022-48754/): phylib: fix potential use-after-free (high 7.8)
- [CVE-2022-48753](https://insights.sbomify.com/CVE-2022-48753/): block: fix memory leak in disk_register_independent_access_ranges (medium 5.3)
- [CVE-2022-48752](https://insights.sbomify.com/CVE-2022-48752/): powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending (medium 5.5)
- [CVE-2022-48751](https://insights.sbomify.com/CVE-2022-48751/): net/smc: Transitional solution for clcsock race issue (high 7.8)
- [CVE-2022-48750](https://insights.sbomify.com/CVE-2022-48750/): hwmon: (nct6775) Fix crash in clear_caseopen (medium 5.5)
- [CVE-2022-4875](https://insights.sbomify.com/CVE-2022-4875/): fossology cross site scripting (low 2.4)
- [CVE-2022-48749](https://insights.sbomify.com/CVE-2022-48749/): drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc (medium 5.5)
- [CVE-2022-48748](https://insights.sbomify.com/CVE-2022-48748/): net: bridge: vlan: fix memory leak in __allowed_ingress (high 7.5)
- [CVE-2022-48747](https://insights.sbomify.com/CVE-2022-48747/): block: Fix wrong offset in bio_truncate() (high 7.5)
- [CVE-2022-48746](https://insights.sbomify.com/CVE-2022-48746/): net/mlx5e: Fix handling of wrong devices during bond netevent (medium 5.5)
- [CVE-2022-48745](https://insights.sbomify.com/CVE-2022-48745/): net/mlx5: Use del_timer_sync in fw reset flow of halting poll (medium 4.7)
- [CVE-2022-48744](https://insights.sbomify.com/CVE-2022-48744/): net/mlx5e: Avoid field-overflowing memcpy() (high 7.5)
- [CVE-2022-48743](https://insights.sbomify.com/CVE-2022-48743/): net: amd-xgbe: Fix skb data length underflow (high 8.1)
- [CVE-2022-48742](https://insights.sbomify.com/CVE-2022-48742/): rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (high 7.8)
- [CVE-2022-48741](https://insights.sbomify.com/CVE-2022-48741/): ovl: fix NULL pointer dereference in copy up warning (medium 5.5)
- [CVE-2022-48740](https://insights.sbomify.com/CVE-2022-48740/): selinux: fix double free of cond_list on error paths (high 7.8)
- [CVE-2022-4874](https://insights.sbomify.com/CVE-2022-4874/): Auth bypass in NF20 (high 7.5)
- [CVE-2022-48739](https://insights.sbomify.com/CVE-2022-48739/): ASoC: hdmi-codec: Fix OOB memory accesses (high 7.1)
- [CVE-2022-48738](https://insights.sbomify.com/CVE-2022-48738/): ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (high 7.1)
- [CVE-2022-48735](https://insights.sbomify.com/CVE-2022-48735/): ALSA: hda: Fix UAF of leds class devs at unbinding (high 7.8)
- [CVE-2022-48734](https://insights.sbomify.com/CVE-2022-48734/): btrfs: fix deadlock between quota disable and qgroup rescan worker (medium 5.5)
- [CVE-2022-48733](https://insights.sbomify.com/CVE-2022-48733/): btrfs: fix use-after-free after failure to create a snapshot (high 7.8)
- [CVE-2022-48732](https://insights.sbomify.com/CVE-2022-48732/): drm/nouveau: fix off by one in BIOS boundary checking (high 7.8)
- [CVE-2022-48731](https://insights.sbomify.com/CVE-2022-48731/): mm/kmemleak: avoid scanning potential huge holes (medium 5.5)
- [CVE-2022-48730](https://insights.sbomify.com/CVE-2022-48730/): dma-buf: heaps: Fix potential spectre v1 gadget (medium 5.5)
- [CVE-2022-4873](https://insights.sbomify.com/CVE-2022-4873/): Stack based overflow on Netcomm router models NF20MESH, NF20, and NL1902 (critical 9.8)
- [CVE-2022-48729](https://insights.sbomify.com/CVE-2022-48729/): IB/hfi1: Fix panic with larger ipoib send_queue_size (high 7.8)
- [CVE-2022-48728](https://insights.sbomify.com/CVE-2022-48728/): IB/hfi1: Fix AIP early init panic (medium 5.5)
- [CVE-2022-48727](https://insights.sbomify.com/CVE-2022-48727/): KVM: arm64: Avoid consuming a stale esr value when SError occur (high 7.3)
- [CVE-2022-48726](https://insights.sbomify.com/CVE-2022-48726/): RDMA/ucma: Protect mc during concurrent multicast leaves (high 7.8)
- [CVE-2022-48725](https://insights.sbomify.com/CVE-2022-48725/): RDMA/siw: Fix refcounting leak in siw_create_qp() (medium 5.5)
