# Vulnerabilities published in 2022


- [CVE-2022-29333](https://insights.sbomify.com/CVE-2022-29333/): Privilege escalation in cyberlink:powerdirector (high 7.8)
- [CVE-2022-29332](https://insights.sbomify.com/CVE-2022-29332/): Path traversal in dlink:dir-825 firmware (medium 6.5)
- [CVE-2022-29330](https://insights.sbomify.com/CVE-2022-29330/): Missing authorization in vitalpbx:vitalpbx (medium 4.9)
- [CVE-2022-2933](https://insights.sbomify.com/CVE-2022-2933/): 0mk Shortener <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-29329](https://insights.sbomify.com/CVE-2022-29329/): Memory corruption in dlink:dap-1330 firmware (critical 9.8)
- [CVE-2022-29328](https://insights.sbomify.com/CVE-2022-29328/): Memory corruption in dlink:dap-1330 firmware (critical 9.8)
- [CVE-2022-29327](https://insights.sbomify.com/CVE-2022-29327/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29326](https://insights.sbomify.com/CVE-2022-29326/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29325](https://insights.sbomify.com/CVE-2022-29325/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29324](https://insights.sbomify.com/CVE-2022-29324/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29323](https://insights.sbomify.com/CVE-2022-29323/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29322](https://insights.sbomify.com/CVE-2022-29322/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29321](https://insights.sbomify.com/CVE-2022-29321/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-29320](https://insights.sbomify.com/CVE-2022-29320/): Privilege escalation in minitool:partition wizard (high 7.8)
- [CVE-2022-2932](https://insights.sbomify.com/CVE-2022-2932/): Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kit (critical 9.8)
- [CVE-2022-29318](https://insights.sbomify.com/CVE-2022-29318/): File upload in car rental management system project:car rental management system (high 7.2)
- [CVE-2022-29317](https://insights.sbomify.com/CVE-2022-29317/): SQL injection in simple bus ticket booking system project:simple bus ticket booking system (critical 9.8)
- [CVE-2022-29316](https://insights.sbomify.com/CVE-2022-29316/): SQL injection in complete online job search system project:complete online job search system (critical 9.8)
- [CVE-2022-29315](https://insights.sbomify.com/CVE-2022-29315/): Code injection in invicti:acunetix (high 8.8)
- [CVE-2022-2931](https://insights.sbomify.com/CVE-2022-2931/): Denial of service in GitLab (high 7.5)
- [CVE-2022-29309](https://insights.sbomify.com/CVE-2022-29309/): Server-side request forgery in wangl1989:mysiteforme (high 7.5)
- [CVE-2022-29307](https://insights.sbomify.com/CVE-2022-29307/): Code injection in ionizecms:ionize (critical 9.8)
- [CVE-2022-29306](https://insights.sbomify.com/CVE-2022-29306/): SQL injection in ionizecms:ionize (critical 9.8)
- [CVE-2022-29305](https://insights.sbomify.com/CVE-2022-29305/): SQL injection in helloxz/imgurl (high 8.1)
- [CVE-2022-29304](https://insights.sbomify.com/CVE-2022-29304/): SQL injection in online sports complex booking system project:online sports complex booking system (high 8.8)
- [CVE-2022-29303](https://insights.sbomify.com/CVE-2022-29303/): SolarView Compact Command Injection (critical 9.8, exploited in the wild)
- [CVE-2022-29302](https://insights.sbomify.com/CVE-2022-29302/): Information disclosure in contec:sv-cpt-mc310 firmware (medium 5.5)
- [CVE-2022-2930](https://insights.sbomify.com/CVE-2022-2930/): Unverified Password Change in octoprint/octoprint (medium 5.3)
- [CVE-2022-29298](https://insights.sbomify.com/CVE-2022-29298/): Path traversal in contec:sv-cpt-mc310 firmware (high 7.5)
- [CVE-2022-29296](https://insights.sbomify.com/CVE-2022-29296/): Cross-site scripting in avantune:genialcloud proj (medium 6.1)
- [CVE-2022-2929](https://insights.sbomify.com/CVE-2022-2929/): DHCP memory leak (medium 6.5)
- [CVE-2022-29287](https://insights.sbomify.com/CVE-2022-29287/): Missing authorization in kentico:xperience (medium 4.9)
- [CVE-2022-29286](https://insights.sbomify.com/CVE-2022-29286/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-29281](https://insights.sbomify.com/CVE-2022-29281/): Path traversal in notable:notable (high 8.8)
