# Vulnerabilities published in 2022


- [CVE-2022-29841](https://insights.sbomify.com/CVE-2022-29841/): OS Command Injection vulnerability in Western Digital My Cloud devices (high 8.0)
- [CVE-2022-29840](https://insights.sbomify.com/CVE-2022-29840/): Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices (medium 5.1)
- [CVE-2022-2984](https://insights.sbomify.com/CVE-2022-2984/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-29839](https://insights.sbomify.com/CVE-2022-29839/): Remote Backups Application Discloses Stored Credentials (medium 4.1)
- [CVE-2022-29838](https://insights.sbomify.com/CVE-2022-29838/): Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices (medium 4.3)
- [CVE-2022-29837](https://insights.sbomify.com/CVE-2022-29837/): Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices (medium 4.7)
- [CVE-2022-29836](https://insights.sbomify.com/CVE-2022-29836/): Post-Auth Path Traversal Vulnerability Allows to Custom Package Installation via HTTP API (low 1.9)
- [CVE-2022-29835](https://insights.sbomify.com/CVE-2022-29835/): WD Discovery's Use of Weak Hashing Algorithm for Code Signing (medium 5.3)
- [CVE-2022-29834](https://insights.sbomify.com/CVE-2022-29834/): Path traversal in GENESIS64 (high 7.5)
- [CVE-2022-29833](https://insights.sbomify.com/CVE-2022-29833/): Information disclosure in GX Works3 (medium 6.8)
- [CVE-2022-29832](https://insights.sbomify.com/CVE-2022-29832/): Information disclosure in GX Developer (low 3.7)
- [CVE-2022-29831](https://insights.sbomify.com/CVE-2022-29831/): Hardcoded credentials in GX Works3 (high 7.5)
- [CVE-2022-29830](https://insights.sbomify.com/CVE-2022-29830/): Hardcoded credentials in GX Works3 (critical 9.1)
- [CVE-2022-2983](https://insights.sbomify.com/CVE-2022-2983/): Salat Times < 3.2.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-29829](https://insights.sbomify.com/CVE-2022-29829/): Hardcoded credentials in GT Designer3 Version1 (GOT2000) (medium 6.8)
- [CVE-2022-29828](https://insights.sbomify.com/CVE-2022-29828/): Hardcoded credentials in GX Works3 (medium 6.8)
- [CVE-2022-29827](https://insights.sbomify.com/CVE-2022-29827/): Hardcoded credentials in GX Works3 (medium 6.8)
- [CVE-2022-29826](https://insights.sbomify.com/CVE-2022-29826/): Information disclosure in GX Works3 (medium 6.8)
- [CVE-2022-29825](https://insights.sbomify.com/CVE-2022-29825/): Hardcoded credentials in GT Designer3 Version1 (GOT2000) (medium 5.6)
- [CVE-2022-29824](https://insights.sbomify.com/CVE-2022-29824/): Integer overflow in debian:debian linux (medium 6.5)
- [CVE-2022-29823](https://insights.sbomify.com/CVE-2022-29823/): Feathers - Query “__proto__” is converted to real prototype (critical 10.0)
- [CVE-2022-29822](https://insights.sbomify.com/CVE-2022-29822/): Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection (critical 10.0)
- [CVE-2022-29821](https://insights.sbomify.com/CVE-2022-29821/): Code injection in Rider (medium 6.9)
- [CVE-2022-29820](https://insights.sbomify.com/CVE-2022-29820/): Misconfiguration in PyCharm (low 3.0)
- [CVE-2022-2982](https://insights.sbomify.com/CVE-2022-2982/): Use After Free in vim/vim (high 7.6)
- [CVE-2022-29819](https://insights.sbomify.com/CVE-2022-29819/): Code injection in IntelliJ IDEA (medium 6.9)
- [CVE-2022-29818](https://insights.sbomify.com/CVE-2022-29818/): Security feature bypass in IntelliJ IDEA (low 3.9)
- [CVE-2022-29817](https://insights.sbomify.com/CVE-2022-29817/): Cross-site scripting in IntelliJ IDEA (low 3.9)
- [CVE-2022-29816](https://insights.sbomify.com/CVE-2022-29816/): Cross-site scripting in IntelliJ IDEA (low 2.8)
- [CVE-2022-29815](https://insights.sbomify.com/CVE-2022-29815/): Code injection in IntelliJ IDEA (medium 6.9)
- [CVE-2022-29814](https://insights.sbomify.com/CVE-2022-29814/): Code injection in IntelliJ IDEA (medium 6.9)
- [CVE-2022-29813](https://insights.sbomify.com/CVE-2022-29813/): Code injection in IntelliJ IDEA (medium 6.9)
- [CVE-2022-29812](https://insights.sbomify.com/CVE-2022-29812/): Other in IntelliJ IDEA (low 2.3)
