# Vulnerabilities published in 2022


- [CVE-2022-27617](https://insights.sbomify.com/CVE-2022-27617/): Path traversal in Synology Calendar (medium 5.0)
- [CVE-2022-27616](https://insights.sbomify.com/CVE-2022-27616/): Command injection in DiskStation Manager (DSM) (high 7.2)
- [CVE-2022-27615](https://insights.sbomify.com/CVE-2022-27615/): Path traversal in DNS Server (high 7.7)
- [CVE-2022-27614](https://insights.sbomify.com/CVE-2022-27614/): Information disclosure in Media Server (medium 5.3)
- [CVE-2022-27613](https://insights.sbomify.com/CVE-2022-27613/): SQL injection in CardDAV Server (high 8.3)
- [CVE-2022-27612](https://insights.sbomify.com/CVE-2022-27612/): Memory corruption in Audio Station (high 7.3)
- [CVE-2022-27611](https://insights.sbomify.com/CVE-2022-27611/): Path traversal in Audio Station (medium 5.4)
- [CVE-2022-27610](https://insights.sbomify.com/CVE-2022-27610/): Path traversal in DiskStation Manager (DSM) (medium 6.5)
- [CVE-2022-2761](https://insights.sbomify.com/CVE-2022-2761/): Information disclosure in GitLab (medium 4.3)
- [CVE-2022-27609](https://insights.sbomify.com/CVE-2022-27609/): Security feature bypass in One Endpoint (medium 6.0)
- [CVE-2022-27608](https://insights.sbomify.com/CVE-2022-27608/): Security feature bypass in One Endpoint (medium 6.0)
- [CVE-2022-27607](https://insights.sbomify.com/CVE-2022-27607/): Memory corruption in axiosys:bento4 (high 8.1)
- [CVE-2022-27600](https://insights.sbomify.com/CVE-2022-27600/): QTS, QuTS hero, QuTScloud (medium 6.8)
- [CVE-2022-2760](https://insights.sbomify.com/CVE-2022-2760/): Information disclosure in Octopus Server (medium 4.3)
- [CVE-2022-27599](https://insights.sbomify.com/CVE-2022-27599/): QVR Pro Client (medium 6.7)
- [CVE-2022-27598](https://insights.sbomify.com/CVE-2022-27598/): QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) (low 2.7)
- [CVE-2022-27597](https://insights.sbomify.com/CVE-2022-27597/): QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) (low 2.7)
- [CVE-2022-27596](https://insights.sbomify.com/CVE-2022-27596/): Vulnerability in QTS (critical 9.8)
- [CVE-2022-27595](https://insights.sbomify.com/CVE-2022-27595/): QVPN Device Client (high 7.8)
- [CVE-2022-27593](https://insights.sbomify.com/CVE-2022-27593/): QNAP Photo Station Externally Controlled Reference (critical 10.0, exploited in the wild)
- [CVE-2022-27592](https://insights.sbomify.com/CVE-2022-27592/): QVR Smart Client (medium 6.7)
- [CVE-2022-2759](https://insights.sbomify.com/CVE-2022-2759/): XML external entity in Delta Robot Automation Studio (DRAS) (medium 5.5)
- [CVE-2022-27588](https://insights.sbomify.com/CVE-2022-27588/): Vulnerability in QVR (critical 9.8)
- [CVE-2022-27586](https://insights.sbomify.com/CVE-2022-27586/): Auth bypass in SICK SIM1004 (critical 9.8)
- [CVE-2022-27585](https://insights.sbomify.com/CVE-2022-27585/): Auth bypass in SICK SIM1000 FX (critical 9.8)
- [CVE-2022-27584](https://insights.sbomify.com/CVE-2022-27584/): Auth bypass in SICK SIM2000ST (PPC) (critical 9.8)
- [CVE-2022-27583](https://insights.sbomify.com/CVE-2022-27583/): Missing authorization in SICK FlexiCompact (critical 9.1)
- [CVE-2022-27582](https://insights.sbomify.com/CVE-2022-27582/): Auth bypass in SICK SIM4000 (PPC) (critical 9.8)
- [CVE-2022-27581](https://insights.sbomify.com/CVE-2022-27581/): Weak cryptography in SICK RFU61x Firmware (medium 6.5)
- [CVE-2022-27580](https://insights.sbomify.com/CVE-2022-27580/): Deserialization in SICK Safety Designer (high 7.8)
- [CVE-2022-2758](https://insights.sbomify.com/CVE-2022-2758/): Update (medium 6.5)
- [CVE-2022-27579](https://insights.sbomify.com/CVE-2022-27579/): Deserialization in SICK Flexi Soft Designer (high 7.8)
- [CVE-2022-27578](https://insights.sbomify.com/CVE-2022-27578/): Privilege escalation in SICK Overall Equipment Effectiveness (high 7.8)
- [CVE-2022-27577](https://insights.sbomify.com/CVE-2022-27577/): Weak cryptography in SICK MSC800 (critical 9.1)
- [CVE-2022-27576](https://insights.sbomify.com/CVE-2022-27576/): Information disclosure in Samsung Mobile Devices (low 3.3)