- [CVE-2022-2928](https://insights.sbomify.com/CVE-2022-2928/): An option refcount overflow exists in dhcpd (medium 6.5)
- [CVE-2022-29279](https://insights.sbomify.com/CVE-2022-29279/): Memory corruption in insyde:kernel (high 8.2)
- [CVE-2022-29278](https://insights.sbomify.com/CVE-2022-29278/): Memory corruption in insyde:kernel (high 8.2)
- [CVE-2022-29277](https://insights.sbomify.com/CVE-2022-29277/): Memory corruption in amd:genoa firmware (high 8.8)
- [CVE-2022-29276](https://insights.sbomify.com/CVE-2022-29276/): Memory corruption in insyde:kernel (high 8.2)
- [CVE-2022-29275](https://insights.sbomify.com/CVE-2022-29275/): Memory corruption in insyde:kernel (high 8.2)
- [CVE-2022-29273](https://insights.sbomify.com/CVE-2022-29273/): Cross-site scripting in netgate:pfsense (medium 6.1)
- [CVE-2022-29272](https://insights.sbomify.com/CVE-2022-29272/): Open redirect in nagios:nagios xi (medium 6.1)
- [CVE-2022-29271](https://insights.sbomify.com/CVE-2022-29271/): Missing authorization in nagios:nagios xi (medium 6.5)
- [CVE-2022-29270](https://insights.sbomify.com/CVE-2022-29270/): Auth bypass in nagios:nagios xi (medium 4.3)
- [CVE-2022-2927](https://insights.sbomify.com/CVE-2022-2927/): Weak Password Requirements in notrinos/notrinoserp (high 7.3)
- [CVE-2022-29269](https://insights.sbomify.com/CVE-2022-29269/): Cross-site scripting in nagios:nagios xi (medium 6.5)
- [CVE-2022-29266](https://insights.sbomify.com/CVE-2022-29266/): apisix/jwt-auth may leak secrets in error response (high 7.5)
- [CVE-2022-29265](https://insights.sbomify.com/CVE-2022-29265/): Improper Restriction of XML External Entity References in Multiple Components (high 7.5)
- [CVE-2022-29264](https://insights.sbomify.com/CVE-2022-29264/): Other in coreboot:coreboot (critical 9.8)
- [CVE-2022-29263](https://insights.sbomify.com/CVE-2022-29263/): Misconfiguration in BIG-IP APM (high 7.8)
- [CVE-2022-29262](https://insights.sbomify.com/CVE-2022-29262/): Memory corruption in Intel(R) Server Board BIOS firmware (high 7.9)
- [CVE-2022-2926](https://insights.sbomify.com/CVE-2022-2926/): Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal (medium 4.9)
- [CVE-2022-29258](https://insights.sbomify.com/CVE-2022-29258/): Cross-site Scripting in Filter Stream Converter Application in XWiki Platform (high 7.4)
- [CVE-2022-29257](https://insights.sbomify.com/CVE-2022-29257/): Electron's AutoUpdater module fails to validate certain nested components of the bundle (medium 6.6)
- [CVE-2022-29256](https://insights.sbomify.com/CVE-2022-29256/): Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment (medium 6.5)
- [CVE-2022-29255](https://insights.sbomify.com/CVE-2022-29255/): Multiple evaluation of contract address in call in vyper (high 8.2)
- [CVE-2022-29254](https://insights.sbomify.com/CVE-2022-29254/): Failed payment recorded has completed in silverstripe/silverstripe-omnipay (low 3.7)
- [CVE-2022-29253](https://insights.sbomify.com/CVE-2022-29253/): Path Traversal in XWiki Platform (low 2.7)
- [CVE-2022-29252](https://insights.sbomify.com/CVE-2022-29252/): Cross-site Scripting in XWiki Platform Wiki UI Main Wiki (high 7.4)
- [CVE-2022-29251](https://insights.sbomify.com/CVE-2022-29251/): Cross-site Scripting in the Flamingo theme manager (high 7.4)
- [CVE-2022-29250](https://insights.sbomify.com/CVE-2022-29250/): SQL injection in GLPI (high 8.1)
- [CVE-2022-2925](https://insights.sbomify.com/CVE-2022-2925/): Cross-site Scripting (XSS) - Stored in appwrite/appwrite (critical 9.0)
- [CVE-2022-29249](https://insights.sbomify.com/CVE-2022-29249/): Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ (high 7.5)
- [CVE-2022-29248](https://insights.sbomify.com/CVE-2022-29248/): Cross-domain cookie leakage in Guzzle (high 8.0)
- [CVE-2022-29247](https://insights.sbomify.com/CVE-2022-29247/): Exposure of Resource to Wrong Sphere in Electron (low 2.2)
- [CVE-2022-29246](https://insights.sbomify.com/CVE-2022-29246/): Potential buffer overflow in function DFU upload in Azure RTOS USBX (critical 9.8)
- [CVE-2022-29245](https://insights.sbomify.com/CVE-2022-29245/): Weak private key generation in SSH.NET (medium 6.5)
- [CVE-2022-29244](https://insights.sbomify.com/CVE-2022-29244/): npm packing does not respect root-level ignore files in workspaces (high 7.5)
