# Vulnerabilities published in 2022


- [CVE-2022-29111](https://insights.sbomify.com/CVE-2022-29111/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29110](https://insights.sbomify.com/CVE-2022-29110/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29109](https://insights.sbomify.com/CVE-2022-29109/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29108](https://insights.sbomify.com/CVE-2022-29108/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29107](https://insights.sbomify.com/CVE-2022-29107/): Microsoft Office Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2022-29106](https://insights.sbomify.com/CVE-2022-29106/): Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29105](https://insights.sbomify.com/CVE-2022-29105/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29104](https://insights.sbomify.com/CVE-2022-29104/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-29103](https://insights.sbomify.com/CVE-2022-29103/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-29102](https://insights.sbomify.com/CVE-2022-29102/): Windows Failover Cluster Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-29098](https://insights.sbomify.com/CVE-2022-29098/): Weak cryptography in PowerScale OneFS (high 8.1)
- [CVE-2022-29097](https://insights.sbomify.com/CVE-2022-29097/): Path traversal in Wyse Management Suite (medium 4.9)
- [CVE-2022-29096](https://insights.sbomify.com/CVE-2022-29096/): Cross-site scripting in Wyse Management Suite (medium 6.1)
- [CVE-2022-29095](https://insights.sbomify.com/CVE-2022-29095/): Cross-site scripting in SupportAssist Consumer (high 8.3)
- [CVE-2022-29094](https://insights.sbomify.com/CVE-2022-29094/): Path traversal in SupportAssist Client Consumer (high 7.1)
- [CVE-2022-29093](https://insights.sbomify.com/CVE-2022-29093/): Path traversal in SupportAssist Client Commercial (high 7.1)
- [CVE-2022-29092](https://insights.sbomify.com/CVE-2022-29092/): Privilege escalation in SupportAssist Consumer (high 7.8)
- [CVE-2022-29091](https://insights.sbomify.com/CVE-2022-29091/): Cross-site scripting in Unity (medium 5.3)
- [CVE-2022-29090](https://insights.sbomify.com/CVE-2022-29090/): Information disclosure in Wyse Management Suite (high 8.5)
- [CVE-2022-2909](https://insights.sbomify.com/CVE-2022-2909/): SourceCodester Simple and Nice Shopping Cart Script profile.php unrestricted upload (medium 6.3)
- [CVE-2022-29089](https://insights.sbomify.com/CVE-2022-29089/): Information disclosure in Dell Networking OS10 (medium 6.4)
- [CVE-2022-29085](https://insights.sbomify.com/CVE-2022-29085/): Information disclosure in Unity (medium 6.4)
- [CVE-2022-29084](https://insights.sbomify.com/CVE-2022-29084/): Auth bypass in Unity (high 8.1)
- [CVE-2022-29083](https://insights.sbomify.com/CVE-2022-29083/): Auth bypass in CPG BIOS (medium 6.8)
- [CVE-2022-29082](https://insights.sbomify.com/CVE-2022-29082/): Security feature bypass in NetWorker (low 3.7)
- [CVE-2022-29081](https://insights.sbomify.com/CVE-2022-29081/): Path traversal in zohocorp:manageengine access manager plus (critical 9.8)
- [CVE-2022-29080](https://insights.sbomify.com/CVE-2022-29080/): Command injection in npm-dependency-versions (critical 9.8)
- [CVE-2022-2908](https://insights.sbomify.com/CVE-2022-2908/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-29078](https://insights.sbomify.com/CVE-2022-29078/): ejs template injection vulnerability (critical 9.8)
- [CVE-2022-29077](https://insights.sbomify.com/CVE-2022-29077/): Memory corruption in ripple:rippled (critical 9.8)
- [CVE-2022-29072](https://insights.sbomify.com/CVE-2022-29072/): Memory corruption in 7-zip:7-zip (high 7.8)
- [CVE-2022-29071](https://insights.sbomify.com/CVE-2022-29071/): Information disclosure in CloudVision Portal (medium 4.0)
- [CVE-2022-2907](https://insights.sbomify.com/CVE-2022-2907/): Information disclosure in GitLab (medium 5.7)
- [CVE-2022-29063](https://insights.sbomify.com/CVE-2022-29063/): Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz (critical 9.8)
- [CVE-2022-29062](https://insights.sbomify.com/CVE-2022-29062/): Path traversal in Fortinet FortiSOAR (medium 6.3)
