# Vulnerabilities published in 2022


- [CVE-2022-29586](https://insights.sbomify.com/CVE-2022-29586/): Security feature bypass in konicaminolta:bizhub 226i firmware (high 7.4)
- [CVE-2022-29585](https://insights.sbomify.com/CVE-2022-29585/): Information disclosure in mahara:mahara (high 7.5)
- [CVE-2022-29584](https://insights.sbomify.com/CVE-2022-29584/): Cross-site scripting in mahara:mahara (medium 5.4)
- [CVE-2022-29583](https://insights.sbomify.com/CVE-2022-29583/): Privilege escalation in service project:service (high 7.8)
- [CVE-2022-29582](https://insights.sbomify.com/CVE-2022-29582/): Use after free in debian:debian linux (high 7.0)
- [CVE-2022-29581](https://insights.sbomify.com/CVE-2022-29581/): Privilege escalation in Kernel (high 7.8)
- [CVE-2022-29580](https://insights.sbomify.com/CVE-2022-29580/): Path Traversal in Android Google Search App (high 8.9)
- [CVE-2022-2958](https://insights.sbomify.com/CVE-2022-2958/): BadgeOS < 3.7.1.3 - Subscriber+ SQLi (high 8.8)
- [CVE-2022-29578](https://insights.sbomify.com/CVE-2022-29578/): Auth bypass in meridian:meridian (medium 5.3)
- [CVE-2022-29577](https://insights.sbomify.com/CVE-2022-29577/): Cross-site Scripting in OWASP AntiSamy (medium 6.1)
- [CVE-2022-2957](https://insights.sbomify.com/CVE-2022-2957/): SourceCodester Simple and Nice Shopping Cart Script profile.php sql injection (medium 6.3)
- [CVE-2022-29567](https://insights.sbomify.com/CVE-2022-29567/): Possible information disclosure inside TreeGrid component with default data provider (medium 5.7)
- [CVE-2022-29566](https://insights.sbomify.com/CVE-2022-29566/): Weak cryptography in bulletproofs project:bulletproofs (high 8.1)
- [CVE-2022-29564](https://insights.sbomify.com/CVE-2022-29564/): Missing authorization in jamf:private access (high 7.5)
- [CVE-2022-29562](https://insights.sbomify.com/CVE-2022-29562/): Denial of service in RUGGEDCOM ROX MX5000 (low 3.7)
- [CVE-2022-29561](https://insights.sbomify.com/CVE-2022-29561/): Cross-site request forgery in RUGGEDCOM ROX MX5000 (high 7.5)
- [CVE-2022-29560](https://insights.sbomify.com/CVE-2022-29560/): Command injection in RUGGEDCOM ROX MX5000 (high 7.2)
- [CVE-2022-2956](https://insights.sbomify.com/CVE-2022-2956/): ConsoleTVs Noxen users.php cross site scripting (low 3.5)
- [CVE-2022-29558](https://insights.sbomify.com/CVE-2022-29558/): Command injection in realtek:rtl819x software development kit (high 8.8)
- [CVE-2022-29557](https://insights.sbomify.com/CVE-2022-29557/): Cross-site request forgery in relx:firco compliance link (high 8.8)
- [CVE-2022-29556](https://insights.sbomify.com/CVE-2022-29556/): Server-side request forgery in northern.tech:mender (critical 9.8)
- [CVE-2022-29555](https://insights.sbomify.com/CVE-2022-29555/): Cross-site request forgery in northern.tech:mender (high 8.8)
- [CVE-2022-29550](https://insights.sbomify.com/CVE-2022-29550/): Information disclosure in qualys:cloud agent (medium 5.5)
- [CVE-2022-29549](https://insights.sbomify.com/CVE-2022-29549/): Privilege escalation in qualys:cloud agent for linux (high 7.3)
- [CVE-2022-29548](https://insights.sbomify.com/CVE-2022-29548/): Cross-site scripting in wso2:api manager (medium 4.6)
- [CVE-2022-29547](https://insights.sbomify.com/CVE-2022-29547/): Missing authorization in mediawiki:createredirect (high 7.5)
- [CVE-2022-29546](https://insights.sbomify.com/CVE-2022-29546/): OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser (high 7.5)
- [CVE-2022-29540](https://insights.sbomify.com/CVE-2022-29540/): Cross-site scripting in resi:gemini-net (medium 6.1)
- [CVE-2022-29539](https://insights.sbomify.com/CVE-2022-29539/): Command injection in resi:gemini-net (critical 9.8)
- [CVE-2022-29538](https://insights.sbomify.com/CVE-2022-29538/): Missing authorization in resi:gemini-net (medium 5.3)
- [CVE-2022-29537](https://insights.sbomify.com/CVE-2022-29537/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-29536](https://insights.sbomify.com/CVE-2022-29536/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2022-29535](https://insights.sbomify.com/CVE-2022-29535/): SQL injection in zohocorp:manageengine opmanager (critical 9.8)
