# Vulnerabilities published in 2022


- [CVE-2022-3172](https://insights.sbomify.com/CVE-2022-3172/): Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF) (medium 5.1)
- [CVE-2022-31711](https://insights.sbomify.com/CVE-2022-31711/): Information disclosure in vRealize Log Insight (vRLI) (medium 5.3)
- [CVE-2022-31710](https://insights.sbomify.com/CVE-2022-31710/): Deserialization in vRealize Log Insight (vRLI) (high 7.5)
- [CVE-2022-3171](https://insights.sbomify.com/CVE-2022-3171/): Memory handling vulnerability in ProtocolBuffers Java core and lite (medium 4.3)
- [CVE-2022-31708](https://insights.sbomify.com/CVE-2022-31708/): Missing authorization in VMware vRealize Operations (vROps) (medium 4.9)
- [CVE-2022-31707](https://insights.sbomify.com/CVE-2022-31707/): Privilege escalation in VMware vRealize Operations (vROps) (high 7.2)
- [CVE-2022-31706](https://insights.sbomify.com/CVE-2022-31706/): Path traversal in vRealize Log Insight (vRLI) (critical 9.8)
- [CVE-2022-31705](https://insights.sbomify.com/CVE-2022-31705/): Memory corruption in VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro / Fusion (Fusion), VMware Cloud Foundation (high 8.2)
- [CVE-2022-31704](https://insights.sbomify.com/CVE-2022-31704/): Missing authorization in vRealize Log Insight (vRLI) (critical 9.8)
- [CVE-2022-31703](https://insights.sbomify.com/CVE-2022-31703/): Path traversal in vRealize Log Insight (vRLI) (high 7.5)
- [CVE-2022-31702](https://insights.sbomify.com/CVE-2022-31702/): Command injection in VMware vRealize Network Insight (vRNI) (critical 9.8)
- [CVE-2022-31701](https://insights.sbomify.com/CVE-2022-31701/): Auth bypass in VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM) (medium 5.3)
- [CVE-2022-31700](https://insights.sbomify.com/CVE-2022-31700/): Other in VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM) (high 7.2)
- [CVE-2022-3170](https://insights.sbomify.com/CVE-2022-3170/): Memory corruption in kernel (high 7.8)
- [CVE-2022-31699](https://insights.sbomify.com/CVE-2022-31699/): Memory corruption in VMware ESXi, VMware Cloud Foundation (low 3.3)
- [CVE-2022-31698](https://insights.sbomify.com/CVE-2022-31698/): Denial of service in VMware vCenter Server, VMware Cloud Foundation (medium 5.3)
- [CVE-2022-31697](https://insights.sbomify.com/CVE-2022-31697/): Information disclosure in VMware vCenter Server, VMware Cloud Foundation (medium 5.5)
- [CVE-2022-31696](https://insights.sbomify.com/CVE-2022-31696/): Memory corruption in VMware ESXi, VMware Cloud Foundation (high 8.8)
- [CVE-2022-31694](https://insights.sbomify.com/CVE-2022-31694/): Other in VMware InstallBuilder (high 7.3)
- [CVE-2022-31693](https://insights.sbomify.com/CVE-2022-31693/): Denial of service in vmware:tools (medium 5.5)
- [CVE-2022-31692](https://insights.sbomify.com/CVE-2022-31692/): Spring Security authorization rules can be bypassed via forward or include dispatcher types (critical 9.8)
- [CVE-2022-31691](https://insights.sbomify.com/CVE-2022-31691/): Code injection in Spring by VMware (critical 9.8)
- [CVE-2022-31690](https://insights.sbomify.com/CVE-2022-31690/): spring-security-oauth2-client vulnerable to Privilege Escalation (high 8.1)
- [CVE-2022-3169](https://insights.sbomify.com/CVE-2022-3169/): Denial of service in Kernel (medium 5.5)
- [CVE-2022-31689](https://insights.sbomify.com/CVE-2022-31689/): Auth bypass in VMware Workspace ONE Assist (critical 9.8)
- [CVE-2022-31688](https://insights.sbomify.com/CVE-2022-31688/): Cross-site scripting in VMware Workspace ONE Assist (medium 6.1)
- [CVE-2022-31687](https://insights.sbomify.com/CVE-2022-31687/): Missing authorization in VMware Workspace ONE Assist (critical 9.8)
- [CVE-2022-31686](https://insights.sbomify.com/CVE-2022-31686/): Auth bypass in VMware Workspace ONE Assist (critical 9.8)
- [CVE-2022-31685](https://insights.sbomify.com/CVE-2022-31685/): Auth bypass in VMware Workspace ONE Assist (critical 9.8)
- [CVE-2022-31684](https://insights.sbomify.com/CVE-2022-31684/): Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens (medium 4.3)
- [CVE-2022-31683](https://insights.sbomify.com/CVE-2022-31683/): Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution (medium 5.4)
- [CVE-2022-31682](https://insights.sbomify.com/CVE-2022-31682/): Path traversal in VMware Aria Operations (medium 4.9)
- [CVE-2022-31681](https://insights.sbomify.com/CVE-2022-31681/): Null dereference in VMware ESXi (medium 6.5)