- [CVE-2022-29811](https://insights.sbomify.com/CVE-2022-29811/): Cross-site scripting in Hub (medium 6.1)
- [CVE-2022-29810](https://insights.sbomify.com/CVE-2022-29810/): Insertion of Sensitive Information into Log File in Hashicorp go-getter (medium 5.5)
- [CVE-2022-2981](https://insights.sbomify.com/CVE-2022-2981/): Download Monitor < 4.5.98 - Admin+ Arbitrary File Download (medium 4.9)
- [CVE-2022-29808](https://insights.sbomify.com/CVE-2022-29808/): Weak cryptography in quest:kace systems management appliance (high 7.5)
- [CVE-2022-29807](https://insights.sbomify.com/CVE-2022-29807/): SQL injection in quest:kace systems management appliance (critical 9.8)
- [CVE-2022-29806](https://insights.sbomify.com/CVE-2022-29806/): Path traversal in zoneminder:zoneminder (critical 9.8)
- [CVE-2022-29805](https://insights.sbomify.com/CVE-2022-29805/): Deserialization in fishbowlinventory:fishbowl (critical 9.8)
- [CVE-2022-29804](https://insights.sbomify.com/CVE-2022-29804/): Path traversal via Clean on Windows in path/filepath (high 7.5)
- [CVE-2022-29801](https://insights.sbomify.com/CVE-2022-29801/): XML external entity in Teamcenter V12.4 (high 7.5)
- [CVE-2022-29800](https://insights.sbomify.com/CVE-2022-29800/): Race condition in networkd-dispatcher (medium 4.7)
- [CVE-2022-2980](https://insights.sbomify.com/CVE-2022-2980/): NULL Pointer Dereference in vim/vim (medium 6.3)
- [CVE-2022-29799](https://insights.sbomify.com/CVE-2022-29799/): Path traversal in networkd-dispatcher (medium 5.5)
- [CVE-2022-29798](https://insights.sbomify.com/CVE-2022-29798/): Denial of service in CV81-WDM FW (high 7.5)
- [CVE-2022-29797](https://insights.sbomify.com/CVE-2022-29797/): Memory corruption in CV81-WDM FW (critical 9.8)
- [CVE-2022-29796](https://insights.sbomify.com/CVE-2022-29796/): Other in EMUI (high 7.5)
- [CVE-2022-29795](https://insights.sbomify.com/CVE-2022-29795/): Null dereference in EMUI (high 7.5)
- [CVE-2022-29794](https://insights.sbomify.com/CVE-2022-29794/): Use after free in EMUI (critical 9.8)
- [CVE-2022-29793](https://insights.sbomify.com/CVE-2022-29793/): Misconfiguration in HarmonyOS;EMUI;Magic UI (high 7.5)
- [CVE-2022-29792](https://insights.sbomify.com/CVE-2022-29792/): Information disclosure in EMUI (high 7.5)
- [CVE-2022-29791](https://insights.sbomify.com/CVE-2022-29791/): Other in EMUI (high 7.5)
- [CVE-2022-29790](https://insights.sbomify.com/CVE-2022-29790/): Race condition in EMUI (high 7.5)
- [CVE-2022-2979](https://insights.sbomify.com/CVE-2022-2979/): Omron CX-Programmer (high 7.8)
- [CVE-2022-29789](https://insights.sbomify.com/CVE-2022-29789/): Other in EMUI (high 7.5)
- [CVE-2022-29788](https://insights.sbomify.com/CVE-2022-29788/): Null dereference in libmobi project:libmobi (medium 6.5)
- [CVE-2022-29784](https://insights.sbomify.com/CVE-2022-29784/): Information disclosure in publiccms:publiccms (medium 5.3)
- [CVE-2022-29780](https://insights.sbomify.com/CVE-2022-29780/): Memory corruption in nginx:njs (medium 5.5)
- [CVE-2022-2978](https://insights.sbomify.com/CVE-2022-2978/): Use after free in Kernel (high 7.8)
- [CVE-2022-29779](https://insights.sbomify.com/CVE-2022-29779/): Memory corruption in nginx:njs (medium 5.5)
- [CVE-2022-29778](https://insights.sbomify.com/CVE-2022-29778/): Hardcoded credentials in dlink:dir-890l firmware (high 8.8)
- [CVE-2022-29777](https://insights.sbomify.com/CVE-2022-29777/): Memory corruption in onlyoffice:core (critical 9.8)
- [CVE-2022-29776](https://insights.sbomify.com/CVE-2022-29776/): Memory corruption in onlyoffice:core (critical 9.8)
- [CVE-2022-29775](https://insights.sbomify.com/CVE-2022-29775/): Auth bypass in ispyconnect:ispy (critical 9.8)
- [CVE-2022-29774](https://insights.sbomify.com/CVE-2022-29774/): Path traversal in ispyconnect:ispy (critical 9.8)
- [CVE-2022-29773](https://insights.sbomify.com/CVE-2022-29773/): Access control issue in AlekSIS-Core (medium 6.5)
- [CVE-2022-29770](https://insights.sbomify.com/CVE-2022-29770/): Cross site scripting in XXL-job (medium 5.4)
- [CVE-2022-2977](https://insights.sbomify.com/CVE-2022-2977/): Use after free in Linux kernel (high 7.8)
