# Vulnerabilities published in 2022


- [CVE-2022-29946](https://insights.sbomify.com/CVE-2022-29946/): NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects (medium 6.3)
- [CVE-2022-29945](https://insights.sbomify.com/CVE-2022-29945/): Information disclosure in dji:air 2 firmware (medium 4.0)
- [CVE-2022-29944](https://insights.sbomify.com/CVE-2022-29944/): Security feature bypass in opennetworking:onos (medium 5.3)
- [CVE-2022-29943](https://insights.sbomify.com/CVE-2022-29943/): XML external entity in talend:administration center (medium 6.5)
- [CVE-2022-29942](https://insights.sbomify.com/CVE-2022-29942/): Server-side request forgery in talend:administration center (medium 6.5)
- [CVE-2022-29940](https://insights.sbomify.com/CVE-2022-29940/): Cross-site scripting in librehealth:librehealth ehr (medium 5.4)
- [CVE-2022-29939](https://insights.sbomify.com/CVE-2022-29939/): Cross-site scripting in librehealth:librehealth ehr (medium 5.4)
- [CVE-2022-29938](https://insights.sbomify.com/CVE-2022-29938/): SQL injection in librehealth:librehealth ehr (high 8.8)
- [CVE-2022-29937](https://insights.sbomify.com/CVE-2022-29937/): Command injection in usu:oracle optimization (high 8.8)
- [CVE-2022-29936](https://insights.sbomify.com/CVE-2022-29936/): Deserialization in usu:oracle optimization (high 8.8)
- [CVE-2022-29935](https://insights.sbomify.com/CVE-2022-29935/): Information disclosure in usu:oracle optimization (high 7.5)
- [CVE-2022-29934](https://insights.sbomify.com/CVE-2022-29934/): Privilege escalation in usu:oracle optimization (high 7.8)
- [CVE-2022-29933](https://insights.sbomify.com/CVE-2022-29933/): Improper account password reset in Craft CMS (high 8.8)
- [CVE-2022-29932](https://insights.sbomify.com/CVE-2022-29932/): Information disclosure in primeur:spazio (high 7.5)
- [CVE-2022-29931](https://insights.sbomify.com/CVE-2022-29931/): Cross-site scripting in raytion:custom security manager (medium 6.1)
- [CVE-2022-29930](https://insights.sbomify.com/CVE-2022-29930/): Weak cryptography in Ktor (high 8.7)
- [CVE-2022-2993](https://insights.sbomify.com/CVE-2022-2993/): bt: host: Wrong key validation check (high 8.6)
- [CVE-2022-29929](https://insights.sbomify.com/CVE-2022-29929/): Cross-site scripting in TeamCity (low 3.7)
- [CVE-2022-29928](https://insights.sbomify.com/CVE-2022-29928/): Information disclosure in TeamCity (medium 4.4)
- [CVE-2022-29927](https://insights.sbomify.com/CVE-2022-29927/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2022-29925](https://insights.sbomify.com/CVE-2022-29925/): Memory corruption in V-SFT (high 7.8)
- [CVE-2022-29923](https://insights.sbomify.com/CVE-2022-29923/): Cross-site scripting in Quick Restaurant Reservations (WordPress plugin) (medium 5.9)
- [CVE-2022-29922](https://insights.sbomify.com/CVE-2022-29922/): Denial of service in MicroSCADA Pro SYS600 (high 7.5)
- [CVE-2022-2992](https://insights.sbomify.com/CVE-2022-2992/): Code injection in GitLab (critical 9.9)
- [CVE-2022-29919](https://insights.sbomify.com/CVE-2022-29919/): Use after free in Intel(R) VROC software (high 7.8)
- [CVE-2022-29918](https://insights.sbomify.com/CVE-2022-29918/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-29917](https://insights.sbomify.com/CVE-2022-29917/): Memory corruption in Firefox (critical 9.8)
- [CVE-2022-29916](https://insights.sbomify.com/CVE-2022-29916/): Information disclosure in Firefox (medium 6.5)
- [CVE-2022-29915](https://insights.sbomify.com/CVE-2022-29915/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2022-29914](https://insights.sbomify.com/CVE-2022-29914/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-29913](https://insights.sbomify.com/CVE-2022-29913/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2022-29912](https://insights.sbomify.com/CVE-2022-29912/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2022-29911](https://insights.sbomify.com/CVE-2022-29911/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2022-29910](https://insights.sbomify.com/CVE-2022-29910/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2022-2991](https://insights.sbomify.com/CVE-2022-2991/): Memory corruption in kernel (medium 6.7)
