# Vulnerabilities published in 2022


- [CVE-2022-30326](https://insights.sbomify.com/CVE-2022-30326/): Cross-site scripting in trendnet:tew-831dr firmware (medium 5.4)
- [CVE-2022-30325](https://insights.sbomify.com/CVE-2022-30325/): Weak cryptography in trendnet:tew-831dr firmware (high 8.8)
- [CVE-2022-30324](https://insights.sbomify.com/CVE-2022-30324/): Privilege escalation in Hashicorp Nomad (critical 9.8)
- [CVE-2022-30323](https://insights.sbomify.com/CVE-2022-30323/): Denial of service in hashicorp:go-getter (high 8.6)
- [CVE-2022-30322](https://insights.sbomify.com/CVE-2022-30322/): Denial of service in hashicorp:go-getter (high 8.6)
- [CVE-2022-30321](https://insights.sbomify.com/CVE-2022-30321/): Command injection in hashicorp:go-getter (high 8.6)
- [CVE-2022-30320](https://insights.sbomify.com/CVE-2022-30320/): Weak cryptography in honeywell:saia pg5 controls suite (medium 4.3)
- [CVE-2022-3032](https://insights.sbomify.com/CVE-2022-3032/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2022-30319](https://insights.sbomify.com/CVE-2022-30319/): Auth bypass in honeywell:saia pg5 controls suite (high 8.1)
- [CVE-2022-30318](https://insights.sbomify.com/CVE-2022-30318/): Hardcoded credentials in honeywell:controledge plc firmware (critical 9.8)
- [CVE-2022-30317](https://insights.sbomify.com/CVE-2022-30317/): Missing authorization in honeywell:experion lx firmware (critical 9.1)
- [CVE-2022-30316](https://insights.sbomify.com/CVE-2022-30316/): Security feature bypass in honeywell:safety manager firmware (medium 6.8)
- [CVE-2022-30315](https://insights.sbomify.com/CVE-2022-30315/): Security feature bypass in honeywell:safety manager firmware (critical 9.8)
- [CVE-2022-30314](https://insights.sbomify.com/CVE-2022-30314/): Hardcoded credentials in honeywell:safety manager firmware (medium 4.6)
- [CVE-2022-30313](https://insights.sbomify.com/CVE-2022-30313/): Missing authorization in honeywell:safety manager firmware (high 7.5)
- [CVE-2022-30312](https://insights.sbomify.com/CVE-2022-30312/): Information disclosure in honeywell:trend iq411 firmware (medium 6.5)
- [CVE-2022-30311](https://insights.sbomify.com/CVE-2022-30311/): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (critical 9.8)
- [CVE-2022-30310](https://insights.sbomify.com/CVE-2022-30310/): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (critical 9.8)
- [CVE-2022-3031](https://insights.sbomify.com/CVE-2022-3031/): Auth bypass in GitLab (low 3.7)
- [CVE-2022-30309](https://insights.sbomify.com/CVE-2022-30309/): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (critical 9.8)
- [CVE-2022-30308](https://insights.sbomify.com/CVE-2022-30308/): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (critical 9.8)
- [CVE-2022-30307](https://insights.sbomify.com/CVE-2022-30307/): Weak cryptography in Fortinet FortiOS (low 3.9)
- [CVE-2022-30306](https://insights.sbomify.com/CVE-2022-30306/): Memory corruption in FortiWeb (medium 6.3)
- [CVE-2022-30305](https://insights.sbomify.com/CVE-2022-30305/): Security feature bypass in FortiDeceptor (low 3.6)
- [CVE-2022-30304](https://insights.sbomify.com/CVE-2022-30304/): Cross-site scripting in FortiAnalyzer (medium 4.2)
- [CVE-2022-30303](https://insights.sbomify.com/CVE-2022-30303/): Command injection in FortiWeb (high 8.6)
- [CVE-2022-30302](https://insights.sbomify.com/CVE-2022-30302/): Path traversal in Fortinet FortiDeceptor (medium 6.5)
- [CVE-2022-30301](https://insights.sbomify.com/CVE-2022-30301/): Path traversal in Fortinet FortiAP-U (high 7.8)
- [CVE-2022-30300](https://insights.sbomify.com/CVE-2022-30300/): Path traversal in FortiWeb (medium 6.2)
- [CVE-2022-3030](https://insights.sbomify.com/CVE-2022-3030/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-30299](https://insights.sbomify.com/CVE-2022-30299/): Path traversal in FortiWeb (medium 5.0)
- [CVE-2022-30298](https://insights.sbomify.com/CVE-2022-30298/): Privilege escalation in Fortinet FortiSOAR (high 7.0)
- [CVE-2022-30297](https://insights.sbomify.com/CVE-2022-30297/): Cross-site scripting in Intel(R) EMA software (low 3.8)
- [CVE-2022-30296](https://insights.sbomify.com/CVE-2022-30296/): Information disclosure in version (high 7.5)