- [CVE-2022-29061](https://insights.sbomify.com/CVE-2022-29061/): Command injection in Fortinet FortiSOAR (high 7.2)
- [CVE-2022-29060](https://insights.sbomify.com/CVE-2022-29060/): Hardcoded credentials in Fortinet FortiDDoS (high 8.1)
- [CVE-2022-2906](https://insights.sbomify.com/CVE-2022-2906/): Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only) (high 7.5)
- [CVE-2022-29059](https://insights.sbomify.com/CVE-2022-29059/): SQL injection in FortiWeb (low 2.6)
- [CVE-2022-29058](https://insights.sbomify.com/CVE-2022-29058/): Command injection in Fortinet FortiAP, FortiAP-S, FortiAP-W2, FortiAP-U (high 7.8)
- [CVE-2022-29057](https://insights.sbomify.com/CVE-2022-29057/): Cross-site scripting in Fortinet FortiEDR (medium 5.4)
- [CVE-2022-29056](https://insights.sbomify.com/CVE-2022-29056/): Denial of service in FortiMail (low 3.5)
- [CVE-2022-29055](https://insights.sbomify.com/CVE-2022-29055/): Null dereference in Fortinet FortiOS, FortiProxy (high 7.5)
- [CVE-2022-29054](https://insights.sbomify.com/CVE-2022-29054/): Weak cryptography in FortiOS (low 3.1)
- [CVE-2022-29053](https://insights.sbomify.com/CVE-2022-29053/): Weak cryptography in Fortinet FortiOS (low 2.3)
- [CVE-2022-29052](https://insights.sbomify.com/CVE-2022-29052/): Private key stored in plain text by Jenkins Google Compute Engine Plugin (medium 4.3)
- [CVE-2022-29051](https://insights.sbomify.com/CVE-2022-29051/): Missing permission checks in Jenkins Publish Over FTP Plugin (medium 4.3)
- [CVE-2022-29050](https://insights.sbomify.com/CVE-2022-29050/): CSRF vulnerability in Jenkins Publish Over FTP Plugin (high 8.8)
- [CVE-2022-2905](https://insights.sbomify.com/CVE-2022-2905/): Memory corruption in kernel (medium 5.5)
- [CVE-2022-29049](https://insights.sbomify.com/CVE-2022-29049/): Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL (medium 5.4)
- [CVE-2022-29048](https://insights.sbomify.com/CVE-2022-29048/): CSRF vulnerability in Jenkins Subversion Plugin (medium 4.3)
- [CVE-2022-29047](https://insights.sbomify.com/CVE-2022-29047/): Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin (medium 5.3)
- [CVE-2022-29046](https://insights.sbomify.com/CVE-2022-29046/): Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin (medium 5.4)
- [CVE-2022-29045](https://insights.sbomify.com/CVE-2022-29045/): Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin (medium 5.4)
- [CVE-2022-29044](https://insights.sbomify.com/CVE-2022-29044/): Stored Cross-site Scripting in Jenkins Node and Label parameter Plugin (medium 5.4)
- [CVE-2022-29043](https://insights.sbomify.com/CVE-2022-29043/): Stored Cross-site Scripting in Jenkins Mask Passwords Plugin (medium 5.4)
- [CVE-2022-29042](https://insights.sbomify.com/CVE-2022-29042/): Stored Cross-site Scripting vulnerability in Jenkins Job Generator Plugin (medium 5.4)
- [CVE-2022-29041](https://insights.sbomify.com/CVE-2022-29041/): Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin (medium 5.4)
- [CVE-2022-29040](https://insights.sbomify.com/CVE-2022-29040/): Stored XSS vulnerability in Jenkins Git Parameter Plugin (medium 5.4)
- [CVE-2022-2904](https://insights.sbomify.com/CVE-2022-2904/): Cross-site scripting in GitLab (high 7.3)
- [CVE-2022-29039](https://insights.sbomify.com/CVE-2022-29039/): Stored Cross-site Scripting vulnerability in Jenkins Gerrit Trigger Plugin (medium 5.4)
- [CVE-2022-29038](https://insights.sbomify.com/CVE-2022-29038/): Stored Cross-site Scripting vulnerabilities in Jenkins Extended Choice Parameter Plugin (medium 5.4)
- [CVE-2022-29037](https://insights.sbomify.com/CVE-2022-29037/): Stored XSS in Jenkins CVS Plugin (medium 5.4)
- [CVE-2022-29036](https://insights.sbomify.com/CVE-2022-29036/): Cross-site Scripting in Jenkins Credentials Plugin (medium 5.4)
- [CVE-2022-29035](https://insights.sbomify.com/CVE-2022-29035/): Weak cryptography in Ktor (low 3.3)
- [CVE-2022-29034](https://insights.sbomify.com/CVE-2022-29034/): Cross-site scripting in SINEMA Remote Connect Server (medium 6.1)
- [CVE-2022-29033](https://insights.sbomify.com/CVE-2022-29033/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-29032](https://insights.sbomify.com/CVE-2022-29032/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-29031](https://insights.sbomify.com/CVE-2022-29031/): Null dereference in JT2Go (medium 5.5)