- [CVE-2022-31680](https://insights.sbomify.com/CVE-2022-31680/): Deserialization in VMware vCenter Server (critical 9.1)
- [CVE-2022-31679](https://insights.sbomify.com/CVE-2022-31679/): Spring Data REST can expose hidden entity attributes (low 3.7)
- [CVE-2022-31678](https://insights.sbomify.com/CVE-2022-31678/): XML external entity in VMware Cloud Foundation (NSX-V) (critical 9.1)
- [CVE-2022-31677](https://insights.sbomify.com/CVE-2022-31677/): Pinniped Supervisor Insufficient Session Expiration vulnerability (medium 5.4)
- [CVE-2022-31676](https://insights.sbomify.com/CVE-2022-31676/): Privilege escalation in VMware Tools (high 7.8)
- [CVE-2022-31675](https://insights.sbomify.com/CVE-2022-31675/): Auth bypass in VMware vRealize Operations (high 7.5)
- [CVE-2022-31674](https://insights.sbomify.com/CVE-2022-31674/): Information disclosure in VMware vRealize Operations (medium 4.3)
- [CVE-2022-31673](https://insights.sbomify.com/CVE-2022-31673/): Information disclosure in VMware vRealize Operations (high 8.8)
- [CVE-2022-31672](https://insights.sbomify.com/CVE-2022-31672/): Privilege escalation in VMware vRealize Operations (medium 6.4)
- [CVE-2022-31671](https://insights.sbomify.com/CVE-2022-31671/): Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs (high 7.4)
- [CVE-2022-31670](https://insights.sbomify.com/CVE-2022-31670/): Harbor fails to validate the user permissions when updating tag retention policies (high 7.7)
- [CVE-2022-3167](https://insights.sbomify.com/CVE-2022-3167/): Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb (critical 10.0)
- [CVE-2022-31669](https://insights.sbomify.com/CVE-2022-31669/): Harbor fails to validate the user permissions when updating tag immutability policies (medium 6.4)
- [CVE-2022-31668](https://insights.sbomify.com/CVE-2022-31668/): User permission validation failure and disclosure of P2P preheat execution logs (high 7.4)
- [CVE-2022-31667](https://insights.sbomify.com/CVE-2022-31667/): Harbor fails to validate the user permissions when updating a robot account (medium 6.4)
- [CVE-2022-31666](https://insights.sbomify.com/CVE-2022-31666/): Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies (high 7.7)
- [CVE-2022-31665](https://insights.sbomify.com/CVE-2022-31665/): Code injection in VMware Workspace ONE Access, Identity Manager and vRealize Automation (high 7.2)
- [CVE-2022-31664](https://insights.sbomify.com/CVE-2022-31664/): Privilege escalation in VMware Workspace ONE Access, Identity Manager and vRealize Automation (high 7.8)
- [CVE-2022-31663](https://insights.sbomify.com/CVE-2022-31663/): Cross-site scripting in VMware Workspace ONE Access, Identity Manager and vRealize Automation (medium 6.1)
- [CVE-2022-31662](https://insights.sbomify.com/CVE-2022-31662/): Path traversal in VMware Workspace ONE Access, Access Connector, Identity Manager, vIDM Connector and vRealize Automation (high 7.5)
- [CVE-2022-31661](https://insights.sbomify.com/CVE-2022-31661/): Privilege escalation in VMware Workspace ONE Access, Identity Manager and vRealize Automation (high 7.8)
- [CVE-2022-31660](https://insights.sbomify.com/CVE-2022-31660/): Privilege escalation in VMware Workspace ONE Access, Identity Manager and vRealize Automation (high 7.8)
- [CVE-2022-3166](https://insights.sbomify.com/CVE-2022-3166/): MicroLogix 1100 & 1400 Product Web Server Application Vulnerable to Denial-Of-Service Condition Attack (high 7.5)
- [CVE-2022-31659](https://insights.sbomify.com/CVE-2022-31659/): SQL injection in VMware Workspace ONE Access, Identity Manager and vRealize Automation (high 7.2)
- [CVE-2022-31658](https://insights.sbomify.com/CVE-2022-31658/): Code injection in VMware Workspace ONE Access, Identity Manager and vRealize Automation (high 7.2)
- [CVE-2022-31657](https://insights.sbomify.com/CVE-2022-31657/): Open redirect in VMware Workspace ONE Access, Identity Manager and vRealize Automation (critical 9.8)
- [CVE-2022-31656](https://insights.sbomify.com/CVE-2022-31656/): Auth bypass in VMware Workspace ONE Access, Identity Manager and vRealize Automation (critical 9.8)
- [CVE-2022-31655](https://insights.sbomify.com/CVE-2022-31655/): Cross-site scripting in VMware vRealize Log Insight (medium 5.4)
- [CVE-2022-31654](https://insights.sbomify.com/CVE-2022-31654/): Cross-site scripting in VMware vRealize Log Insight (medium 5.4)
- [CVE-2022-31651](https://insights.sbomify.com/CVE-2022-31651/): Denial of service in sound exchange project:sound exchange (medium 5.5)
