# Vulnerabilities published in 2022


- [CVE-2022-48665](https://insights.sbomify.com/CVE-2022-48665/): exfat: fix overflow for large capacity partition (high 7.1)
- [CVE-2022-48664](https://insights.sbomify.com/CVE-2022-48664/): btrfs: fix hang during unmount when stopping a space reclaim worker (medium 5.5)
- [CVE-2022-48663](https://insights.sbomify.com/CVE-2022-48663/): gpio: mockup: fix NULL pointer dereference when removing debugfs (medium 5.5)
- [CVE-2022-48662](https://insights.sbomify.com/CVE-2022-48662/): drm/i915/gem: Really move i915_gem_context.link under ref protection (high 7.8)
- [CVE-2022-48661](https://insights.sbomify.com/CVE-2022-48661/): gpio: mockup: Fix potential resource leakage when register a chip (medium 5.5)
- [CVE-2022-48660](https://insights.sbomify.com/CVE-2022-48660/): gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully (medium 5.5)
- [CVE-2022-4866](https://insights.sbomify.com/CVE-2022-4866/): Cross-site Scripting (XSS) - Stored in usememos/memos (critical 9.8)
- [CVE-2022-48659](https://insights.sbomify.com/CVE-2022-48659/): mm/slub: fix to return errno if kmalloc() fails (medium 5.5)
- [CVE-2022-48658](https://insights.sbomify.com/CVE-2022-48658/): mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context. (high 7.5)
- [CVE-2022-48657](https://insights.sbomify.com/CVE-2022-48657/): arm64: topology: fix possible overflow in amu_fie_setup() (high 7.8)
- [CVE-2022-48656](https://insights.sbomify.com/CVE-2022-48656/): dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get() (medium 5.5)
- [CVE-2022-48655](https://insights.sbomify.com/CVE-2022-48655/): firmware: arm_scmi: Harden accesses to the reset domains (high 8.1)
- [CVE-2022-48654](https://insights.sbomify.com/CVE-2022-48654/): netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (high 7.1)
- [CVE-2022-48653](https://insights.sbomify.com/CVE-2022-48653/): ice: Don't double unplug aux on peer initiated reset (medium 5.5)
- [CVE-2022-48652](https://insights.sbomify.com/CVE-2022-48652/): ice: Fix crash by keep old cfg when update TCs more than queues (high 8.8)
- [CVE-2022-48651](https://insights.sbomify.com/CVE-2022-48651/): ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header (high 7.7)
- [CVE-2022-48650](https://insights.sbomify.com/CVE-2022-48650/): scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() (medium 4.7)
- [CVE-2022-4865](https://insights.sbomify.com/CVE-2022-4865/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 8.3)
- [CVE-2022-48649](https://insights.sbomify.com/CVE-2022-48649/): mm/slab_common: fix possible double free of kmem_cache (high 7.8)
- [CVE-2022-48648](https://insights.sbomify.com/CVE-2022-48648/): sfc: fix null pointer dereference in efx_hard_start_xmit (medium 5.5)
- [CVE-2022-48647](https://insights.sbomify.com/CVE-2022-48647/): sfc: fix TX channel offset when using legacy interrupts (medium 5.5)
- [CVE-2022-48646](https://insights.sbomify.com/CVE-2022-48646/): sfc/siena: fix null pointer dereference in efx_hard_start_xmit (medium 6.2)
- [CVE-2022-48645](https://insights.sbomify.com/CVE-2022-48645/): net: enetc: deny offload of tc-based TSN features on VF interfaces (medium 5.5)
- [CVE-2022-48644](https://insights.sbomify.com/CVE-2022-48644/): net/sched: taprio: avoid disabling offload when it was never enabled (medium 5.5)
- [CVE-2022-48643](https://insights.sbomify.com/CVE-2022-48643/): netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() (medium 5.5)
- [CVE-2022-48642](https://insights.sbomify.com/CVE-2022-48642/): netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() (medium 5.5)
- [CVE-2022-48641](https://insights.sbomify.com/CVE-2022-48641/): netfilter: ebtables: fix memory leak when blob is malformed (medium 5.5)
- [CVE-2022-48640](https://insights.sbomify.com/CVE-2022-48640/): bonding: fix NULL deref in bond_rr_gen_slave_id (medium 5.5)
- [CVE-2022-4864](https://insights.sbomify.com/CVE-2022-4864/): Argument Injection in froxlor/froxlor (medium 5.3)
- [CVE-2022-48639](https://insights.sbomify.com/CVE-2022-48639/): net: sched: fix possible refcount leak in tc_new_tfilter() (medium 5.5)
