# Vulnerabilities published in 2022


- [CVE-2022-37959](https://insights.sbomify.com/CVE-2022-37959/): Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2022-37958](https://insights.sbomify.com/CVE-2022-37958/): SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability (high 8.1)
- [CVE-2022-37957](https://insights.sbomify.com/CVE-2022-37957/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-37956](https://insights.sbomify.com/CVE-2022-37956/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-37955](https://insights.sbomify.com/CVE-2022-37955/): Windows Group Policy Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-37954](https://insights.sbomify.com/CVE-2022-37954/): DirectX Graphics Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-37953](https://insights.sbomify.com/CVE-2022-37953/): WorkstationST - Response Splitting in AM Gateway Challenge-Response (medium 4.7)
- [CVE-2022-37952](https://insights.sbomify.com/CVE-2022-37952/): WorkstationST - Reflected XSS in iHistorian Data Display Tags (medium 4.7)
- [CVE-2022-37940](https://insights.sbomify.com/CVE-2022-37940/): Open redirect in HPE FlexFabric 5700 Switch Series (medium 5.3)
- [CVE-2022-3794](https://insights.sbomify.com/CVE-2022-3794/): Jeg Elementor Kit <= 2.5.6 - Authorization Bypass (medium 5.4)
- [CVE-2022-37939](https://insights.sbomify.com/CVE-2022-37939/): Information disclosure in HPE Superdome Flex Servers; HPE Superdome Flex 280 Servers (low 2.3)
- [CVE-2022-37938](https://insights.sbomify.com/CVE-2022-37938/): Server-side request forgery in HPE Serviceguard for Linux (critical 9.8)
- [CVE-2022-37937](https://insights.sbomify.com/CVE-2022-37937/): Memory corruption in HPE Serviceguard for Linux (critical 9.8)
- [CVE-2022-37936](https://insights.sbomify.com/CVE-2022-37936/): Deserialization in HPE Serviceguard for Linux (critical 9.8)
- [CVE-2022-37935](https://insights.sbomify.com/CVE-2022-37935/): Information disclosure in HPE OneView for VMware vCenter, (medium 5.5)
- [CVE-2022-37934](https://insights.sbomify.com/CVE-2022-37934/): Path traversal in HPE OfficeConnect 1820 and 1850 Switch Series (medium 6.8)
- [CVE-2022-37933](https://insights.sbomify.com/CVE-2022-37933/): Other in HPE Superdome Flex Server; HPE Superdome Flex 280 Server (high 7.3)
- [CVE-2022-37932](https://insights.sbomify.com/CVE-2022-37932/): Auth bypass in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches (high 8.8)
- [CVE-2022-37931](https://insights.sbomify.com/CVE-2022-37931/): A vulnerability in NetBatch-Plus software allows unauthorized access to the application (high 7.3)
- [CVE-2022-37930](https://insights.sbomify.com/CVE-2022-37930/): Information disclosure in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays (medium 6.7)
- [CVE-2022-3793](https://insights.sbomify.com/CVE-2022-3793/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-37929](https://insights.sbomify.com/CVE-2022-37929/): Privilege escalation in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays (medium 6.7)
- [CVE-2022-37928](https://insights.sbomify.com/CVE-2022-37928/): Security feature bypass in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays (high 8.0)
- [CVE-2022-37927](https://insights.sbomify.com/CVE-2022-37927/): Open redirect in HPE OneView Global Dashboard (OVGD) (medium 6.1)
- [CVE-2022-37926](https://insights.sbomify.com/CVE-2022-37926/): Cross-site scripting in Aruba EdgeConnect Enterprise Software (medium 5.5)
- [CVE-2022-37925](https://insights.sbomify.com/CVE-2022-37925/): Cross-site scripting in Aruba EdgeConnect Enterprise Software (medium 6.1)
- [CVE-2022-37924](https://insights.sbomify.com/CVE-2022-37924/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-37923](https://insights.sbomify.com/CVE-2022-37923/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-37922](https://insights.sbomify.com/CVE-2022-37922/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-37921](https://insights.sbomify.com/CVE-2022-37921/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-37920](https://insights.sbomify.com/CVE-2022-37920/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-3792](https://insights.sbomify.com/CVE-2022-3792/): SQL Injection in GullsEye Terminal Operating System (critical 9.8)
- [CVE-2022-37919](https://insights.sbomify.com/CVE-2022-37919/): Denial of service in Aruba EdgeConnect Enterprise Software (high 7.5)