- [CVE-2022-29767](https://insights.sbomify.com/CVE-2022-29767/): Denial of service in adbyby project:adbyby (medium 6.5)
- [CVE-2022-29751](https://insights.sbomify.com/CVE-2022-29751/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29750](https://insights.sbomify.com/CVE-2022-29750/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-2975](https://insights.sbomify.com/CVE-2022-2975/): Avaya Aura Application Enablement Services weak permissions in web application (high 7.7)
- [CVE-2022-29749](https://insights.sbomify.com/CVE-2022-29749/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29748](https://insights.sbomify.com/CVE-2022-29748/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29747](https://insights.sbomify.com/CVE-2022-29747/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29746](https://insights.sbomify.com/CVE-2022-29746/): SQL injection in money transfer management system project:money transfer management system (critical 9.8)
- [CVE-2022-29745](https://insights.sbomify.com/CVE-2022-29745/): SQL injection in money transfer management system project:money transfer management system (critical 9.8)
- [CVE-2022-29741](https://insights.sbomify.com/CVE-2022-29741/): SQL injection in money transfer management system project:money transfer management system (critical 9.8)
- [CVE-2022-29739](https://insights.sbomify.com/CVE-2022-29739/): SQL injection in money transfer management system project:money transfer management system (critical 9.8)
- [CVE-2022-29738](https://insights.sbomify.com/CVE-2022-29738/): SQL injection in money transfer management system project:money transfer management system (critical 9.8)
- [CVE-2022-29735](https://insights.sbomify.com/CVE-2022-29735/): Cross-site request forgery in deltacontrols:entelitouch firmware (high 8.8)
- [CVE-2022-29734](https://insights.sbomify.com/CVE-2022-29734/): Cross-site scripting in ict:protege gx (medium 5.4)
- [CVE-2022-29733](https://insights.sbomify.com/CVE-2022-29733/): Information disclosure in deltacontrols:entelitouch firmware (medium 5.9)
- [CVE-2022-29732](https://insights.sbomify.com/CVE-2022-29732/): Cross-site scripting in deltacontrols:entelitouch firmware (medium 6.1)
- [CVE-2022-29731](https://insights.sbomify.com/CVE-2022-29731/): Information disclosure in ict:protege gx firmware (medium 4.3)
- [CVE-2022-29730](https://insights.sbomify.com/CVE-2022-29730/): Hardcoded credentials in usr:usr-g800v2 firmware (critical 9.8)
- [CVE-2022-2973](https://insights.sbomify.com/CVE-2022-2973/): MZ Automation libIEC61850 NULL Pointer Dereference (high 8.6)
- [CVE-2022-29729](https://insights.sbomify.com/CVE-2022-29729/): Weak cryptography in verizon:4g lte network extender firmware (high 7.5)
- [CVE-2022-29728](https://insights.sbomify.com/CVE-2022-29728/): Cross-site scripting in surveysparrow:enterprise survey software (medium 6.1)
- [CVE-2022-29727](https://insights.sbomify.com/CVE-2022-29727/): Cross-site scripting in surveysparrow:enterprise survey software (medium 5.4)
- [CVE-2022-29725](https://insights.sbomify.com/CVE-2022-29725/): File upload in creatiwity:witycms (high 8.8)
- [CVE-2022-29721](https://insights.sbomify.com/CVE-2022-29721/): SQL injection in 74cms:74cmsse (high 7.5)
- [CVE-2022-29720](https://insights.sbomify.com/CVE-2022-29720/): Path traversal in 74cms:74cmsse (high 7.5)
- [CVE-2022-2972](https://insights.sbomify.com/CVE-2022-2972/): MZ Automation libIEC61850 Stack-Based Buffer Overflow (critical 10.0)
- [CVE-2022-29718](https://insights.sbomify.com/CVE-2022-29718/): Open redirect in caddy (medium 6.1)
- [CVE-2022-29712](https://insights.sbomify.com/CVE-2022-29712/): Command injection in librenms (critical 9.8)
- [CVE-2022-29711](https://insights.sbomify.com/CVE-2022-29711/): Cross site scripting in librenms (medium 6.1)
- [CVE-2022-29710](https://insights.sbomify.com/CVE-2022-29710/): Cross-site scripting in limesurvey:limesurvey (medium 6.1)
- [CVE-2022-2971](https://insights.sbomify.com/CVE-2022-2971/): MZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion') (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/330/