# Vulnerabilities published in 2022


- [CVE-2022-35721](https://insights.sbomify.com/CVE-2022-35721/): Cross-site scripting in Jazz for Service Management (medium 6.4)
- [CVE-2022-35720](https://insights.sbomify.com/CVE-2022-35720/): IBM Sterling External Authentication Server information disclosure (low 2.3)
- [CVE-2022-3572](https://insights.sbomify.com/CVE-2022-3572/): Cross-site scripting in GitLab (critical 9.3)
- [CVE-2022-35719](https://insights.sbomify.com/CVE-2022-35719/): Information disclosure in MQ Internet Pass-Thru (medium 5.1)
- [CVE-2022-35717](https://insights.sbomify.com/CVE-2022-35717/): Command injection in IBM InfoSphere Information Server (high 7.8)
- [CVE-2022-35716](https://insights.sbomify.com/CVE-2022-35716/): Missing authorization in UrbanCode Deploy (medium 5.3)
- [CVE-2022-35715](https://insights.sbomify.com/CVE-2022-35715/): Information disclosure in InfoSphere Information Server (medium 5.3)
- [CVE-2022-35714](https://insights.sbomify.com/CVE-2022-35714/): Cross-site scripting in Maximo Asset Management (medium 5.4)
- [CVE-2022-35713](https://insights.sbomify.com/CVE-2022-35713/): Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35712](https://insights.sbomify.com/CVE-2022-35712/): Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-35711](https://insights.sbomify.com/CVE-2022-35711/): Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-35710](https://insights.sbomify.com/CVE-2022-35710/): Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-35709](https://insights.sbomify.com/CVE-2022-35709/): Adobe Bridge DCM File Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-35708](https://insights.sbomify.com/CVE-2022-35708/): Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35707](https://insights.sbomify.com/CVE-2022-35707/): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35706](https://insights.sbomify.com/CVE-2022-35706/): Adobe Bridge SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35705](https://insights.sbomify.com/CVE-2022-35705/): Adobe Bridge MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35704](https://insights.sbomify.com/CVE-2022-35704/): Adobe Bridge SVG File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35703](https://insights.sbomify.com/CVE-2022-35703/): Adobe Bridge SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35702](https://insights.sbomify.com/CVE-2022-35702/): Adobe Bridge SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35701](https://insights.sbomify.com/CVE-2022-35701/): Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35700](https://insights.sbomify.com/CVE-2022-35700/): Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-3570](https://insights.sbomify.com/CVE-2022-3570/): Memory corruption in libtiff (high 7.7)
- [CVE-2022-35699](https://insights.sbomify.com/CVE-2022-35699/): Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35698](https://insights.sbomify.com/CVE-2022-35698/): Adobe Commerce Stored XSS Arbitrary code execution (critical 10.0)
- [CVE-2022-35697](https://insights.sbomify.com/CVE-2022-35697/): AEM File Upload Security Issue leading to RXSS (medium 5.4)
- [CVE-2022-35696](https://insights.sbomify.com/CVE-2022-35696/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-35695](https://insights.sbomify.com/CVE-2022-35695/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-35694](https://insights.sbomify.com/CVE-2022-35694/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-35693](https://insights.sbomify.com/CVE-2022-35693/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-35692](https://insights.sbomify.com/CVE-2022-35692/): Adobe Commerce Improper Access Control Security feature bypass (medium 5.3)
- [CVE-2022-35691](https://insights.sbomify.com/CVE-2022-35691/): Adobe Acrobat Reader NULL Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2022-35690](https://insights.sbomify.com/CVE-2022-35690/): Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-3569](https://insights.sbomify.com/CVE-2022-3569/): Privilege escalation in Zimbra Collaboration Suite (ZCS) (high 7.8)