- [CVE-2022-48724](https://insights.sbomify.com/CVE-2022-48724/): iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (medium 5.5)
- [CVE-2022-48723](https://insights.sbomify.com/CVE-2022-48723/): spi: uniphier: fix reference count leak in uniphier_spi_probe() (medium 5.5)
- [CVE-2022-48722](https://insights.sbomify.com/CVE-2022-48722/): net: ieee802154: ca8210: Stop leaking skb's (medium 5.5)
- [CVE-2022-48721](https://insights.sbomify.com/CVE-2022-48721/): net/smc: Forward wakeup to smc socket waitqueue after fallback (high 7.8)
- [CVE-2022-48720](https://insights.sbomify.com/CVE-2022-48720/): net: macsec: Fix offload support for NETDEV_UNREGISTER event (high 7.8)
- [CVE-2022-4872](https://insights.sbomify.com/CVE-2022-4872/): WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no' (medium 4.3)
- [CVE-2022-48719](https://insights.sbomify.com/CVE-2022-48719/): net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work (medium 5.5)
- [CVE-2022-48718](https://insights.sbomify.com/CVE-2022-48718/): drm: mxsfb: Fix NULL pointer dereference (medium 5.5)
- [CVE-2022-48717](https://insights.sbomify.com/CVE-2022-48717/): ASoC: max9759: fix underflow in speaker_gain_control_put() (high 7.1)
- [CVE-2022-48716](https://insights.sbomify.com/CVE-2022-48716/): ASoC: codecs: wcd938x: fix incorrect used of portid (high 7.8)
- [CVE-2022-48715](https://insights.sbomify.com/CVE-2022-48715/): scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (medium 5.5)
- [CVE-2022-48714](https://insights.sbomify.com/CVE-2022-48714/): bpf: Use VM_MAP instead of VM_ALLOC for ringbuf (high 7.1)
- [CVE-2022-48713](https://insights.sbomify.com/CVE-2022-48713/): perf/x86/intel/pt: Fix crash with stop filters in single-range mode (medium 5.5)
- [CVE-2022-48712](https://insights.sbomify.com/CVE-2022-48712/): ext4: fix error handling in ext4_fc_record_modified_inode() (high 7.8)
- [CVE-2022-48711](https://insights.sbomify.com/CVE-2022-48711/): tipc: improve size validations for received domain records (critical 9.8)
- [CVE-2022-48710](https://insights.sbomify.com/CVE-2022-48710/): drm/radeon: fix a possible null pointer dereference (medium 5.5)
- [CVE-2022-4871](https://insights.sbomify.com/CVE-2022-4871/): ummmmm nflpick-em.com LoadUsers.php _Load_Users sql injection (medium 4.7)
- [CVE-2022-48709](https://insights.sbomify.com/CVE-2022-48709/): ice: switch: fix potential memleak in ice_add_adv_recipe() (medium 5.5)
- [CVE-2022-48708](https://insights.sbomify.com/CVE-2022-48708/): pinctrl: single: fix potential NULL dereference (medium 5.5)
- [CVE-2022-48707](https://insights.sbomify.com/CVE-2022-48707/): cxl/region: Fix null pointer dereference for resetting decoder (medium 5.5)
- [CVE-2022-48706](https://insights.sbomify.com/CVE-2022-48706/): vdpa: ifcvf: Do proper cleanup if IFCVF init fails (medium 5.5)
- [CVE-2022-48705](https://insights.sbomify.com/CVE-2022-48705/): wifi: mt76: mt7921e: fix crash in chip reset fail (medium 5.5)
- [CVE-2022-48704](https://insights.sbomify.com/CVE-2022-48704/): drm/radeon: add a force flush to delay work when radeon (medium 5.5)
- [CVE-2022-48703](https://insights.sbomify.com/CVE-2022-48703/): thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR (medium 5.5)
- [CVE-2022-48702](https://insights.sbomify.com/CVE-2022-48702/): ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (high 7.8)
- [CVE-2022-48701](https://insights.sbomify.com/CVE-2022-48701/): ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (high 7.1)
- [CVE-2022-4870](https://insights.sbomify.com/CVE-2022-4870/): Information disclosure in Octopus Server (medium 5.3)
- [CVE-2022-48699](https://insights.sbomify.com/CVE-2022-48699/): sched/debug: fix dentry leak in update_sched_domain_debugfs (medium 5.5)
- [CVE-2022-48698](https://insights.sbomify.com/CVE-2022-48698/): drm/amd/display: fix memory leak when using debugfs_lookup() (medium 5.3)
