# Vulnerabilities published in 2022


- [CVE-2022-31238](https://insights.sbomify.com/CVE-2022-31238/): Information disclosure in PowerScale OneFS (medium 4.7)
- [CVE-2022-31237](https://insights.sbomify.com/CVE-2022-31237/): Information disclosure in PowerScale OneFS (low 3.3)
- [CVE-2022-31234](https://insights.sbomify.com/CVE-2022-31234/): Auth bypass in PowerStore (high 8.1)
- [CVE-2022-31233](https://insights.sbomify.com/CVE-2022-31233/): Privilege escalation in Unisphere for PowerMax (medium 6.3)
- [CVE-2022-31232](https://insights.sbomify.com/CVE-2022-31232/): Command injection in Smart Fabric Storage Software (high 8.6)
- [CVE-2022-31231](https://insights.sbomify.com/CVE-2022-31231/): Missing authorization in ECS (medium 5.9)
- [CVE-2022-31230](https://insights.sbomify.com/CVE-2022-31230/): Weak cryptography in PowerScale OneFS (high 8.1)
- [CVE-2022-3123](https://insights.sbomify.com/CVE-2022-3123/): Cross-site Scripting (XSS) - Reflected in splitbrain/dokuwiki (medium 5.4)
- [CVE-2022-31229](https://insights.sbomify.com/CVE-2022-31229/): Information disclosure in PowerScale OneFS (critical 9.6)
- [CVE-2022-31228](https://insights.sbomify.com/CVE-2022-31228/): Auth bypass in XtremIO (high 8.1)
- [CVE-2022-31226](https://insights.sbomify.com/CVE-2022-31226/): Memory corruption in CPG BIOS (high 7.1)
- [CVE-2022-31225](https://insights.sbomify.com/CVE-2022-31225/): Other in CPG BIOS (low 3.0)
- [CVE-2022-31224](https://insights.sbomify.com/CVE-2022-31224/): Security feature bypass in CPG BIOS (low 2.0)
- [CVE-2022-31223](https://insights.sbomify.com/CVE-2022-31223/): Information disclosure in CPG BIOS (low 2.3)
- [CVE-2022-31222](https://insights.sbomify.com/CVE-2022-31222/): Denial of service in CPG BIOS (low 2.3)
- [CVE-2022-31221](https://insights.sbomify.com/CVE-2022-31221/): Information disclosure in CPG BIOS (low 2.3)
- [CVE-2022-31220](https://insights.sbomify.com/CVE-2022-31220/): Other in CPG BIOS (low 3.0)
- [CVE-2022-3122](https://insights.sbomify.com/CVE-2022-3122/): SourceCodester Clinics Patient Management System medicine_details.php sql injection (medium 6.3)
- [CVE-2022-31219](https://insights.sbomify.com/CVE-2022-31219/): Drive Composer Link Following Local Privilege Escalation Vulnerability (high 7.3)
- [CVE-2022-31218](https://insights.sbomify.com/CVE-2022-31218/): Drive Composer Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2022-31217](https://insights.sbomify.com/CVE-2022-31217/): Drive Composer Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2022-31216](https://insights.sbomify.com/CVE-2022-31216/): Drive Composer Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2022-31215](https://insights.sbomify.com/CVE-2022-31215/): Security feature bypass in goverlan:client agent (medium 6.5)
- [CVE-2022-31214](https://insights.sbomify.com/CVE-2022-31214/): Privilege escalation in debian:debian linux (high 7.8)
- [CVE-2022-31213](https://insights.sbomify.com/CVE-2022-31213/): Null dereference in dbus-broker project:dbus-broker (high 7.5)
- [CVE-2022-31212](https://insights.sbomify.com/CVE-2022-31212/): Memory corruption in dbus-broker project:dbus-broker (high 7.5)
- [CVE-2022-31211](https://insights.sbomify.com/CVE-2022-31211/): Hardcoded credentials in infiray:iray-a8z3 firmware (critical 9.8)
- [CVE-2022-31210](https://insights.sbomify.com/CVE-2022-31210/): Hardcoded credentials in infiray:iray-a8z3 firmware (critical 9.8)
- [CVE-2022-3121](https://insights.sbomify.com/CVE-2022-3121/): SourceCodester Online Employee Leave Management System addemployee.php cross-site request forgery (medium 4.3)
- [CVE-2022-31209](https://insights.sbomify.com/CVE-2022-31209/): Memory corruption in infiray:iray-a8z3 firmware (critical 9.8)
- [CVE-2022-31208](https://insights.sbomify.com/CVE-2022-31208/): Command injection in infiray:iray-a8z3 firmware (high 8.8)
- [CVE-2022-31207](https://insights.sbomify.com/CVE-2022-31207/): Security feature bypass in omron:cp1w-cif41 firmware (critical 9.8)
- [CVE-2022-31206](https://insights.sbomify.com/CVE-2022-31206/): Security feature bypass in omron:nj101-1000 firmware (critical 9.8)
- [CVE-2022-31205](https://insights.sbomify.com/CVE-2022-31205/): Information disclosure in omron:cp1w-cif41 firmware (high 7.5)
- [CVE-2022-31204](https://insights.sbomify.com/CVE-2022-31204/): Information disclosure in omron:cp1w-cif41 firmware (high 7.5)