- [CVE-2022-37918](https://insights.sbomify.com/CVE-2022-37918/): Broken Access Control for some Web-based Management URLs in AirWave Management Platform (high 8.1)
- [CVE-2022-37917](https://insights.sbomify.com/CVE-2022-37917/): Broken Access Control for some Web-based Management URLs in AirWave Management Platform (high 8.1)
- [CVE-2022-37916](https://insights.sbomify.com/CVE-2022-37916/): Broken Access Control for some Web-based Management URLs in AirWave Management Platform (high 8.1)
- [CVE-2022-37915](https://insights.sbomify.com/CVE-2022-37915/): Command injection in Aruba EdgeConnect Enterprise Orchestrator (on-premises) (critical 9.8)
- [CVE-2022-37914](https://insights.sbomify.com/CVE-2022-37914/): Auth bypass in Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators (critical 9.8)
- [CVE-2022-37913](https://insights.sbomify.com/CVE-2022-37913/): Auth bypass in Aruba EdgeConnect Enterprise Orchestrator (on-premises), Aruba EdgeConnect Enterprise Orchestrator-as-a-Service, Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators (critical 9.8)
- [CVE-2022-37912](https://insights.sbomify.com/CVE-2022-37912/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37911](https://insights.sbomify.com/CVE-2022-37911/): XML external entity in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (low 3.8)
- [CVE-2022-37910](https://insights.sbomify.com/CVE-2022-37910/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 4.4)
- [CVE-2022-37909](https://insights.sbomify.com/CVE-2022-37909/): Information disclosure in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.3)
- [CVE-2022-37908](https://insights.sbomify.com/CVE-2022-37908/): Security feature bypass in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.8)
- [CVE-2022-37907](https://insights.sbomify.com/CVE-2022-37907/): Denial of service in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 5.8)
- [CVE-2022-37906](https://insights.sbomify.com/CVE-2022-37906/): Path traversal in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 6.5)
- [CVE-2022-37905](https://insights.sbomify.com/CVE-2022-37905/): Other in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 6.6)
- [CVE-2022-37904](https://insights.sbomify.com/CVE-2022-37904/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (medium 6.6)
- [CVE-2022-37903](https://insights.sbomify.com/CVE-2022-37903/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37902](https://insights.sbomify.com/CVE-2022-37902/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37901](https://insights.sbomify.com/CVE-2022-37901/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37900](https://insights.sbomify.com/CVE-2022-37900/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37899](https://insights.sbomify.com/CVE-2022-37899/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37898](https://insights.sbomify.com/CVE-2022-37898/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (high 7.2)
- [CVE-2022-37897](https://insights.sbomify.com/CVE-2022-37897/): Command injection in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (critical 9.8)
- [CVE-2022-37896](https://insights.sbomify.com/CVE-2022-37896/): Cross-site scripting in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (medium 6.1)
- [CVE-2022-37895](https://insights.sbomify.com/CVE-2022-37895/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (medium 4.9)
- [CVE-2022-37894](https://insights.sbomify.com/CVE-2022-37894/): Denial of service in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (medium 6.5)
- [CVE-2022-37893](https://insights.sbomify.com/CVE-2022-37893/): Command injection in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (high 7.8)
- [CVE-2022-37892](https://insights.sbomify.com/CVE-2022-37892/): Cross-site scripting in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (medium 5.4)
- [CVE-2022-37891](https://insights.sbomify.com/CVE-2022-37891/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-37890](https://insights.sbomify.com/CVE-2022-37890/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-3789](https://insights.sbomify.com/CVE-2022-3789/): Tim Campus Confession Wall share.php sql injection (medium 5.5)