- [CVE-2022-29909](https://insights.sbomify.com/CVE-2022-29909/): Security feature bypass in Firefox (high 8.8)
- [CVE-2022-29908](https://insights.sbomify.com/CVE-2022-29908/): Privilege escalation in fabasoft:fabasoft cloud enterprise client (high 7.8)
- [CVE-2022-29907](https://insights.sbomify.com/CVE-2022-29907/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2022-29906](https://insights.sbomify.com/CVE-2022-29906/): Missing authorization in mediawiki:mediawiki (critical 9.8)
- [CVE-2022-29905](https://insights.sbomify.com/CVE-2022-29905/): Cross-site request forgery in mediawiki:mediawiki (medium 4.3)
- [CVE-2022-29904](https://insights.sbomify.com/CVE-2022-29904/): SQL injection in mediawiki:mediawiki (critical 9.8)
- [CVE-2022-29903](https://insights.sbomify.com/CVE-2022-29903/): Cross-site request forgery in mediawiki:mediawiki (medium 4.3)
- [CVE-2022-29901](https://insights.sbomify.com/CVE-2022-29901/): Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed) (medium 5.6)
- [CVE-2022-29900](https://insights.sbomify.com/CVE-2022-29900/): Information disclosure in AMD Processors (medium 6.5)
- [CVE-2022-2990](https://insights.sbomify.com/CVE-2022-2990/): Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification (high 7.1)
- [CVE-2022-29898](https://insights.sbomify.com/CVE-2022-29898/): Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT (critical 9.1)
- [CVE-2022-29897](https://insights.sbomify.com/CVE-2022-29897/): Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT (critical 9.1)
- [CVE-2022-29894](https://insights.sbomify.com/CVE-2022-29894/): Cross-site Scripting in Strapi (medium 4.8)
- [CVE-2022-29893](https://insights.sbomify.com/CVE-2022-29893/): Auth bypass in Intel(R) AMT (high 8.1)
- [CVE-2022-29892](https://insights.sbomify.com/CVE-2022-29892/): Denial of service in Cybozu Garoon (medium 6.5)
- [CVE-2022-29891](https://insights.sbomify.com/CVE-2022-29891/): Missing authorization in Cybozu Office (medium 4.3)
- [CVE-2022-29890](https://insights.sbomify.com/CVE-2022-29890/): Cross-site scripting in Octopus Server (medium 6.1)
- [CVE-2022-2989](https://insights.sbomify.com/CVE-2022-2989/): Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification (high 7.1)
- [CVE-2022-29889](https://insights.sbomify.com/CVE-2022-29889/): Hardcoded credentials in iota All-In-One Security Kit (critical 9.8)
- [CVE-2022-29888](https://insights.sbomify.com/CVE-2022-29888/): Other in InRouter302 (medium 6.5)
- [CVE-2022-29887](https://insights.sbomify.com/CVE-2022-29887/): Cross-site scripting in Intel(R) Manageability Commander software (high 8.1)
- [CVE-2022-29886](https://insights.sbomify.com/CVE-2022-29886/): Integer overflow in Alyac (high 7.3)
- [CVE-2022-29885](https://insights.sbomify.com/CVE-2022-29885/): EncryptInterceptor does not provide complete protection on insecure networks (high 7.5)
- [CVE-2022-29884](https://insights.sbomify.com/CVE-2022-29884/): Denial of service in CP-8000 MASTER MODULE WITH I/O -25/+70°C (high 7.5)
- [CVE-2022-29883](https://insights.sbomify.com/CVE-2022-29883/): Missing authorization in SICAM T (medium 6.9)
- [CVE-2022-29882](https://insights.sbomify.com/CVE-2022-29882/): Cross-site scripting in SICAM T (high 7.1)
- [CVE-2022-29881](https://insights.sbomify.com/CVE-2022-29881/): Missing authorization in SICAM T (medium 6.9)
- [CVE-2022-29880](https://insights.sbomify.com/CVE-2022-29880/): Cross-site scripting in SICAM T (medium 6.5)
- [CVE-2022-2988](https://insights.sbomify.com/CVE-2022-2988/): Memory corruption in EcoStruxure Machine Expert – HVAC (medium 4.3)
- [CVE-2022-29879](https://insights.sbomify.com/CVE-2022-29879/): Missing authorization in SICAM T (medium 5.3)
- [CVE-2022-29878](https://insights.sbomify.com/CVE-2022-29878/): Auth bypass in SICAM T (high 7.5)
- [CVE-2022-29877](https://insights.sbomify.com/CVE-2022-29877/): Missing authorization in SICAM P850 (medium 6.5)
- [CVE-2022-29876](https://insights.sbomify.com/CVE-2022-29876/): Cross-site scripting in SICAM T (high 7.1)