- [CVE-2022-31202](https://insights.sbomify.com/CVE-2022-31202/): Path traversal in monitoringsoft:softguard web (medium 6.5)
- [CVE-2022-31201](https://insights.sbomify.com/CVE-2022-31201/): Cross-site scripting in monitoringsoft:softguard web (medium 5.4)
- [CVE-2022-31200](https://insights.sbomify.com/CVE-2022-31200/): Cross-site scripting in atmail:atmail (medium 6.1)
- [CVE-2022-3120](https://insights.sbomify.com/CVE-2022-3120/): SourceCodester Clinics Patient Management System Login index.php sql injection (high 7.3)
- [CVE-2022-31199](https://insights.sbomify.com/CVE-2022-31199/): Netwrix Auditor Insecure Object Deserialization (critical 9.8, exploited in the wild)
- [CVE-2022-31198](https://insights.sbomify.com/CVE-2022-31198/): GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts (high 7.5)
- [CVE-2022-31197](https://insights.sbomify.com/CVE-2022-31197/): SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc (high 7.1)
- [CVE-2022-31196](https://insights.sbomify.com/CVE-2022-31196/): Server-Side Request Forgery (SSRF) vulnerability in Databasir (high 7.6)
- [CVE-2022-31195](https://insights.sbomify.com/CVE-2022-31195/): Path traversal vulnerability in Simple Archive Format package import in DSpace (high 7.2)
- [CVE-2022-31194](https://insights.sbomify.com/CVE-2022-31194/): Path traversal vulnerabilities in DSpace JSPUI submission upload (high 8.2)
- [CVE-2022-31193](https://insights.sbomify.com/CVE-2022-31193/): URL Redirection to Untrusted Site in Dspace JSPUI (high 7.1)
- [CVE-2022-31192](https://insights.sbomify.com/CVE-2022-31192/): Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature (high 7.1)
- [CVE-2022-31191](https://insights.sbomify.com/CVE-2022-31191/): Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools (high 7.1)
- [CVE-2022-31190](https://insights.sbomify.com/CVE-2022-31190/): Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI (medium 5.3)
- [CVE-2022-3119](https://insights.sbomify.com/CVE-2022-3119/): OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass (high 7.5)
- [CVE-2022-31189](https://insights.sbomify.com/CVE-2022-31189/): "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization (medium 5.3)
- [CVE-2022-31188](https://insights.sbomify.com/CVE-2022-31188/): Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) (high 8.6)
- [CVE-2022-31187](https://insights.sbomify.com/CVE-2022-31187/): Stored Cross Site Scripting (XSS) through global search in GLPI (medium 6.8)
- [CVE-2022-31186](https://insights.sbomify.com/CVE-2022-31186/): Leakage of excessive information into log in next-auth (low 3.3)
- [CVE-2022-31185](https://insights.sbomify.com/CVE-2022-31185/): Email addresses are not hidden regardless of selected state in mprweb (medium 5.3)
- [CVE-2022-31184](https://insights.sbomify.com/CVE-2022-31184/): Email activation route can be abused by spammers in Discourse (medium 6.5)
- [CVE-2022-31183](https://insights.sbomify.com/CVE-2022-31183/): mTLS client verification is skipped in fs2 on Node.js (critical 9.1)
- [CVE-2022-31182](https://insights.sbomify.com/CVE-2022-31182/): Cache poisoning via maliciously-formed request in Discourse (medium 5.3)
- [CVE-2022-31181](https://insights.sbomify.com/CVE-2022-31181/): Remote code execution in prestashop (critical 9.8)
- [CVE-2022-31180](https://insights.sbomify.com/CVE-2022-31180/): Insufficient escaping of whitespace in shescape (critical 9.8)
- [CVE-2022-3118](https://insights.sbomify.com/CVE-2022-3118/): Sourcecodehero ERP System Project processlogin.php sql injection (high 7.3)
- [CVE-2022-31179](https://insights.sbomify.com/CVE-2022-31179/): Insufficient escaping of line feeds for CMD in shescape (high 8.1)
- [CVE-2022-31178](https://insights.sbomify.com/CVE-2022-31178/): Improper Authorization in eLabFTW (medium 4.3)
- [CVE-2022-31177](https://insights.sbomify.com/CVE-2022-31177/): Possible to infer sensitive information through query strings in Flask-AppBuilder (low 2.7)
- [CVE-2022-31176](https://insights.sbomify.com/CVE-2022-31176/): Grafana Image Renderer leaking files (high 8.3)
- [CVE-2022-31175](https://insights.sbomify.com/CVE-2022-31175/): Cross-site scripting caused by the editor instance destroying process in ckeditor5 (medium 5.8)
- [CVE-2022-31173](https://insights.sbomify.com/CVE-2022-31173/): Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow (high 7.5)
- [CVE-2022-31172](https://insights.sbomify.com/CVE-2022-31172/): OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers (high 7.5)