- [CVE-2022-27575](https://insights.sbomify.com/CVE-2022-27575/): Information disclosure in Samsung Mobile Devices (low 3.3)
- [CVE-2022-27574](https://insights.sbomify.com/CVE-2022-27574/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-27573](https://insights.sbomify.com/CVE-2022-27573/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-27572](https://insights.sbomify.com/CVE-2022-27572/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2022-27571](https://insights.sbomify.com/CVE-2022-27571/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2022-27570](https://insights.sbomify.com/CVE-2022-27570/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2022-2757](https://insights.sbomify.com/CVE-2022-2757/): Missing authorization in TMS300 CS (critical 9.8)
- [CVE-2022-27569](https://insights.sbomify.com/CVE-2022-27569/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2022-27568](https://insights.sbomify.com/CVE-2022-27568/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2022-27567](https://insights.sbomify.com/CVE-2022-27567/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-27563](https://insights.sbomify.com/CVE-2022-27563/): Overload/denial of service affects HCL VersionVault Express (high 7.5)
- [CVE-2022-27562](https://insights.sbomify.com/CVE-2022-27562/): HCL Domino Volt is affected by an unrestricted upload of a dangerous file type (medium 4.6)
- [CVE-2022-27561](https://insights.sbomify.com/CVE-2022-27561/): HCL Traveler is susceptible to a Reflected Cross-Site Scripting vulnerability in the web admin (LotusTraveler.nsf) (high 7.5)
- [CVE-2022-27560](https://insights.sbomify.com/CVE-2022-27560/): An insufficiently protected credential vulnerability affects HCL VersionVault Express (medium 6.0)
- [CVE-2022-2756](https://insights.sbomify.com/CVE-2022-2756/): Server-Side Request Forgery (SSRF) in kareadita/kavita (high 7.1)
- [CVE-2022-27558](https://insights.sbomify.com/CVE-2022-27558/): HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. (medium 5.9)
- [CVE-2022-27551](https://insights.sbomify.com/CVE-2022-27551/): HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551) (medium 5.3)
- [CVE-2022-27549](https://insights.sbomify.com/CVE-2022-27549/): HCL Launch could disclose sensitive database information to a local user in plain text. (medium 4.0)
- [CVE-2022-27548](https://insights.sbomify.com/CVE-2022-27548/): HCL Launch is vulnerable to information disclosure which can be read by a local user. (medium 4.9)
- [CVE-2022-27547](https://insights.sbomify.com/CVE-2022-27547/): HCL iNotes is susceptible to a link to non-existent domain vulnerability. (medium 6.1)
- [CVE-2022-27546](https://insights.sbomify.com/CVE-2022-27546/): HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability (high 8.3)
- [CVE-2022-27545](https://insights.sbomify.com/CVE-2022-27545/): HCL BigFix Web Reports authorized users may perform HTML injection. (medium 4.6)
- [CVE-2022-27544](https://insights.sbomify.com/CVE-2022-27544/): HCL BigFix Web Reports authorized users may see sensitive information in clear text (medium 5.0)
- [CVE-2022-27541](https://insights.sbomify.com/CVE-2022-27541/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-27540](https://insights.sbomify.com/CVE-2022-27540/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-2754](https://insights.sbomify.com/CVE-2022-2754/): Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Blind SQLi (critical 9.8)
- [CVE-2022-27539](https://insights.sbomify.com/CVE-2022-27539/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-27538](https://insights.sbomify.com/CVE-2022-27538/): Race condition in HP PC BIOS (high 7.0)
- [CVE-2022-27537](https://insights.sbomify.com/CVE-2022-27537/): Code injection in HP PC BIOS (high 7.8)
- [CVE-2022-27536](https://insights.sbomify.com/CVE-2022-27536/): Denial of service in golang:go (high 7.5)
- [CVE-2022-27535](https://insights.sbomify.com/CVE-2022-27535/): Other in Kaspersky VPN Secure Connection for Windows (high 7.8)
- [CVE-2022-27534](https://insights.sbomify.com/CVE-2022-27534/): Memory corruption in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security (critical 9.8)