- [CVE-2022-29875](https://insights.sbomify.com/CVE-2022-29875/): Deserialization in Biograph Horizon PET/CT Systems (critical 9.8)
- [CVE-2022-29874](https://insights.sbomify.com/CVE-2022-29874/): Weak cryptography in SICAM T (high 8.8)
- [CVE-2022-29873](https://insights.sbomify.com/CVE-2022-29873/): Memory corruption in SICAM T (critical 9.3)
- [CVE-2022-29872](https://insights.sbomify.com/CVE-2022-29872/): Memory corruption in SICAM T (high 8.7)
- [CVE-2022-29871](https://insights.sbomify.com/CVE-2022-29871/): Privilege escalation in Intel(R) CSME software installer (medium 6.7)
- [CVE-2022-2987](https://insights.sbomify.com/CVE-2022-2987/): Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass (high 7.5)
- [CVE-2022-29869](https://insights.sbomify.com/CVE-2022-29869/): Information disclosure in debian:debian linux (medium 5.3)
- [CVE-2022-29868](https://insights.sbomify.com/CVE-2022-29868/): Security feature bypass in 1password:1password (medium 5.5)
- [CVE-2022-29866](https://insights.sbomify.com/CVE-2022-29866/): Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core (high 7.5)
- [CVE-2022-29865](https://insights.sbomify.com/CVE-2022-29865/): Incorrect Implementation of Authentication Algorithm in OPCFoundation.NetStandard.Opc.Ua.Core (high 7.5)
- [CVE-2022-29864](https://insights.sbomify.com/CVE-2022-29864/): Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core (high 7.5)
- [CVE-2022-29863](https://insights.sbomify.com/CVE-2022-29863/): Memory Allocation with Excessive Size Value in OPCFoundation.NetStandard.Opc.Ua.Core (high 7.5)
- [CVE-2022-29862](https://insights.sbomify.com/CVE-2022-29862/): Security Update for the OPC UA .NET Standard Stack (high 7.5)
- [CVE-2022-2986](https://insights.sbomify.com/CVE-2022-2986/): Moodle Cross-Site Request Forgery (CSRF) (high 8.8)
- [CVE-2022-29859](https://insights.sbomify.com/CVE-2022-29859/): Memory corruption in amb1 sdk project:amb1 sdk (critical 9.8)
- [CVE-2022-29858](https://insights.sbomify.com/CVE-2022-29858/): Unpublished, protected files can be published via shortcode (medium 4.3)
- [CVE-2022-29856](https://insights.sbomify.com/CVE-2022-29856/): Hardcoded credentials in automationanywhere:automation 360 (high 7.5)
- [CVE-2022-29855](https://insights.sbomify.com/CVE-2022-29855/): Missing authorization in mitel:6865i sip firmware (medium 6.8)
- [CVE-2022-29854](https://insights.sbomify.com/CVE-2022-29854/): Missing authorization in mitel:minet firmware (medium 6.8)
- [CVE-2022-29853](https://insights.sbomify.com/CVE-2022-29853/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 5.4)
- [CVE-2022-29852](https://insights.sbomify.com/CVE-2022-29852/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 5.4)
- [CVE-2022-29851](https://insights.sbomify.com/CVE-2022-29851/): Command injection in open-xchange:ox app suite (critical 9.8)
- [CVE-2022-29850](https://insights.sbomify.com/CVE-2022-29850/): Other in lexmark:b2236 firmware (high 8.1)
- [CVE-2022-2985](https://insights.sbomify.com/CVE-2022-2985/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2022-29849](https://insights.sbomify.com/CVE-2022-29849/): Privilege escalation in progress:openedge (high 7.8)
- [CVE-2022-29848](https://insights.sbomify.com/CVE-2022-29848/): Server-side request forgery in progress:whatsup gold (medium 6.5)
- [CVE-2022-29847](https://insights.sbomify.com/CVE-2022-29847/): Server-side request forgery in progress:whatsup gold (high 7.5)
- [CVE-2022-29846](https://insights.sbomify.com/CVE-2022-29846/): Information disclosure in progress:whatsup gold (medium 5.3)
- [CVE-2022-29845](https://insights.sbomify.com/CVE-2022-29845/): Path traversal in progress:whatsup gold (medium 6.5)
- [CVE-2022-29844](https://insights.sbomify.com/CVE-2022-29844/): Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp (medium 6.7)
- [CVE-2022-29843](https://insights.sbomify.com/CVE-2022-29843/): Western Digital My Cloud OS 5 devices Command Injection Vulnerability (medium 6.2)
- [CVE-2022-29842](https://insights.sbomify.com/CVE-2022-29842/): Command Injection Vulnerability in Western Digital My Cloud devices (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/329/