- [CVE-2022-31170](https://insights.sbomify.com/CVE-2022-31170/): OpenZeppelin Contracts's ERC165Checker may revert instead of returning false (high 7.5)
- [CVE-2022-31169](https://insights.sbomify.com/CVE-2022-31169/): Cranelift vulnerable to miscompilation of constant values in division on AArch64 (medium 5.9)
- [CVE-2022-31168](https://insights.sbomify.com/CVE-2022-31168/): Zulip Server insufficient authorization for changing bot roles (medium 5.4)
- [CVE-2022-31167](https://insights.sbomify.com/CVE-2022-31167/): XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference (high 7.1)
- [CVE-2022-31166](https://insights.sbomify.com/CVE-2022-31166/): XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups (high 8.1)
- [CVE-2022-31164](https://insights.sbomify.com/CVE-2022-31164/): Tovy before v0.7.51 vulnerable to users logging in as and impersonating other users (high 7.5)
- [CVE-2022-31163](https://insights.sbomify.com/CVE-2022-31163/): TZInfo relative path traversal vulnerability allows loading of arbitrary files (high 7.5)
- [CVE-2022-31162](https://insights.sbomify.com/CVE-2022-31162/): Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs (high 7.5)
- [CVE-2022-31161](https://insights.sbomify.com/CVE-2022-31161/): Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload (critical 10.0)
- [CVE-2022-31160](https://insights.sbomify.com/CVE-2022-31160/): jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label (medium 6.1)
- [CVE-2022-3116](https://insights.sbomify.com/CVE-2022-3116/): Null dereference in Heimdal Software Kerberos (high 7.5)
- [CVE-2022-31159](https://insights.sbomify.com/CVE-2022-31159/): Partial Path Traversal in com.amazonaws:aws-java-sdk-s3 (high 7.9)
- [CVE-2022-31158](https://insights.sbomify.com/CVE-2022-31158/): Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library (high 7.5)
- [CVE-2022-31157](https://insights.sbomify.com/CVE-2022-31157/): Use of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library (high 7.5)
- [CVE-2022-31156](https://insights.sbomify.com/CVE-2022-31156/): Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed (medium 6.6)
- [CVE-2022-31155](https://insights.sbomify.com/CVE-2022-31155/): Unauthorized overwriting of saved searches in Sourcegraph (medium 4.3)
- [CVE-2022-31154](https://insights.sbomify.com/CVE-2022-31154/): Indirect Object Access in Sourcegraph Code Monitoring (medium 6.4)
- [CVE-2022-31153](https://insights.sbomify.com/CVE-2022-31153/): OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli (medium 6.5)
- [CVE-2022-31152](https://insights.sbomify.com/CVE-2022-31152/): Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules (medium 6.4)
- [CVE-2022-31151](https://insights.sbomify.com/CVE-2022-31151/): Uncleared cookies on cross-host/cross-origin redirect in undici (low 3.7)
- [CVE-2022-31150](https://insights.sbomify.com/CVE-2022-31150/): CRLF injection in request headers (medium 5.3)
- [CVE-2022-3115](https://insights.sbomify.com/CVE-2022-3115/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31149](https://insights.sbomify.com/CVE-2022-31149/): ActivityWatch vulnerable to DNS rebinding attack (high 8.8)
- [CVE-2022-31148](https://insights.sbomify.com/CVE-2022-31148/): Persistent cross site scripting in customer module in Shopware (medium 5.4)
- [CVE-2022-31147](https://insights.sbomify.com/CVE-2022-31147/): jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306 (high 7.5)
- [CVE-2022-31146](https://insights.sbomify.com/CVE-2022-31146/): Use After Free in Wasmtime (medium 6.4)
- [CVE-2022-31145](https://insights.sbomify.com/CVE-2022-31145/): Insufficient AccessToken Expiration Check in FlyteAdmin (medium 6.5)
- [CVE-2022-31144](https://insights.sbomify.com/CVE-2022-31144/): Potential heap overflow in Redis (high 7.0)
- [CVE-2022-31143](https://insights.sbomify.com/CVE-2022-31143/): Leak of sensitive information through login page error in GLPI (medium 5.3)
- [CVE-2022-31142](https://insights.sbomify.com/CVE-2022-31142/): Potential Timing Attack Vector in @fastify/bearer-auth (high 7.5)
- [CVE-2022-31140](https://insights.sbomify.com/CVE-2022-31140/): Valinor error messages leading to potential data exfiltration (high 7.5)
- [CVE-2022-3114](https://insights.sbomify.com/CVE-2022-3114/): Null dereference in Kernel (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/318/