- [CVE-2022-35689](https://insights.sbomify.com/CVE-2022-35689/): Adobe Commerce Improper Access Control Security feature bypass (medium 5.3)
- [CVE-2022-3568](https://insights.sbomify.com/CVE-2022-3568/): ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization (high 8.8)
- [CVE-2022-35678](https://insights.sbomify.com/CVE-2022-35678/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-35677](https://insights.sbomify.com/CVE-2022-35677/): Adobe FrameMaker SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35676](https://insights.sbomify.com/CVE-2022-35676/): Adobe FrameMaker SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35675](https://insights.sbomify.com/CVE-2022-35675/): Adobe FrameMaker SVG File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35674](https://insights.sbomify.com/CVE-2022-35674/): Adobe FrameMaker SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35673](https://insights.sbomify.com/CVE-2022-35673/): Adobe FrameMaker SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35672](https://insights.sbomify.com/CVE-2022-35672/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35671](https://insights.sbomify.com/CVE-2022-35671/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-35670](https://insights.sbomify.com/CVE-2022-35670/): Adobe Acrobat Reader Use-After-Free Memory leak (medium 5.5)
- [CVE-2022-3567](https://insights.sbomify.com/CVE-2022-3567/): Linux Kernel IPv6 inet6_dgram_ops race condition (medium 4.6)
- [CVE-2022-35669](https://insights.sbomify.com/CVE-2022-35669/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-35668](https://insights.sbomify.com/CVE-2022-35668/): Adobe Acrobat Reader Improper Input Validation Memory leak (medium 5.5)
- [CVE-2022-35667](https://insights.sbomify.com/CVE-2022-35667/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35666](https://insights.sbomify.com/CVE-2022-35666/): Adobe Acrobat Reader Improper Input Validation Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-35665](https://insights.sbomify.com/CVE-2022-35665/): Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution (high 7.8)
- [CVE-2022-35664](https://insights.sbomify.com/CVE-2022-35664/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-3566](https://insights.sbomify.com/CVE-2022-3566/): Linux Kernel TCP tcp_setsockopt race condition (low 2.1)
- [CVE-2022-35656](https://insights.sbomify.com/CVE-2022-35656/): Cross-site request forgery in Pega Infinity (medium 6.8)
- [CVE-2022-35655](https://insights.sbomify.com/CVE-2022-35655/): Cross-site scripting in Pega Infinity (medium 6.1)
- [CVE-2022-35654](https://insights.sbomify.com/CVE-2022-35654/): Cross-site scripting in Pega Infinity (medium 6.1)
- [CVE-2022-35653](https://insights.sbomify.com/CVE-2022-35653/): Moodle LTI module reflected XSS risk (medium 6.1)
- [CVE-2022-35652](https://insights.sbomify.com/CVE-2022-35652/): Moodle Open redirect risk in mobile auto-login feature (medium 6.1)
- [CVE-2022-35651](https://insights.sbomify.com/CVE-2022-35651/): Moodle Stored XSS and blind SSRF possible via SCORM track details (medium 6.1)
- [CVE-2022-35650](https://insights.sbomify.com/CVE-2022-35650/): Moodle Arbitrary file read when importing lesson questions (high 7.5)
- [CVE-2022-3565](https://insights.sbomify.com/CVE-2022-3565/): Linux Kernel Bluetooth l1oip_core.c del_timer use after free (medium 4.6)
- [CVE-2022-35649](https://insights.sbomify.com/CVE-2022-35649/): Moodle PostScript Code Injection (critical 9.8)
- [CVE-2022-35648](https://insights.sbomify.com/CVE-2022-35648/): Other in nautilus:t616 firmware (low 2.6)
- [CVE-2022-35646](https://insights.sbomify.com/CVE-2022-35646/): IBM Security Verify Governance, Identity Manager security bypass (medium 5.9)
- [CVE-2022-35645](https://insights.sbomify.com/CVE-2022-35645/): IBM Maximo Asset Management cross-site scripting (medium 6.4)
- [CVE-2022-35643](https://insights.sbomify.com/CVE-2022-35643/): Other in PowerVM VIOS (critical 9.1)
- [CVE-2022-35642](https://insights.sbomify.com/CVE-2022-35642/): Cross-site scripting in IBM InfoSphere Information Server (medium 5.4)