- [CVE-2022-29534](https://insights.sbomify.com/CVE-2022-29534/): Auth bypass in misp-project:misp (high 7.5)
- [CVE-2022-29533](https://insights.sbomify.com/CVE-2022-29533/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2022-29532](https://insights.sbomify.com/CVE-2022-29532/): Cross-site scripting in misp-project:misp (medium 4.8)
- [CVE-2022-29531](https://insights.sbomify.com/CVE-2022-29531/): Cross-site scripting in misp-project:misp (medium 5.4)
- [CVE-2022-29530](https://insights.sbomify.com/CVE-2022-29530/): Cross-site scripting in misp-project:misp (medium 5.4)
- [CVE-2022-2953](https://insights.sbomify.com/CVE-2022-2953/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-29529](https://insights.sbomify.com/CVE-2022-29529/): Cross-site scripting in misp-project:misp (medium 5.4)
- [CVE-2022-29528](https://insights.sbomify.com/CVE-2022-29528/): Deserialization in misp-project:misp (critical 9.8)
- [CVE-2022-29527](https://insights.sbomify.com/CVE-2022-29527/): Race condition in amazon:amazon ssm agent (high 7.0)
- [CVE-2022-29526](https://insights.sbomify.com/CVE-2022-29526/): golang.org/x/sys/unix has Incorrect privilege reporting in syscall (medium 5.3)
- [CVE-2022-29525](https://insights.sbomify.com/CVE-2022-29525/): Hardcoded credentials in Rakuten Casa (critical 9.8)
- [CVE-2022-29524](https://insights.sbomify.com/CVE-2022-29524/): Memory corruption in V-Server and V-Server Lite (high 7.8)
- [CVE-2022-29523](https://insights.sbomify.com/CVE-2022-29523/): Denial of service in Open CAS software maintained by Intel(R) (low 3.3)
- [CVE-2022-29522](https://insights.sbomify.com/CVE-2022-29522/): Use after free in V-SFT (high 7.8)
- [CVE-2022-29520](https://insights.sbomify.com/CVE-2022-29520/): Command injection in iota All-In-One Security Kit (high 8.1)
- [CVE-2022-2952](https://insights.sbomify.com/CVE-2022-2952/): GE CIMPLICITY Access of Uninitialized Pointer (high 7.8)
- [CVE-2022-29519](https://insights.sbomify.com/CVE-2022-29519/): Information disclosure in STARDOM Controller (high 7.5)
- [CVE-2022-29518](https://insights.sbomify.com/CVE-2022-29518/): Auth bypass in Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool (high 7.0)
- [CVE-2022-29517](https://insights.sbomify.com/CVE-2022-29517/): Path traversal in lansweeper (critical 9.9)
- [CVE-2022-29516](https://insights.sbomify.com/CVE-2022-29516/): Command injection in IPCOM EX2 series, IPCOM EX series, IPCOM VE2 series, and IPCOM VA2/VE1 series (critical 9.8)
- [CVE-2022-29515](https://insights.sbomify.com/CVE-2022-29515/): Denial of service in Intel(R) SPS (medium 6.0)
- [CVE-2022-29514](https://insights.sbomify.com/CVE-2022-29514/): Missing authorization in Intel(R) SUR software (high 7.7)
- [CVE-2022-29513](https://insights.sbomify.com/CVE-2022-29513/): Cross-site scripting in Cybozu Garoon (medium 4.8)
- [CVE-2022-29512](https://insights.sbomify.com/CVE-2022-29512/): Information disclosure in Cybozu Garoon (medium 6.5)
- [CVE-2022-29511](https://insights.sbomify.com/CVE-2022-29511/): Path traversal in lansweeper (critical 9.1)
- [CVE-2022-29510](https://insights.sbomify.com/CVE-2022-29510/): Memory corruption in Intel(R) Server Board M10JNP2SB BIOS firmware (high 7.5)
- [CVE-2022-2951](https://insights.sbomify.com/CVE-2022-2951/): Memory corruption in HyperView Player (high 7.8)
- [CVE-2022-29509](https://insights.sbomify.com/CVE-2022-29509/): Path traversal in T&D Data Server and THERMO RECORDER DATA SERVER (high 7.5)
- [CVE-2022-29508](https://insights.sbomify.com/CVE-2022-29508/): Null dereference in Intel(R) VROC software (medium 6.3)
- [CVE-2022-29507](https://insights.sbomify.com/CVE-2022-29507/): Information disclosure in version (medium 5.5)
- [CVE-2022-29506](https://insights.sbomify.com/CVE-2022-29506/): Memory corruption in V-SFT (high 7.8)
- [CVE-2022-29505](https://insights.sbomify.com/CVE-2022-29505/): Privilege escalation in LINE for Windows (high 7.8)
- [CVE-2022-29503](https://insights.sbomify.com/CVE-2022-29503/): Memory corruption in Eufy Homebase 2 (high 8.1)
