# Vulnerabilities published in 2022


- [CVE-2022-32268](https://insights.sbomify.com/CVE-2022-32268/): Command injection in starwindsoftware:starwind san \& nas (high 8.8)
- [CVE-2022-32267](https://insights.sbomify.com/CVE-2022-32267/): Race condition in insyde:kernel (medium 6.4)
- [CVE-2022-32266](https://insights.sbomify.com/CVE-2022-32266/): Race condition in insyde:kernel (medium 6.4)
- [CVE-2022-32265](https://insights.sbomify.com/CVE-2022-32265/): Other in qdecoder project:qdecoder (medium 5.3)
- [CVE-2022-32264](https://insights.sbomify.com/CVE-2022-32264/): Denial of service in freebsd:freebsd (high 7.5)
- [CVE-2022-32263](https://insights.sbomify.com/CVE-2022-32263/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-32262](https://insights.sbomify.com/CVE-2022-32262/): Command injection in SINEMA Remote Connect Server (high 8.8)
- [CVE-2022-32261](https://insights.sbomify.com/CVE-2022-32261/): Misconfiguration in SINEMA Remote Connect Server (medium 5.3)
- [CVE-2022-32260](https://insights.sbomify.com/CVE-2022-32260/): Auth bypass in SINEMA Remote Connect Server (medium 6.5)
- [CVE-2022-3226](https://insights.sbomify.com/CVE-2022-3226/): Command injection in Sophos Firewall (high 7.2)
- [CVE-2022-32259](https://insights.sbomify.com/CVE-2022-32259/): Hardcoded credentials in SINEMA Remote Connect Server (medium 6.5)
- [CVE-2022-32258](https://insights.sbomify.com/CVE-2022-32258/): Information disclosure in SINEMA Remote Connect Server (medium 5.3)
- [CVE-2022-32257](https://insights.sbomify.com/CVE-2022-32257/): Missing authorization in SINEMA Remote Connect Server (critical 9.8)
- [CVE-2022-32256](https://insights.sbomify.com/CVE-2022-32256/): Missing authorization in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2022-32255](https://insights.sbomify.com/CVE-2022-32255/): Missing authorization in SINEMA Remote Connect Server (medium 5.3)
- [CVE-2022-32254](https://insights.sbomify.com/CVE-2022-32254/): Information disclosure in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2022-32253](https://insights.sbomify.com/CVE-2022-32253/): Information disclosure in SINEMA Remote Connect Server (medium 4.9)
- [CVE-2022-32252](https://insights.sbomify.com/CVE-2022-32252/): Security feature bypass in SINEMA Remote Connect Server (medium 6.5)
- [CVE-2022-32251](https://insights.sbomify.com/CVE-2022-32251/): Missing authorization in SINEMA Remote Connect Server (high 8.8)
- [CVE-2022-32250](https://insights.sbomify.com/CVE-2022-32250/): Use after free in debian:debian linux (high 7.8)
- [CVE-2022-3225](https://insights.sbomify.com/CVE-2022-3225/): Improper Control of Dynamically-Managed Code Resources in budibase/budibase (high 8.8)
- [CVE-2022-32249](https://insights.sbomify.com/CVE-2022-32249/): Information disclosure in SAP Business one (high 7.5)
- [CVE-2022-32248](https://insights.sbomify.com/CVE-2022-32248/): Other in SAP S/4HANA (medium 5.3)
- [CVE-2022-32247](https://insights.sbomify.com/CVE-2022-32247/): Cross-site scripting in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2022-32246](https://insights.sbomify.com/CVE-2022-32246/): SQL injection in SAP BusinessObjects Business Intelligence Platform (Visual Difference Application) (medium 4.6)
- [CVE-2022-32245](https://insights.sbomify.com/CVE-2022-32245/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (Open Document) (high 8.2)
- [CVE-2022-32244](https://insights.sbomify.com/CVE-2022-32244/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (Commentary DB) (medium 5.2)
- [CVE-2022-32243](https://insights.sbomify.com/CVE-2022-32243/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32242](https://insights.sbomify.com/CVE-2022-32242/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32241](https://insights.sbomify.com/CVE-2022-32241/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32240](https://insights.sbomify.com/CVE-2022-32240/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-3224](https://insights.sbomify.com/CVE-2022-3224/): Misinterpretation of Input in ionicabizau/parse-url (critical 9.4)