- [CVE-2022-27532](https://insights.sbomify.com/CVE-2022-27532/): Memory corruption in Autodesk 3ds Max (high 7.8)
- [CVE-2022-27531](https://insights.sbomify.com/CVE-2022-27531/): Memory corruption in Autodesk 3ds Max (high 7.8)
- [CVE-2022-27530](https://insights.sbomify.com/CVE-2022-27530/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-2753](https://insights.sbomify.com/CVE-2022-2753/): Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2022-27529](https://insights.sbomify.com/CVE-2022-27529/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-27528](https://insights.sbomify.com/CVE-2022-27528/): Use after free in Autodesk Navisworks (high 7.8)
- [CVE-2022-27527](https://insights.sbomify.com/CVE-2022-27527/): Memory corruption in Navisworks (high 7.8)
- [CVE-2022-27526](https://insights.sbomify.com/CVE-2022-27526/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-27525](https://insights.sbomify.com/CVE-2022-27525/): Memory corruption in Autodesk® Design Review (high 7.8)
- [CVE-2022-27524](https://insights.sbomify.com/CVE-2022-27524/): Memory corruption in Autodesk Trueview (high 7.1)
- [CVE-2022-27523](https://insights.sbomify.com/CVE-2022-27523/): Memory corruption in Autodesk Trueview (high 7.1)
- [CVE-2022-2752](https://insights.sbomify.com/CVE-2022-2752/): Potential vulnerabilities in GM login process (medium 5.5)
- [CVE-2022-27518](https://insights.sbomify.com/CVE-2022-27518/): Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2022-27516](https://insights.sbomify.com/CVE-2022-27516/): User login brute force protection functionality bypass (medium 5.3)
- [CVE-2022-27513](https://insights.sbomify.com/CVE-2022-27513/): Remote desktop takeover via phishing (high 8.3)
- [CVE-2022-27512](https://insights.sbomify.com/CVE-2022-27512/): Temporary disruption of the ADM license service (medium 5.3)
- [CVE-2022-27511](https://insights.sbomify.com/CVE-2022-27511/): Missing authorization in Citrix Application Delivery Management (Citrix ADM) (high 8.1)
- [CVE-2022-27510](https://insights.sbomify.com/CVE-2022-27510/): Unauthorized access to Gateway user capabilities (critical 9.8)
- [CVE-2022-2751](https://insights.sbomify.com/CVE-2022-2751/): SourceCodester Company Website CMS add-portfolio.php unrestricted upload (medium 6.3)
- [CVE-2022-27509](https://insights.sbomify.com/CVE-2022-27509/): Unauthenticated redirection to a malicious website (medium 6.1)
- [CVE-2022-27508](https://insights.sbomify.com/CVE-2022-27508/): Unauthenticated denial of service (high 7.5)
- [CVE-2022-27507](https://insights.sbomify.com/CVE-2022-27507/): Authenticated denial of service (medium 6.5)
- [CVE-2022-27506](https://insights.sbomify.com/CVE-2022-27506/): Hardcoded credentials in Citrix SD-WAN (low 2.7)
- [CVE-2022-27505](https://insights.sbomify.com/CVE-2022-27505/): Reflected cross site scripting (XSS) (medium 6.1)
- [CVE-2022-27503](https://insights.sbomify.com/CVE-2022-27503/): Cross-site scripting in StoreFront (medium 6.1)
- [CVE-2022-27502](https://insights.sbomify.com/CVE-2022-27502/): Privilege escalation in realvnc:vnc server (high 7.8)
- [CVE-2022-27500](https://insights.sbomify.com/CVE-2022-27500/): Misconfiguration in Intel(R) Support Android application (medium 5.5)
- [CVE-2022-2750](https://insights.sbomify.com/CVE-2022-2750/): SourceCodester Company Website CMS Add Service add-service.php unrestricted upload (medium 6.3)
- [CVE-2022-27499](https://insights.sbomify.com/CVE-2022-27499/): Information disclosure in Intel(R) SGX SDK software (low 2.5)
- [CVE-2022-27498](https://insights.sbomify.com/CVE-2022-27498/): Path traversal in lansweeper (critical 9.1)
- [CVE-2022-27497](https://insights.sbomify.com/CVE-2022-27497/): Null dereference in Intel(R) AMT (high 8.6)
- [CVE-2022-27496](https://insights.sbomify.com/CVE-2022-27496/): Cross-site scripting in Zero-channel BBS Plus (medium 6.1)
- [CVE-2022-27495](https://insights.sbomify.com/CVE-2022-27495/): Missing authorization in NGINX Service Mesh (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/348/