- [CVE-2022-29502](https://insights.sbomify.com/CVE-2022-29502/): Privilege escalation in fedoraproject:fedora (critical 9.8)
- [CVE-2022-29501](https://insights.sbomify.com/CVE-2022-29501/): Privilege escalation in debian:debian linux (high 8.8)
- [CVE-2022-29500](https://insights.sbomify.com/CVE-2022-29500/): Information disclosure in debian:debian linux (high 8.8)
- [CVE-2022-2950](https://insights.sbomify.com/CVE-2022-2950/): Memory corruption in HyperView Player (high 7.8)
- [CVE-2022-29499](https://insights.sbomify.com/CVE-2022-29499/): Mitel MiVoice Connect Data Validation (critical 9.8, exploited in the wild)
- [CVE-2022-29498](https://insights.sbomify.com/CVE-2022-29498/): SQL injection in blazer (high 7.5)
- [CVE-2022-29496](https://insights.sbomify.com/CVE-2022-29496/): Memory corruption in Blynk-Library (critical 9.0)
- [CVE-2022-29495](https://insights.sbomify.com/CVE-2022-29495/): WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update (medium 5.4)
- [CVE-2022-29494](https://insights.sbomify.com/CVE-2022-29494/): Denial of service in OpenBMC (medium 6.5)
- [CVE-2022-29493](https://insights.sbomify.com/CVE-2022-29493/): Denial of service in Integrated BMC (medium 4.5)
- [CVE-2022-29492](https://insights.sbomify.com/CVE-2022-29492/): Denial of service in MicroSCADA Pro SYS600 (medium 5.3)
- [CVE-2022-29491](https://insights.sbomify.com/CVE-2022-29491/): Null dereference in BIG-IP LTM, Advanced WAF, ASM, and APM (high 7.5)
- [CVE-2022-29490](https://insights.sbomify.com/CVE-2022-29490/): Missing authorization in MicroSCADA X SYS600 (high 8.5)
- [CVE-2022-2949](https://insights.sbomify.com/CVE-2022-2949/): Memory corruption in HyperView Player (high 7.8)
- [CVE-2022-29489](https://insights.sbomify.com/CVE-2022-29489/): WordPress Sucuri Security plugin <= 1.8.33 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-29488](https://insights.sbomify.com/CVE-2022-29488/): Horner Automation Cscape Csfont (high 7.8)
- [CVE-2022-29487](https://insights.sbomify.com/CVE-2022-29487/): Cross-site scripting in Cybozu Office (medium 6.1)
- [CVE-2022-29486](https://insights.sbomify.com/CVE-2022-29486/): Memory corruption in Hyperscan library maintained by Intel(R) (medium 4.3)
- [CVE-2022-29485](https://insights.sbomify.com/CVE-2022-29485/): Cross-site scripting in SHIRASAGI (medium 6.1)
- [CVE-2022-29484](https://insights.sbomify.com/CVE-2022-29484/): Missing authorization in Cybozu Garoon (high 8.1)
- [CVE-2022-29483](https://insights.sbomify.com/CVE-2022-29483/): e-Design - Multiple vulnerabilities (high 7.8)
- [CVE-2022-29482](https://insights.sbomify.com/CVE-2022-29482/): Weak cryptography in Mobaoku-Auction & Flea Market App for iOS (low 3.7)
- [CVE-2022-29481](https://insights.sbomify.com/CVE-2022-29481/): Security feature bypass in InRouter302 (medium 4.9)
- [CVE-2022-29480](https://insights.sbomify.com/CVE-2022-29480/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-2948](https://insights.sbomify.com/CVE-2022-2948/): GE CIMPLICITY Heap-based Buffer Overflow (high 7.8)
- [CVE-2022-29479](https://insights.sbomify.com/CVE-2022-29479/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-29477](https://insights.sbomify.com/CVE-2022-29477/): Auth bypass in iota All-In-One Security Kit (high 8.6)
- [CVE-2022-29476](https://insights.sbomify.com/CVE-2022-29476/): Cross-site scripting in Notification Bar for WordPress (medium 6.1)
- [CVE-2022-29475](https://insights.sbomify.com/CVE-2022-29475/): Information disclosure in iota All-In-One Security Kit (medium 4.7)
- [CVE-2022-29474](https://insights.sbomify.com/CVE-2022-29474/): Path traversal in BIG-IP (medium 4.3)
- [CVE-2022-29473](https://insights.sbomify.com/CVE-2022-29473/): Denial of service in BIG-IP (medium 5.9)
- [CVE-2022-29472](https://insights.sbomify.com/CVE-2022-29472/): Command injection in iota All-In-One Security Kit (critical 10.0)
- [CVE-2022-29471](https://insights.sbomify.com/CVE-2022-29471/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2022-29470](https://insights.sbomify.com/CVE-2022-29470/): Privilege escalation in Intel DTT Software (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/332/