- [CVE-2022-37889](https://insights.sbomify.com/CVE-2022-37889/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-37888](https://insights.sbomify.com/CVE-2022-37888/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-37887](https://insights.sbomify.com/CVE-2022-37887/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-37886](https://insights.sbomify.com/CVE-2022-37886/): Memory corruption in Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-37885](https://insights.sbomify.com/CVE-2022-37885/): Memory corruption in Aruba Access Points; 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; (critical 9.8)
- [CVE-2022-37884](https://insights.sbomify.com/CVE-2022-37884/): Denial of service in Aruba ClearPass Policy Manager (high 7.5)
- [CVE-2022-37883](https://insights.sbomify.com/CVE-2022-37883/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-37882](https://insights.sbomify.com/CVE-2022-37882/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-37881](https://insights.sbomify.com/CVE-2022-37881/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-37880](https://insights.sbomify.com/CVE-2022-37880/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-37879](https://insights.sbomify.com/CVE-2022-37879/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-37878](https://insights.sbomify.com/CVE-2022-37878/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-37877](https://insights.sbomify.com/CVE-2022-37877/): Privilege escalation in Aruba ClearPass Policy Manager (high 7.8)
- [CVE-2022-3787](https://insights.sbomify.com/CVE-2022-3787/): Privilege escalation in device-mapper-multipath (high 7.8)
- [CVE-2022-37866](https://insights.sbomify.com/CVE-2022-37866/): Apache Ivy allows path traversal in the presence of a malicious repository (high 7.5)
- [CVE-2022-37865](https://insights.sbomify.com/CVE-2022-37865/): Apache Ivy allows creating/overwriting any file on the system (critical 9.1)
- [CVE-2022-37864](https://insights.sbomify.com/CVE-2022-37864/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2022-37861](https://insights.sbomify.com/CVE-2022-37861/): Command injection in tenhot:tws-100 firmware (critical 9.8)
- [CVE-2022-37860](https://insights.sbomify.com/CVE-2022-37860/): Command injection in tp-link:m7350 firmware (critical 9.8)
- [CVE-2022-3786](https://insights.sbomify.com/CVE-2022-3786/): X.509 Email Address Variable Length Buffer Overflow (high 7.5)
- [CVE-2022-37857](https://insights.sbomify.com/CVE-2022-37857/): Hardcoded credentials in hauk project:hauk (high 7.5)
- [CVE-2022-3785](https://insights.sbomify.com/CVE-2022-3785/): Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow (medium 6.3)
- [CVE-2022-37843](https://insights.sbomify.com/CVE-2022-37843/): Command injection in totolink:a860r firmware (critical 9.8)
- [CVE-2022-37842](https://insights.sbomify.com/CVE-2022-37842/): Memory corruption in totolink:a860r firmware (critical 9.8)
- [CVE-2022-37841](https://insights.sbomify.com/CVE-2022-37841/): Hardcoded credentials in totolink:a860r firmware (high 7.5)
- [CVE-2022-37840](https://insights.sbomify.com/CVE-2022-37840/): Memory corruption in totolink:a860r firmware (critical 9.8)
- [CVE-2022-3784](https://insights.sbomify.com/CVE-2022-3784/): Axiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflow (medium 6.3)
- [CVE-2022-37839](https://insights.sbomify.com/CVE-2022-37839/): Memory corruption in totolink:a860r firmware (critical 9.8)
- [CVE-2022-37835](https://insights.sbomify.com/CVE-2022-37835/): Information disclosure in torguard:vpn (high 7.5)
- [CVE-2022-37832](https://insights.sbomify.com/CVE-2022-37832/): Hardcoded credentials in mutiny:mutiny (critical 9.8)
- [CVE-2022-37830](https://insights.sbomify.com/CVE-2022-37830/): Cross-site scripting in webjet:webjet cms (critical 9.6)
- [CVE-2022-3783](https://insights.sbomify.com/CVE-2022-3783/): node-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting (low 3.5)
- [CVE-2022-37824](https://insights.sbomify.com/CVE-2022-37824/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37823](https://insights.sbomify.com/CVE-2022-37823/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37822](https://insights.sbomify.com/CVE-2022-37822/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37821](https://insights.sbomify.com/CVE-2022-37821/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37820](https://insights.sbomify.com/CVE-2022-37820/): Memory corruption in tenda:ax1803 firmware (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/268/