- [CVE-2022-48697](https://insights.sbomify.com/CVE-2022-48697/): nvmet: fix a use-after-free (critical 9.8)
- [CVE-2022-48696](https://insights.sbomify.com/CVE-2022-48696/): regmap: spi: Reserve space for register address/padding (high 7.1)
- [CVE-2022-48695](https://insights.sbomify.com/CVE-2022-48695/): scsi: mpt3sas: Fix use-after-free warning (high 7.8)
- [CVE-2022-48694](https://insights.sbomify.com/CVE-2022-48694/): RDMA/irdma: Fix drain SQ hang with no completion (high 7.5)
- [CVE-2022-48693](https://insights.sbomify.com/CVE-2022-48693/): soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs (medium 5.5)
- [CVE-2022-48692](https://insights.sbomify.com/CVE-2022-48692/): RDMA/srp: Set scmnd->result only when scmnd is not NULL (high 7.5)
- [CVE-2022-48691](https://insights.sbomify.com/CVE-2022-48691/): netfilter: nf_tables: clean up hook list when offload flags check fails (medium 5.3)
- [CVE-2022-48690](https://insights.sbomify.com/CVE-2022-48690/): ice: Fix DMA mappings leak (medium 5.5)
- [CVE-2022-4869](https://insights.sbomify.com/CVE-2022-4869/): Evolution Events Artaxerxes POST Parameter middleware.py information disclosure (low 3.5)
- [CVE-2022-48689](https://insights.sbomify.com/CVE-2022-48689/): tcp: TX zerocopy should not sense pfmemalloc status (medium 5.3)
- [CVE-2022-48688](https://insights.sbomify.com/CVE-2022-48688/): i40e: Fix kernel crash during module removal (medium 5.5)
- [CVE-2022-48687](https://insights.sbomify.com/CVE-2022-48687/): ipv6: sr: fix out-of-bounds read when setting HMAC data. (medium 5.5)
- [CVE-2022-48686](https://insights.sbomify.com/CVE-2022-48686/): nvme-tcp: fix UAF when detecting digest errors (critical 9.8)
- [CVE-2022-48685](https://insights.sbomify.com/CVE-2022-48685/): Privilege escalation in logpoint:siem (high 7.7)
- [CVE-2022-48684](https://insights.sbomify.com/CVE-2022-48684/): Code injection in logpoint:siem (high 8.4)
- [CVE-2022-48683](https://insights.sbomify.com/CVE-2022-48683/): Security feature bypass in macOS (high 8.6)
- [CVE-2022-48682](https://insights.sbomify.com/CVE-2022-48682/): In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink. (medium 6.0)
- [CVE-2022-48681](https://insights.sbomify.com/CVE-2022-48681/): Memory corruption in EGRT-00 (high 7.2)
- [CVE-2022-4868](https://insights.sbomify.com/CVE-2022-4868/): Improper Authorization in froxlor/froxlor (medium 6.5)
- [CVE-2022-48675](https://insights.sbomify.com/CVE-2022-48675/): IB/core: Fix a nested dead lock as part of ODP flow (medium 5.5)
- [CVE-2022-48674](https://insights.sbomify.com/CVE-2022-48674/): erofs: fix pcluster use-after-free on UP platforms (high 7.8)
- [CVE-2022-48673](https://insights.sbomify.com/CVE-2022-48673/): net/smc: Fix possible access to freed memory in link clear (critical 9.8)
- [CVE-2022-48672](https://insights.sbomify.com/CVE-2022-48672/): of: fdt: fix off-by-one error in unflatten_dt_nodes() (high 7.8)
- [CVE-2022-48671](https://insights.sbomify.com/CVE-2022-48671/): cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() (medium 5.5)
- [CVE-2022-48670](https://insights.sbomify.com/CVE-2022-48670/): peci: cpu: Fix use-after-free in adev_release() (high 7.8)
- [CVE-2022-4867](https://insights.sbomify.com/CVE-2022-4867/): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (low 3.5)
- [CVE-2022-48669](https://insights.sbomify.com/CVE-2022-48669/): powerpc/pseries: Fix potential memleak in papr_get_attr() (medium 5.5)
- [CVE-2022-48668](https://insights.sbomify.com/CVE-2022-48668/): smb3: fix temporary data corruption in collapse range (low 3.3)
- [CVE-2022-48667](https://insights.sbomify.com/CVE-2022-48667/): smb3: fix temporary data corruption in insert range (low 3.3)
- [CVE-2022-48666](https://insights.sbomify.com/CVE-2022-48666/): scsi: core: Fix a use-after-free (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/192/