- [CVE-2022-29243](https://insights.sbomify.com/CVE-2022-29243/): Improper input-size validation on the user new session name in Nextcloud Server (medium 4.3)
- [CVE-2022-29242](https://insights.sbomify.com/CVE-2022-29242/): Buffer Overflow on creating key transport blob in GOST Engine (medium 5.9)
- [CVE-2022-29241](https://insights.sbomify.com/CVE-2022-29241/): Known or guessable hidden files may be accessed in Jupyter Server (high 7.1)
- [CVE-2022-29240](https://insights.sbomify.com/CVE-2022-29240/): Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla (high 8.1)
- [CVE-2022-2924](https://insights.sbomify.com/CVE-2022-2924/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (high 7.1)
- [CVE-2022-29238](https://insights.sbomify.com/CVE-2022-29238/): Forced Browsing in Jupyter Notebook (medium 4.3)
- [CVE-2022-29237](https://insights.sbomify.com/CVE-2022-29237/): Limited Authentication Bypass for Media Files in Opencast (medium 5.4)
- [CVE-2022-29236](https://insights.sbomify.com/CVE-2022-29236/): Improper access control for pencil annotations in BigBlueButton (medium 4.3)
- [CVE-2022-29235](https://insights.sbomify.com/CVE-2022-29235/): Limited data exposure for shared external videos in BigBlueButton (medium 5.3)
- [CVE-2022-29234](https://insights.sbomify.com/CVE-2022-29234/): Grace period for lock settings in public/private chats in BigBlueButton (medium 4.3)
- [CVE-2022-29233](https://insights.sbomify.com/CVE-2022-29233/): Improper access control for breakout rooms in BigBlue Button (medium 4.3)
- [CVE-2022-29232](https://insights.sbomify.com/CVE-2022-29232/): Exposure of messages in BigBlueButton public chats (medium 6.5)
- [CVE-2022-29230](https://insights.sbomify.com/CVE-2022-29230/): Potential cross-site scripting (XSS) vulnerability in Hydrogen (medium 6.3)
- [CVE-2022-2923](https://insights.sbomify.com/CVE-2022-2923/): NULL Pointer Dereference in vim/vim (medium 6.6)
- [CVE-2022-29229](https://insights.sbomify.com/CVE-2022-29229/): Missing Cryptographic Step in cassproject (medium 6.3)
- [CVE-2022-29228](https://insights.sbomify.com/CVE-2022-29228/): Reachable assertion in Envoy (high 7.5)
- [CVE-2022-29227](https://insights.sbomify.com/CVE-2022-29227/): Use after free in Envoy (high 7.5)
- [CVE-2022-29226](https://insights.sbomify.com/CVE-2022-29226/): Trivial authentication bypass in Envoy (critical 10.0)
- [CVE-2022-29225](https://insights.sbomify.com/CVE-2022-29225/): Zip bomb vulnerability in Envoy (high 7.5)
- [CVE-2022-29224](https://insights.sbomify.com/CVE-2022-29224/): Segmentation fault leading to crash in Envoy (medium 5.9)
- [CVE-2022-29223](https://insights.sbomify.com/CVE-2022-29223/): Buffer overflow on HUB descriptor in Azure RTOS USBX (high 7.5)
- [CVE-2022-29222](https://insights.sbomify.com/CVE-2022-29222/): Improper Certificate Validation in Pion DTLS (medium 5.9)
- [CVE-2022-29221](https://insights.sbomify.com/CVE-2022-29221/): PHP Code Injection by malicious block or filename in Smarty (high 8.8)
- [CVE-2022-29220](https://insights.sbomify.com/CVE-2022-29220/): No verification of commits origin in github-action-merge-dependabot (medium 6.5)
- [CVE-2022-2922](https://insights.sbomify.com/CVE-2022-2922/): Relative Path Traversal in dnnsoftware/dnn.platform (medium 4.9)
- [CVE-2022-29219](https://insights.sbomify.com/CVE-2022-29219/): Integer Overflow in Lodestar (high 7.5)
- [CVE-2022-29218](https://insights.sbomify.com/CVE-2022-29218/): Unauthorized takeover for new versions of some platform-specific gems (high 7.7)
- [CVE-2022-29217](https://insights.sbomify.com/CVE-2022-29217/): Key confusion through non-blocklisted public key formats in PyJWT (high 7.4)
- [CVE-2022-29216](https://insights.sbomify.com/CVE-2022-29216/): Code injection in `saved_model_cli` in TensorFlow (high 7.8)
- [CVE-2022-29215](https://insights.sbomify.com/CVE-2022-29215/): Argument Injection in RegionProtect (high 7.5)
- [CVE-2022-29214](https://insights.sbomify.com/CVE-2022-29214/): URL Redirection to Untrusted Site ('Open Redirect') in next-auth (medium 6.1)
- [CVE-2022-29213](https://insights.sbomify.com/CVE-2022-29213/): Incomplete validation in signal ops leads to crashes in TensorFlow (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/334/