- [CVE-2022-35640](https://insights.sbomify.com/CVE-2022-35640/): IBM Sterling Partner Engagement Manager information disclosure (medium 4.0)
- [CVE-2022-3564](https://insights.sbomify.com/CVE-2022-3564/): Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free (medium 5.5)
- [CVE-2022-35639](https://insights.sbomify.com/CVE-2022-35639/): Denial of service in Sterling Partner Engagement Manager (high 7.5)
- [CVE-2022-35638](https://insights.sbomify.com/CVE-2022-35638/): IBM Sterling B2B Integrator cross-site request forgery (medium 4.3)
- [CVE-2022-35637](https://insights.sbomify.com/CVE-2022-35637/): Denial of service in DB2 for Linux, UNIX and Windows (medium 6.5)
- [CVE-2022-35632](https://insights.sbomify.com/CVE-2022-35632/): XSS in User Interface (medium 4.8)
- [CVE-2022-35631](https://insights.sbomify.com/CVE-2022-35631/): Filesystem race on temporary files (medium 5.5)
- [CVE-2022-35630](https://insights.sbomify.com/CVE-2022-35630/): Unsafe HTML Injection in Artifact Collection Report (medium 6.1)
- [CVE-2022-3563](https://insights.sbomify.com/CVE-2022-3563/): Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereference (low 3.5)
- [CVE-2022-35629](https://insights.sbomify.com/CVE-2022-35629/): Velociraptor Client ID Spoofing (medium 5.4)
- [CVE-2022-35628](https://insights.sbomify.com/CVE-2022-35628/): SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation" (critical 9.8)
- [CVE-2022-35624](https://insights.sbomify.com/CVE-2022-35624/): Memory corruption in nordicsemi:nrf5 sdk for mesh (high 8.2)
- [CVE-2022-35623](https://insights.sbomify.com/CVE-2022-35623/): Memory corruption in nordicsemi:nrf5 sdk for mesh (high 8.2)
- [CVE-2022-35621](https://insights.sbomify.com/CVE-2022-35621/): Missing authorization in evohclaimable project:evohclaimable (medium 5.3)
- [CVE-2022-35620](https://insights.sbomify.com/CVE-2022-35620/): Code injection in dlink:dir-818l firmware (critical 9.8)
- [CVE-2022-3562](https://insights.sbomify.com/CVE-2022-3562/): Cross-site Scripting (XSS) - Stored in librenms/librenms (medium 4.3)
- [CVE-2022-35619](https://insights.sbomify.com/CVE-2022-35619/): Command injection in dlink:dir-818l firmware (critical 9.8)
- [CVE-2022-35613](https://insights.sbomify.com/CVE-2022-35613/): Cross-site request forgery in konker:konker platform (high 8.8)
- [CVE-2022-35612](https://insights.sbomify.com/CVE-2022-35612/): Cross-site scripting in bevywise:mqttroute (medium 5.4)
- [CVE-2022-35611](https://insights.sbomify.com/CVE-2022-35611/): Cross-site request forgery in bevywise:mqttroute (medium 4.3)
- [CVE-2022-3561](https://insights.sbomify.com/CVE-2022-3561/): Cross-site Scripting (XSS) - Generic in librenms/librenms (medium 4.3)
- [CVE-2022-35606](https://insights.sbomify.com/CVE-2022-35606/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-35605](https://insights.sbomify.com/CVE-2022-35605/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-35603](https://insights.sbomify.com/CVE-2022-35603/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-35602](https://insights.sbomify.com/CVE-2022-35602/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-35601](https://insights.sbomify.com/CVE-2022-35601/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-3560](https://insights.sbomify.com/CVE-2022-3560/): Path traversal in pesign (medium 5.5)
- [CVE-2022-35599](https://insights.sbomify.com/CVE-2022-35599/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-35598](https://insights.sbomify.com/CVE-2022-35598/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (critical 9.8)
- [CVE-2022-35590](https://insights.sbomify.com/CVE-2022-35590/): ForkCMS XSS via `end_date` parameter (medium 4.8)
- [CVE-2022-3559](https://insights.sbomify.com/CVE-2022-3559/): Exim Regex use after free (medium 4.6)
- [CVE-2022-35589](https://insights.sbomify.com/CVE-2022-35589/): ForkCMS XSS via `publish_on_time` parameter (medium 4.8)
- [CVE-2022-35587](https://insights.sbomify.com/CVE-2022-35587/): ForkCMS XSS via `publish_on_date` parameter (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/285/