# Vulnerabilities published in 2022


- [CVE-2022-26934](https://insights.sbomify.com/CVE-2022-26934/): Windows Graphics Component Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-26933](https://insights.sbomify.com/CVE-2022-26933/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-26932](https://insights.sbomify.com/CVE-2022-26932/): Storage Spaces Direct Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2022-26931](https://insights.sbomify.com/CVE-2022-26931/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2022-26930](https://insights.sbomify.com/CVE-2022-26930/): Windows Remote Access Connection Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-2693](https://insights.sbomify.com/CVE-2022-2693/): SourceCodester Electronic Medical Records System UPDATE Statement register.php sql injection (medium 6.3)
- [CVE-2022-26929](https://insights.sbomify.com/CVE-2022-26929/): .NET Framework Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26928](https://insights.sbomify.com/CVE-2022-26928/): Windows Photo Import API Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-26927](https://insights.sbomify.com/CVE-2022-26927/): Windows Graphics Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-26926](https://insights.sbomify.com/CVE-2022-26926/): Windows Address Book Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26925](https://insights.sbomify.com/CVE-2022-26925/): Microsoft Windows LSA Spoofing (high 8.1, exploited in the wild)
- [CVE-2022-26924](https://insights.sbomify.com/CVE-2022-26924/): YARP Denial of Service Vulnerability (high 7.5)
- [CVE-2022-26923](https://insights.sbomify.com/CVE-2022-26923/): Microsoft Active Directory Domain Services Privilege Escalation (high 8.8, exploited in the wild)
- [CVE-2022-26921](https://insights.sbomify.com/CVE-2022-26921/): Visual Studio Code Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2022-26920](https://insights.sbomify.com/CVE-2022-26920/): Windows Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-2692](https://insights.sbomify.com/CVE-2022-2692/): SourceCodester Wedding Hall Booking System Staff User Profile cross site scripting (low 3.5)
- [CVE-2022-26919](https://insights.sbomify.com/CVE-2022-26919/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2022-26918](https://insights.sbomify.com/CVE-2022-26918/): Windows Fax Compose Form Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26917](https://insights.sbomify.com/CVE-2022-26917/): Windows Fax Compose Form Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26916](https://insights.sbomify.com/CVE-2022-26916/): Windows Fax Compose Form Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26915](https://insights.sbomify.com/CVE-2022-26915/): Windows Secure Channel Denial of Service Vulnerability (high 7.5)
- [CVE-2022-26914](https://insights.sbomify.com/CVE-2022-26914/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-26913](https://insights.sbomify.com/CVE-2022-26913/): Windows Authentication Information Disclosure Vulnerability (high 7.4)
- [CVE-2022-26912](https://insights.sbomify.com/CVE-2022-26912/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-26911](https://insights.sbomify.com/CVE-2022-26911/): Skype for Business Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-26910](https://insights.sbomify.com/CVE-2022-26910/): Skype for Business and Lync Spoofing Vulnerability (medium 5.3)
- [CVE-2022-2691](https://insights.sbomify.com/CVE-2022-2691/): SourceCodester Wedding Hall Booking System Profile Page cross site scripting (low 3.5)
- [CVE-2022-26909](https://insights.sbomify.com/CVE-2022-26909/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-26908](https://insights.sbomify.com/CVE-2022-26908/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-26907](https://insights.sbomify.com/CVE-2022-26907/): Azure SDK for .NET Information Disclosure Vulnerability (medium 5.3)
- [CVE-2022-26905](https://insights.sbomify.com/CVE-2022-26905/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2022-26904](https://insights.sbomify.com/CVE-2022-26904/): Microsoft Windows User Profile Service Privilege Escalation (high 7.0, exploited in the wild)
- [CVE-2022-26903](https://insights.sbomify.com/CVE-2022-26903/): Windows Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26901](https://insights.sbomify.com/CVE-2022-26901/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-26900](https://insights.sbomify.com/CVE-2022-26900/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-2690](https://insights.sbomify.com/CVE-2022-2690/): SourceCodester Wedding Hall Booking System Booking Form cross site scripting (low 3.5)
- [CVE-2022-26899](https://insights.sbomify.com/CVE-2022-26899/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 6.3)
- [CVE-2022-26898](https://insights.sbomify.com/CVE-2022-26898/): Azure Site Recovery Remote Code Execution Vulnerability (high 7.2)