- [CVE-2022-32239](https://insights.sbomify.com/CVE-2022-32239/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32238](https://insights.sbomify.com/CVE-2022-32238/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32237](https://insights.sbomify.com/CVE-2022-32237/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32236](https://insights.sbomify.com/CVE-2022-32236/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32235](https://insights.sbomify.com/CVE-2022-32235/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 5.5)
- [CVE-2022-32234](https://insights.sbomify.com/CVE-2022-32234/): Memory corruption in Hermes (critical 9.8)
- [CVE-2022-32231](https://insights.sbomify.com/CVE-2022-32231/): Privilege escalation in Intel(R) Processors (high 7.5)
- [CVE-2022-32230](https://insights.sbomify.com/CVE-2022-32230/): SMBv3 FileNormalizedNameInformation NULL Pointer Dereference (high 7.5)
- [CVE-2022-3223](https://insights.sbomify.com/CVE-2022-3223/): Cross-site Scripting (XSS) - Stored in jgraph/drawio (medium 4.3)
- [CVE-2022-32229](https://insights.sbomify.com/CVE-2022-32229/): Information disclosure in Rocket.Chat (medium 4.3)
- [CVE-2022-32228](https://insights.sbomify.com/CVE-2022-32228/): Information disclosure in Rocket.Chat (medium 4.3)
- [CVE-2022-32227](https://insights.sbomify.com/CVE-2022-32227/): Information disclosure in Rocket.Chat (medium 6.5)
- [CVE-2022-32226](https://insights.sbomify.com/CVE-2022-32226/): Missing authorization in Rocket.Chat (medium 4.3)
- [CVE-2022-32225](https://insights.sbomify.com/CVE-2022-32225/): Cross-site scripting in Veeam Management Pack for Microsoft System Center (medium 6.1)
- [CVE-2022-32224](https://insights.sbomify.com/CVE-2022-32224/): Active Record RCE bug with Serialized Columns (critical 9.8)
- [CVE-2022-32223](https://insights.sbomify.com/CVE-2022-32223/): Other in Node (high 7.3)
- [CVE-2022-32222](https://insights.sbomify.com/CVE-2022-32222/): Misconfiguration in Node (medium 5.3)
- [CVE-2022-32221](https://insights.sbomify.com/CVE-2022-32221/): Use after free in https://github.com/curl/curl (critical 9.8)
- [CVE-2022-32220](https://insights.sbomify.com/CVE-2022-32220/): Missing authorization in Rocket.Chat (medium 6.5)
- [CVE-2022-3222](https://insights.sbomify.com/CVE-2022-3222/): Uncontrolled Recursion in gpac/gpac (medium 5.3)
- [CVE-2022-32219](https://insights.sbomify.com/CVE-2022-32219/): Information disclosure in Rocket.Chat (medium 4.3)
- [CVE-2022-32218](https://insights.sbomify.com/CVE-2022-32218/): Information disclosure in Rocket.chat (medium 4.3)
- [CVE-2022-32217](https://insights.sbomify.com/CVE-2022-32217/): Information disclosure in Rocket.chat (medium 5.3)
- [CVE-2022-32215](https://insights.sbomify.com/CVE-2022-32215/): Other in Node (medium 6.5)
- [CVE-2022-32214](https://insights.sbomify.com/CVE-2022-32214/): llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields (medium 6.5)
- [CVE-2022-32213](https://insights.sbomify.com/CVE-2022-32213/): llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding (medium 6.5)
- [CVE-2022-32212](https://insights.sbomify.com/CVE-2022-32212/): Command injection in Node (high 8.1)
- [CVE-2022-32211](https://insights.sbomify.com/CVE-2022-32211/): SQL injection in Rocket.Chat (high 8.8)
- [CVE-2022-32210](https://insights.sbomify.com/CVE-2022-32210/): ProxyAgent vulnerable to MITM (medium 6.5)
- [CVE-2022-3221](https://insights.sbomify.com/CVE-2022-3221/): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb (high 8.8)
- [CVE-2022-32209](https://insights.sbomify.com/CVE-2022-32209/): Rails::Html::Sanitizer vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2022-32208](https://insights.sbomify.com/CVE-2022-32208/): Security feature bypass in https://github.com/curl/curl (medium 5.9)
- [CVE-2022-32207](https://insights.sbomify.com/CVE-2022-32207/): Misconfiguration in https://github.com/curl/curl (critical 9.8)
- [CVE-2022-32206](https://insights.sbomify.com/CVE-2022-32206/): Denial of service in https://github.com/curl/curl (medium 6.5)