- [CVE-2022-48638](https://insights.sbomify.com/CVE-2022-48638/): cgroup: cgroup_get_from_id() must check the looked-up kn is a directory (medium 5.3)
- [CVE-2022-48637](https://insights.sbomify.com/CVE-2022-48637/): bnxt: prevent skb UAF after handing over to PTP worker (high 7.8)
- [CVE-2022-48636](https://insights.sbomify.com/CVE-2022-48636/): s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup (high 7.8)
- [CVE-2022-48635](https://insights.sbomify.com/CVE-2022-48635/): fsdax: Fix infinite loop in dax_iomap_rw() (medium 6.2)
- [CVE-2022-48634](https://insights.sbomify.com/CVE-2022-48634/): drm/gma500: Fix BUG: sleeping function called from invalid context errors (medium 5.3)
- [CVE-2022-48633](https://insights.sbomify.com/CVE-2022-48633/): drm/gma500: Fix WARN_ON(lock->magic != lock) error (medium 5.5)
- [CVE-2022-48632](https://insights.sbomify.com/CVE-2022-48632/): i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (high 7.8)
- [CVE-2022-48631](https://insights.sbomify.com/CVE-2022-48631/): ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (medium 5.5)
- [CVE-2022-48630](https://insights.sbomify.com/CVE-2022-48630/): crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ (medium 5.5)
- [CVE-2022-4863](https://insights.sbomify.com/CVE-2022-4863/): Improper Handling of Insufficient Permissions or Privileges in usememos/memos (high 8.4)
- [CVE-2022-48629](https://insights.sbomify.com/CVE-2022-48629/): crypto: qcom-rng - ensure buffer for generate is completely filled (high 8.1)
- [CVE-2022-48628](https://insights.sbomify.com/CVE-2022-48628/): ceph: drop messages from MDS when unmounting (medium 5.5)
- [CVE-2022-48627](https://insights.sbomify.com/CVE-2022-48627/): vt: fix memory overlapping when deleting chars in the buffer (medium 5.5)
- [CVE-2022-48626](https://insights.sbomify.com/CVE-2022-48626/): moxart: fix potential use-after-free on remove path (high 7.8)
- [CVE-2022-48625](https://insights.sbomify.com/CVE-2022-48625/): Hardcoded credentials in yealink:configuration encryption tool (high 7.5)
- [CVE-2022-48624](https://insights.sbomify.com/CVE-2022-48624/): Command injection in greenwoodsoftware:less (high 7.8)
- [CVE-2022-48623](https://insights.sbomify.com/CVE-2022-48623/): Memory corruption in rurban:cpanel\ (critical 9.1)
- [CVE-2022-48622](https://insights.sbomify.com/CVE-2022-48622/): Memory corruption in gnome:gdkpixbuf (high 7.8)
- [CVE-2022-48621](https://insights.sbomify.com/CVE-2022-48621/): Auth bypass in EMUI (medium 6.3)
- [CVE-2022-48620](https://insights.sbomify.com/CVE-2022-48620/): Memory corruption in troglobit:libeuv (critical 9.8)
- [CVE-2022-4862](https://insights.sbomify.com/CVE-2022-4862/): XSS vulnerability in M-Files Web (medium 5.0)
- [CVE-2022-48619](https://insights.sbomify.com/CVE-2022-48619/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2022-48618](https://insights.sbomify.com/CVE-2022-48618/): Apple Multiple Products Memory Corruption (high 7.0, exploited in the wild)
- [CVE-2022-48616](https://insights.sbomify.com/CVE-2022-48616/): Command injection in AR6000 (medium 6.4)
- [CVE-2022-48615](https://insights.sbomify.com/CVE-2022-48615/): Missing authorization in AR6000 (medium 4.8)
- [CVE-2022-48614](https://insights.sbomify.com/CVE-2022-48614/): Cross-site Scripting in Semantic MediaWiki (medium 6.1)
- [CVE-2022-48613](https://insights.sbomify.com/CVE-2022-48613/): Race condition in EMUI (medium 5.9)
- [CVE-2022-48612](https://insights.sbomify.com/CVE-2022-48612/): Cross-site scripting in classlink:oneclick (medium 6.1)
- [CVE-2022-48611](https://insights.sbomify.com/CVE-2022-48611/): Privilege escalation in iTunes for Windows (high 7.8)
- [CVE-2022-48610](https://insights.sbomify.com/CVE-2022-48610/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2022-4861](https://insights.sbomify.com/CVE-2022-4861/): Incorrect Implementation of Authentication Algorithm (medium 4.8)
- [CVE-2022-48606](https://insights.sbomify.com/CVE-2022-48606/): Null dereference in EMUI (high 7.5)
- [CVE-2022-48605](https://insights.sbomify.com/CVE-2022-48605/): Other in EMUI (critical 9.8)