- [CVE-2022-29030](https://insights.sbomify.com/CVE-2022-29030/): Integer overflow in JT2Go (medium 5.5)
- [CVE-2022-2903](https://insights.sbomify.com/CVE-2022-2903/): NinjaForms < 3.6.13 - Admin+ PHP Objection Injection (high 7.2)
- [CVE-2022-29029](https://insights.sbomify.com/CVE-2022-29029/): Null dereference in JT2Go (medium 5.5)
- [CVE-2022-29028](https://insights.sbomify.com/CVE-2022-29028/): Denial of service in JT2Go (medium 5.5)
- [CVE-2022-29023](https://insights.sbomify.com/CVE-2022-29023/): Memory corruption in openrazer project:openrazer (critical 9.8)
- [CVE-2022-29022](https://insights.sbomify.com/CVE-2022-29022/): Memory corruption in openrazer project:openrazer (critical 9.8)
- [CVE-2022-29021](https://insights.sbomify.com/CVE-2022-29021/): Memory corruption in openrazer project:openrazer (critical 9.8)
- [CVE-2022-29020](https://insights.sbomify.com/CVE-2022-29020/): Cross-site scripting in forestblog project:forestblog (medium 6.1)
- [CVE-2022-29017](https://insights.sbomify.com/CVE-2022-29017/): Memory corruption in axiosys:bento4 (medium 5.5)
- [CVE-2022-29014](https://insights.sbomify.com/CVE-2022-29014/): Path traversal in razer:sila firmware (high 7.5)
- [CVE-2022-29013](https://insights.sbomify.com/CVE-2022-29013/): Command injection in razer:sila firmware (critical 9.8)
- [CVE-2022-2901](https://insights.sbomify.com/CVE-2022-2901/): Improper Authorization in chatwoot/chatwoot (high 7.6)
- [CVE-2022-29009](https://insights.sbomify.com/CVE-2022-29009/): SQL injection in phpgurukul:cyber cafe management system (critical 9.8)
- [CVE-2022-29008](https://insights.sbomify.com/CVE-2022-29008/): Missing authorization in phpgurukul:bus pass management system (medium 6.5)
- [CVE-2022-29007](https://insights.sbomify.com/CVE-2022-29007/): SQL injection in phpgurukul:dairy farm shop management system (critical 9.8)
- [CVE-2022-29006](https://insights.sbomify.com/CVE-2022-29006/): SQL injection in phpgurukul:directory management system (critical 9.8)
- [CVE-2022-29005](https://insights.sbomify.com/CVE-2022-29005/): Cross-site scripting in phpgurukul:online birth certificate system (medium 6.1)
- [CVE-2022-29004](https://insights.sbomify.com/CVE-2022-29004/): Cross-site scripting in phpgurukul:e-diary management system (medium 6.1)
- [CVE-2022-29002](https://insights.sbomify.com/CVE-2022-29002/): Cross-Site Request Forgery in XXL-Job (high 8.8)
- [CVE-2022-29001](https://insights.sbomify.com/CVE-2022-29001/): File upload in springbootmovie project:springbootmovie (high 7.2)
- [CVE-2022-2900](https://insights.sbomify.com/CVE-2022-2900/): Server-Side Request Forgery (SSRF) in ionicabizau/parse-url (critical 9.1)
- [CVE-2022-28999](https://insights.sbomify.com/CVE-2022-28999/): Misconfiguration in bloodshed:dev-c\+\+ (high 8.8)
- [CVE-2022-28998](https://insights.sbomify.com/CVE-2022-28998/): Memory corruption in xlightftpd:xlight ftp (high 8.1)
- [CVE-2022-28997](https://insights.sbomify.com/CVE-2022-28997/): Server-side request forgery in cszcms:cszcms (high 7.5)
- [CVE-2022-28995](https://insights.sbomify.com/CVE-2022-28995/): Code injection in yogeshojha:rengine (critical 9.8)
- [CVE-2022-28994](https://insights.sbomify.com/CVE-2022-28994/): Memory corruption in smallsrv:small http server (critical 9.8)
- [CVE-2022-28993](https://insights.sbomify.com/CVE-2022-28993/): Missing authorization in bdtask:multi store inventory management system (critical 9.8)
- [CVE-2022-28992](https://insights.sbomify.com/CVE-2022-28992/): Cross-site request forgery in phpgurukul:online banquet booking system (high 8.8)
- [CVE-2022-28991](https://insights.sbomify.com/CVE-2022-28991/): Information disclosure in bdtask:multi store inventory management system (high 7.5)
- [CVE-2022-28990](https://insights.sbomify.com/CVE-2022-28990/): Buffer overflow in wasm3 (high 7.8)
- [CVE-2022-28987](https://insights.sbomify.com/CVE-2022-28987/): Information disclosure in zohocorp:manageengine adselfservice plus (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/336/