- [CVE-2022-32205](https://insights.sbomify.com/CVE-2022-32205/): Denial of service in https://github.com/curl/curl (medium 4.3)
- [CVE-2022-32204](https://insights.sbomify.com/CVE-2022-32204/): Other in CV81-WDM FW (high 7.5)
- [CVE-2022-32203](https://insights.sbomify.com/CVE-2022-32203/): Command injection in CV81-WDM FW (critical 9.8)
- [CVE-2022-32202](https://insights.sbomify.com/CVE-2022-32202/): Null dereference in libjpeg project:libjpeg (medium 5.5)
- [CVE-2022-32201](https://insights.sbomify.com/CVE-2022-32201/): Null dereference in libjpeg project:libjpeg (medium 5.5)
- [CVE-2022-32200](https://insights.sbomify.com/CVE-2022-32200/): Memory corruption in libdwarf project:libdwarf (high 7.8)
- [CVE-2022-3220](https://insights.sbomify.com/CVE-2022-3220/): Advanced Comment Form < 1.2.1 - Admin+ Authenticated Stored XSS (medium 4.8)
- [CVE-2022-32199](https://insights.sbomify.com/CVE-2022-32199/): Path traversal in scriptcase:scriptcase (medium 6.5)
- [CVE-2022-32195](https://insights.sbomify.com/CVE-2022-32195/): Cross-site scripting in edx:open edx (medium 6.1)
- [CVE-2022-32193](https://insights.sbomify.com/CVE-2022-32193/): Information disclosure in couchbase:couchbase server (medium 6.5)
- [CVE-2022-32192](https://insights.sbomify.com/CVE-2022-32192/): Information disclosure in couchbase:couchbase server (high 7.5)
- [CVE-2022-32190](https://insights.sbomify.com/CVE-2022-32190/): Failure to strip relative path components in net/url (high 7.5)
- [CVE-2022-3219](https://insights.sbomify.com/CVE-2022-3219/): Denial of service in gnupg (low 3.3)
- [CVE-2022-32189](https://insights.sbomify.com/CVE-2022-32189/): Panic when decoding Float and Rat types in math/big (high 7.5)
- [CVE-2022-3218](https://insights.sbomify.com/CVE-2022-3218/): Necta WiFi Mouse (Mouse Server) client-side authentication bypass (critical 9.8)
- [CVE-2022-32177](https://insights.sbomify.com/CVE-2022-32177/): Gin-vue-admin - Unrestricted File Upload (critical 9.0)
- [CVE-2022-32176](https://insights.sbomify.com/CVE-2022-32176/): Gin-vue-admin - Unrestricted File Upload (critical 9.0)
- [CVE-2022-32175](https://insights.sbomify.com/CVE-2022-32175/): AdGuardHome - CSRF (medium 5.4)
- [CVE-2022-32174](https://insights.sbomify.com/CVE-2022-32174/): Gogs - XSS (critical 9.0)
- [CVE-2022-32173](https://insights.sbomify.com/CVE-2022-32173/): OrchardCore - HTML Injection (medium 5.4)
- [CVE-2022-32172](https://insights.sbomify.com/CVE-2022-32172/): Zinc - Cross-Site Scripting (not scored)
- [CVE-2022-32171](https://insights.sbomify.com/CVE-2022-32171/): Zinc - Stored XSS (not scored)
- [CVE-2022-32170](https://insights.sbomify.com/CVE-2022-32170/): bytebase - Improper Authorization (medium 4.3)
- [CVE-2022-3217](https://insights.sbomify.com/CVE-2022-3217/): Weak cryptography in VISAM VBASE (high 7.5)
- [CVE-2022-32169](https://insights.sbomify.com/CVE-2022-32169/): bytebase - Improper Authorization (medium 4.3)
- [CVE-2022-32168](https://insights.sbomify.com/CVE-2022-32168/): notepad-plus-plus - DLL Hijacking (high 7.8)
- [CVE-2022-32167](https://insights.sbomify.com/CVE-2022-32167/): Cloudreve - Stored XSS (medium 5.4)
- [CVE-2022-32166](https://insights.sbomify.com/CVE-2022-32166/): ovs - buffer over-read (medium 6.1)
- [CVE-2022-3216](https://insights.sbomify.com/CVE-2022-3216/): Nintendo Game Boy Color Mobile Adapter GB Tetsuji memory corruption (medium 5.0)
- [CVE-2022-32159](https://insights.sbomify.com/CVE-2022-32159/): Openlibrary - Stored XSS (low 3.5)
- [CVE-2022-32158](https://insights.sbomify.com/CVE-2022-32158/): Splunk Enterprise deployment servers allow client publishing of forwarder bundles (critical 9.0)
- [CVE-2022-32157](https://insights.sbomify.com/CVE-2022-32157/): Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads (high 7.5)
- [CVE-2022-32156](https://insights.sbomify.com/CVE-2022-32156/): Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation (high 7.4)
- [CVE-2022-32155](https://insights.sbomify.com/CVE-2022-32155/): Universal Forwarder management services allows remote login by default (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/310/