- [CVE-2022-48604](https://insights.sbomify.com/CVE-2022-48604/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48603](https://insights.sbomify.com/CVE-2022-48603/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48602](https://insights.sbomify.com/CVE-2022-48602/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48601](https://insights.sbomify.com/CVE-2022-48601/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48600](https://insights.sbomify.com/CVE-2022-48600/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-4860](https://insights.sbomify.com/CVE-2022-4860/): KBase Metrics methods_upload_user_stats.py upload_user_data sql injection (medium 5.5)
- [CVE-2022-48599](https://insights.sbomify.com/CVE-2022-48599/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48598](https://insights.sbomify.com/CVE-2022-48598/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48597](https://insights.sbomify.com/CVE-2022-48597/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48596](https://insights.sbomify.com/CVE-2022-48596/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48595](https://insights.sbomify.com/CVE-2022-48595/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48594](https://insights.sbomify.com/CVE-2022-48594/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48593](https://insights.sbomify.com/CVE-2022-48593/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48592](https://insights.sbomify.com/CVE-2022-48592/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48591](https://insights.sbomify.com/CVE-2022-48591/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48590](https://insights.sbomify.com/CVE-2022-48590/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-4859](https://insights.sbomify.com/CVE-2022-4859/): Joget User Profile Menu UserProfileMenu.java submitForm cross site scripting (low 3.5)
- [CVE-2022-48589](https://insights.sbomify.com/CVE-2022-48589/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48588](https://insights.sbomify.com/CVE-2022-48588/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48587](https://insights.sbomify.com/CVE-2022-48587/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48586](https://insights.sbomify.com/CVE-2022-48586/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48585](https://insights.sbomify.com/CVE-2022-48585/): SQL injection in SL 1 (high 8.8)
- [CVE-2022-48584](https://insights.sbomify.com/CVE-2022-48584/): Command injection in SL 1 (high 8.8)
- [CVE-2022-48583](https://insights.sbomify.com/CVE-2022-48583/): Command injection in SL 1 (high 8.8)
- [CVE-2022-48582](https://insights.sbomify.com/CVE-2022-48582/): Command injection in SL 1 (high 8.8)
- [CVE-2022-48581](https://insights.sbomify.com/CVE-2022-48581/): Command injection in SL 1 (high 8.8)
- [CVE-2022-48580](https://insights.sbomify.com/CVE-2022-48580/): Command injection in SL 1 (high 8.8)
- [CVE-2022-4858](https://insights.sbomify.com/CVE-2022-4858/): Insertion of Sensitive Information into Log File (medium 4.4)
- [CVE-2022-48579](https://insights.sbomify.com/CVE-2022-48579/): Path traversal in rarlab:unrar (high 7.5)
- [CVE-2022-48578](https://insights.sbomify.com/CVE-2022-48578/): Memory corruption in macOS (high 7.1)
- [CVE-2022-48577](https://insights.sbomify.com/CVE-2022-48577/): Missing authorization in macOS (medium 5.5)
- [CVE-2022-48575](https://insights.sbomify.com/CVE-2022-48575/): Auth bypass in macOS Monterey (low 3.5)
- [CVE-2022-48571](https://insights.sbomify.com/CVE-2022-48571/): Denial of service in memcached:memcached (high 7.5)
- [CVE-2022-48570](https://insights.sbomify.com/CVE-2022-48570/): Weak cryptography in cryptopp:crypto\+\+ (high 7.5)
- [CVE-2022-4857](https://insights.sbomify.com/CVE-2022-4857/): Modbus Tools Modbus Poll mbp File mbpoll.exe buffer overflow (medium 6.3)
- [CVE-2022-48566](https://insights.sbomify.com/CVE-2022-48566/): Weak cryptography in debian:debian linux (medium 5.9)
- [CVE-2022-48565](https://insights.sbomify.com/CVE-2022-48565/): XML external entity in debian:debian linux (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/193/