- [CVE-2022-30295](https://insights.sbomify.com/CVE-2022-30295/): Weak cryptography in uclibc-ng project:uclibc-ng (medium 6.5)
- [CVE-2022-30293](https://insights.sbomify.com/CVE-2022-30293/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2022-30292](https://insights.sbomify.com/CVE-2022-30292/): Memory corruption in fedoraproject:fedora (critical 10.0)
- [CVE-2022-30290](https://insights.sbomify.com/CVE-2022-30290/): Missing authorization in citeum:opencti (high 7.5)
- [CVE-2022-3029](https://insights.sbomify.com/CVE-2022-3029/): Fatal error on incorrect base64 data in RRDP (high 7.5)
- [CVE-2022-30289](https://insights.sbomify.com/CVE-2022-30289/): Cross-site scripting in citeum:opencti (medium 5.4)
- [CVE-2022-30288](https://insights.sbomify.com/CVE-2022-30288/): Denial of service in ohler:agoo (high 7.5)
- [CVE-2022-30287](https://insights.sbomify.com/CVE-2022-30287/): Deserialization in debian:debian linux (high 8.0)
- [CVE-2022-30286](https://insights.sbomify.com/CVE-2022-30286/): Information disclosure in pyscript:pyscript (high 7.5)
- [CVE-2022-30285](https://insights.sbomify.com/CVE-2022-30285/): Weak cryptography in quest:kace systems management appliance (critical 9.8)
- [CVE-2022-30284](https://insights.sbomify.com/CVE-2022-30284/): Argument injection in python-libnmap (critical 9.0)
- [CVE-2022-30283](https://insights.sbomify.com/CVE-2022-30283/): Race condition in insyde:kernel (high 7.5)
- [CVE-2022-30280](https://insights.sbomify.com/CVE-2022-30280/): Cross-site request forgery in nokia:netact (high 8.8)
- [CVE-2022-3028](https://insights.sbomify.com/CVE-2022-3028/): Race condition in Linux kernel (high 7.0)
- [CVE-2022-30279](https://insights.sbomify.com/CVE-2022-30279/): Null dereference in stormshield:stormshield network security (high 7.5)
- [CVE-2022-30278](https://insights.sbomify.com/CVE-2022-30278/): Cross-site scripting in Black Duck Hub (medium 6.1)
- [CVE-2022-30277](https://insights.sbomify.com/CVE-2022-30277/): BD Synapsys™ – Insufficient Session Expiration (medium 5.7)
- [CVE-2022-30276](https://insights.sbomify.com/CVE-2022-30276/): Missing authorization in motorola:ace ip gateway \(4600\) firmware (high 7.5)
- [CVE-2022-30275](https://insights.sbomify.com/CVE-2022-30275/): Weak cryptography in motorolasolutions:mdlc (high 7.5)
- [CVE-2022-30274](https://insights.sbomify.com/CVE-2022-30274/): Hardcoded credentials in motorola:ace1000 firmware (critical 9.8)
- [CVE-2022-30273](https://insights.sbomify.com/CVE-2022-30273/): Weak cryptography in motorolasolutions:mdlc (critical 9.8)
- [CVE-2022-30272](https://insights.sbomify.com/CVE-2022-30272/): Security feature bypass in motorola:ace1000 firmware (high 7.2)
- [CVE-2022-30271](https://insights.sbomify.com/CVE-2022-30271/): Hardcoded credentials in motorola:ace1000 firmware (critical 9.8)
- [CVE-2022-30270](https://insights.sbomify.com/CVE-2022-30270/): Hardcoded credentials in motorola:ace1000 firmware (critical 9.8)
- [CVE-2022-3027](https://insights.sbomify.com/CVE-2022-3027/): Contec Health CMS8000 (medium 5.7)
- [CVE-2022-30269](https://insights.sbomify.com/CVE-2022-30269/): Security feature bypass in motorola:ace1000 firmware (high 8.8)
- [CVE-2022-30264](https://insights.sbomify.com/CVE-2022-30264/): Missing authorization in emerson:dl8000 firmware (critical 9.8)
- [CVE-2022-30262](https://insights.sbomify.com/CVE-2022-30262/): Security feature bypass in emerson:controlwave micro firmware (high 7.8)
- [CVE-2022-30260](https://insights.sbomify.com/CVE-2022-30260/): Security feature bypass in emerson:deltav distributed control system sq controller firmware (high 7.8)
- [CVE-2022-3026](https://insights.sbomify.com/CVE-2022-3026/): WP Users Exporter <= 1.4.2 - CSV Injection (medium 6.5)
- [CVE-2022-30258](https://insights.sbomify.com/CVE-2022-30258/): Other in technitium:dns server (critical 9.8)
- [CVE-2022-30257](https://insights.sbomify.com/CVE-2022-30257/): Other in technitium:dns server (critical 9.8)
- [CVE-2022-30256](https://insights.sbomify.com/CVE-2022-30256/): Business logic in maradns:maradns (high 7.5)
- [CVE-2022-3025](https://insights.sbomify.com/CVE-2022-3025/): Bitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRF (medium 5.4)