- [CVE-2022-31650](https://insights.sbomify.com/CVE-2022-31650/): Denial of service in sound exchange project:sound exchange (medium 5.5)
- [CVE-2022-3165](https://insights.sbomify.com/CVE-2022-3165/): Integer overflow in QEMU (medium 6.5)
- [CVE-2022-31649](https://insights.sbomify.com/CVE-2022-31649/): Information disclosure in owncloud:owncloud (high 7.5)
- [CVE-2022-31648](https://insights.sbomify.com/CVE-2022-31648/): Cross-site scripting in talend:administration center (medium 6.1)
- [CVE-2022-31647](https://insights.sbomify.com/CVE-2022-31647/): Path traversal in docker:desktop (high 7.1)
- [CVE-2022-31646](https://insights.sbomify.com/CVE-2022-31646/): Other in HP PC BIOS (high 7.8)
- [CVE-2022-31645](https://insights.sbomify.com/CVE-2022-31645/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-31644](https://insights.sbomify.com/CVE-2022-31644/): Other in HP PC BIOS (high 7.8)
- [CVE-2022-31643](https://insights.sbomify.com/CVE-2022-31643/): Other in HP PC BIOS (medium 5.5)
- [CVE-2022-31642](https://insights.sbomify.com/CVE-2022-31642/): Race condition in HP PC BIOS (high 7.0)
- [CVE-2022-31641](https://insights.sbomify.com/CVE-2022-31641/): Race condition in HP PC BIOS (high 7.0)
- [CVE-2022-31640](https://insights.sbomify.com/CVE-2022-31640/): Race condition in HP PC BIOS (high 7.0)
- [CVE-2022-31639](https://insights.sbomify.com/CVE-2022-31639/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-31638](https://insights.sbomify.com/CVE-2022-31638/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-31637](https://insights.sbomify.com/CVE-2022-31637/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-31636](https://insights.sbomify.com/CVE-2022-31636/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-31635](https://insights.sbomify.com/CVE-2022-31635/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-31631](https://insights.sbomify.com/CVE-2022-31631/): PDO::quote() may return unquoted string (critical 9.1)
- [CVE-2022-31630](https://insights.sbomify.com/CVE-2022-31630/): OOB read due to insufficient input validation in imageloadfont() (medium 6.5)
- [CVE-2022-31629](https://insights.sbomify.com/CVE-2022-31629/): $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities (medium 6.5)
- [CVE-2022-31628](https://insights.sbomify.com/CVE-2022-31628/): phar wrapper can occur dos when using quine gzip file (low 2.3)
- [CVE-2022-31627](https://insights.sbomify.com/CVE-2022-31627/): Heap buffer overflow in finfo_buffer (high 7.7)
- [CVE-2022-31626](https://insights.sbomify.com/CVE-2022-31626/): mysqlnd/pdo password buffer overflow (high 7.5)
- [CVE-2022-31625](https://insights.sbomify.com/CVE-2022-31625/): Freeing unallocated memory in php_pgsql_free_params() (high 8.1)
- [CVE-2022-31624](https://insights.sbomify.com/CVE-2022-31624/): Denial of service in mariadb:mariadb (medium 5.5)
- [CVE-2022-31623](https://insights.sbomify.com/CVE-2022-31623/): Denial of service in mariadb:mariadb (medium 5.5)
- [CVE-2022-31622](https://insights.sbomify.com/CVE-2022-31622/): Denial of service in mariadb:mariadb (medium 5.5)
- [CVE-2022-31621](https://insights.sbomify.com/CVE-2022-31621/): Denial of service in mariadb:mariadb (medium 5.3)
- [CVE-2022-31620](https://insights.sbomify.com/CVE-2022-31620/): Denial of service in libjpeg project:libjpeg (medium 6.5)
- [CVE-2022-3162](https://insights.sbomify.com/CVE-2022-3162/): Unauthorized read of Custom Resources (medium 6.5)
- [CVE-2022-31619](https://insights.sbomify.com/CVE-2022-31619/): Hardcoded credentials in Teamcenter V12.4 (high 8.8)
- [CVE-2022-31618](https://insights.sbomify.com/CVE-2022-31618/): Null dereference in NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming (medium 5.5)
- [CVE-2022-31617](https://insights.sbomify.com/CVE-2022-31617/): Memory corruption in NVIDIA Cloud Gaming (guest driver) (high 7.8)
- [CVE-2022-31616](https://insights.sbomify.com/CVE-2022-31616/): Memory corruption in NVIDIA Cloud Gaming (guest driver) (medium 6.1)
- [CVE-2022-31615](https://insights.sbomify.com/CVE-2022-31615/): Null dereference in GeForce, Workstation, Compute (medium 5.5)
- [CVE-2022-31614](https://insights.sbomify.com/CVE-2022-31614/): Memory corruption in NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming (high 7.0)
- [CVE-2022-31613](https://insights.sbomify.com/CVE-2022-31613/): Null dereference in NVIDIA Cloud Gaming (guest driver) (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/314/