- [CVE-2022-30245](https://insights.sbomify.com/CVE-2022-30245/): Missing authorization in honeywell:alerton compass (medium 6.5)
- [CVE-2022-30244](https://insights.sbomify.com/CVE-2022-30244/): Missing authorization in honeywell:alerton ascent control module firmware (high 8.0)
- [CVE-2022-30243](https://insights.sbomify.com/CVE-2022-30243/): Missing authorization in honeywell:alterton visual logic firmware (high 8.8)
- [CVE-2022-30242](https://insights.sbomify.com/CVE-2022-30242/): Missing authorization in honeywell:alerton ascent control module firmware (medium 6.8)
- [CVE-2022-30241](https://insights.sbomify.com/CVE-2022-30241/): Cross-site Scripting in jquery.json-viewer (medium 6.1)
- [CVE-2022-30240](https://insights.sbomify.com/CVE-2022-30240/): Command injection in insightsoftware:magnitude simba amazon redshift jdbc driver (high 7.8)
- [CVE-2022-3024](https://insights.sbomify.com/CVE-2022-3024/): Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS (medium 5.4)
- [CVE-2022-30239](https://insights.sbomify.com/CVE-2022-30239/): Command injection in insightsoftware:magnitude simba amazon athena jdbc driver (high 7.8)
- [CVE-2022-30238](https://insights.sbomify.com/CVE-2022-30238/): Auth bypass in Wiser Smart (high 8.3)
- [CVE-2022-30237](https://insights.sbomify.com/CVE-2022-30237/): Weak cryptography in Wiser Smart (high 8.2)
- [CVE-2022-30236](https://insights.sbomify.com/CVE-2022-30236/): Security feature bypass in Wiser Smart (high 8.2)
- [CVE-2022-30235](https://insights.sbomify.com/CVE-2022-30235/): Auth bypass in Wiser Smart (high 8.6)
- [CVE-2022-30234](https://insights.sbomify.com/CVE-2022-30234/): Hardcoded credentials in Wiser Smart (critical 9.4)
- [CVE-2022-30233](https://insights.sbomify.com/CVE-2022-30233/): Other in Wiser Smart (medium 6.5)
- [CVE-2022-30232](https://insights.sbomify.com/CVE-2022-30232/): Other in Power Logic ION Setup (high 8.0)
- [CVE-2022-30231](https://insights.sbomify.com/CVE-2022-30231/): Information disclosure in SICAM GridEdge (Classic) (medium 6.9)
- [CVE-2022-30230](https://insights.sbomify.com/CVE-2022-30230/): Missing authorization in SICAM GridEdge (Classic) (critical 9.3)
- [CVE-2022-3023](https://insights.sbomify.com/CVE-2022-3023/): Use of Externally-Controlled Format String in pingcap/tidb (medium 4.2)
- [CVE-2022-30229](https://insights.sbomify.com/CVE-2022-30229/): Missing authorization in SICAM GridEdge (Classic) (high 8.6)
- [CVE-2022-30228](https://insights.sbomify.com/CVE-2022-30228/): Cross-site request forgery in SICAM GridEdge (Classic) (high 8.6)
- [CVE-2022-30226](https://insights.sbomify.com/CVE-2022-30226/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2022-30225](https://insights.sbomify.com/CVE-2022-30225/): Windows Media Player Network Sharing Service Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2022-30224](https://insights.sbomify.com/CVE-2022-30224/): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-30223](https://insights.sbomify.com/CVE-2022-30223/): Windows Hyper-V Information Disclosure Vulnerability (medium 5.7)
- [CVE-2022-30222](https://insights.sbomify.com/CVE-2022-30222/): Windows Shell Remote Code Execution Vulnerability (high 8.4)
- [CVE-2022-30221](https://insights.sbomify.com/CVE-2022-30221/): Windows Graphics Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-30220](https://insights.sbomify.com/CVE-2022-30220/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-30216](https://insights.sbomify.com/CVE-2022-30216/): Windows Server Service Tampering Vulnerability (high 8.8)
- [CVE-2022-30215](https://insights.sbomify.com/CVE-2022-30215/): Active Directory Federation Services Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2022-30214](https://insights.sbomify.com/CVE-2022-30214/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2022-30213](https://insights.sbomify.com/CVE-2022-30213/): Windows GDI+ Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-30212](https://insights.sbomify.com/CVE-2022-30212/): Windows Connected Devices Platform Service Information Disclosure Vulnerability (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/326/