- [CVE-2022-26897](https://insights.sbomify.com/CVE-2022-26897/): Azure Site Recovery Information Disclosure Vulnerability (medium 4.9)
- [CVE-2022-26896](https://insights.sbomify.com/CVE-2022-26896/): Azure Site Recovery Information Disclosure Vulnerability (medium 4.9)
- [CVE-2022-26895](https://insights.sbomify.com/CVE-2022-26895/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-26894](https://insights.sbomify.com/CVE-2022-26894/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-26891](https://insights.sbomify.com/CVE-2022-26891/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-26890](https://insights.sbomify.com/CVE-2022-26890/): Denial of service in BIG-IP Advanced WAF, ASM, and APM (high 7.5)
- [CVE-2022-2689](https://insights.sbomify.com/CVE-2022-2689/): SourceCodester Wedding Hall Booking System Contact Page cross site scripting (low 3.5)
- [CVE-2022-26889](https://insights.sbomify.com/CVE-2022-26889/): Path Traversal in search parameter results in external content injection (high 8.8)
- [CVE-2022-26888](https://insights.sbomify.com/CVE-2022-26888/): Cross-site scripting in Intel(R) Quartus Prime Pro and Standard edition software (low 2.8)
- [CVE-2022-26887](https://insights.sbomify.com/CVE-2022-26887/): Delta Electronics DIAEnergie SQL Injection in DIAE_HandlerTag_KID.ashx (critical 9.8)
- [CVE-2022-26885](https://insights.sbomify.com/CVE-2022-26885/): Apache DolphinScheduler config file read by task risk (high 7.5)
- [CVE-2022-26884](https://insights.sbomify.com/CVE-2022-26884/): Apache DolphinScheduler exposes files without authentication (medium 6.5)
- [CVE-2022-2688](https://insights.sbomify.com/CVE-2022-2688/): SourceCodester Expense Management System POST Parameter report.php fetch_report_credit sql injection (medium 6.3)
- [CVE-2022-26878](https://insights.sbomify.com/CVE-2022-26878/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2022-26877](https://insights.sbomify.com/CVE-2022-26877/): Information disclosure in asana:desktop (medium 6.5)
- [CVE-2022-26874](https://insights.sbomify.com/CVE-2022-26874/): Cross-site scripting in debian:debian linux (medium 5.4)
- [CVE-2022-26873](https://insights.sbomify.com/CVE-2022-26873/): Memory corruption in Aptio (high 8.2)
- [CVE-2022-26872](https://insights.sbomify.com/CVE-2022-26872/): Password reset interception via API (high 8.3)
- [CVE-2022-26871](https://insights.sbomify.com/CVE-2022-26871/): Trend Micro Apex Central Arbitrary File Upload (critical 9.8, exploited in the wild)
- [CVE-2022-26870](https://insights.sbomify.com/CVE-2022-26870/): Auth bypass in PowerStore (high 7.0)
- [CVE-2022-2687](https://insights.sbomify.com/CVE-2022-2687/): SourceCodester Gym Management System sql injection (medium 6.3)
- [CVE-2022-26869](https://insights.sbomify.com/CVE-2022-26869/): Misconfiguration in PowerStore (critical 9.8)
- [CVE-2022-26868](https://insights.sbomify.com/CVE-2022-26868/): Command injection in PowerStore (medium 6.4)
- [CVE-2022-26867](https://insights.sbomify.com/CVE-2022-26867/): Code injection in PowerStore (medium 5.9)
- [CVE-2022-26866](https://insights.sbomify.com/CVE-2022-26866/): Cross-site scripting in PowerStore (medium 5.5)
- [CVE-2022-26865](https://insights.sbomify.com/CVE-2022-26865/): Auth bypass in Dell OS Recovery Tool (medium 6.8)
- [CVE-2022-26864](https://insights.sbomify.com/CVE-2022-26864/): Security feature bypass in CPG BIOS (medium 6.3)
- [CVE-2022-26863](https://insights.sbomify.com/CVE-2022-26863/): Security feature bypass in CPG BIOS (medium 6.3)
- [CVE-2022-26862](https://insights.sbomify.com/CVE-2022-26862/): Security feature bypass in CPG BIOS (medium 6.3)
- [CVE-2022-26861](https://insights.sbomify.com/CVE-2022-26861/): Other in CPG BIOS (high 7.9)
- [CVE-2022-26860](https://insights.sbomify.com/CVE-2022-26860/): Memory corruption in CPG BIOS (high 7.5)
- [CVE-2022-2686](https://insights.sbomify.com/CVE-2022-2686/): oretnom23 Fast Food Ordering System Menu List Page cross site scripting (low 3.5)
- [CVE-2022-26859](https://insights.sbomify.com/CVE-2022-26859/): Race condition in CPG BIOS (medium 6.1)
- [CVE-2022-26858](https://insights.sbomify.com/CVE-2022-26858/): Auth bypass in CPG BIOS (medium 6.1)
- [CVE-2022-26857](https://insights.sbomify.com/CVE-2022-26857/): Missing authorization in OpenManage Enterprise (critical 9.0)
- [CVE-2022-26856](https://insights.sbomify.com/CVE-2022-26856/): Information disclosure in Dell Repository Manager (DRM) (high 8.2)
- [CVE-2022-26855](https://insights.sbomify.com/CVE-2022-26855/): Misconfiguration in PowerScale OneFS (medium 5.5)
- [CVE-2022-26854](https://insights.sbomify.com/CVE-2022-26854/): Weak cryptography in PowerScale OneFS (high 8.1)
- [CVE-2022-26852](https://insights.sbomify.com/CVE-2022-26852/): Weak cryptography in PowerScale OneFS (high 8.1)
- [CVE-2022-26851](https://insights.sbomify.com/CVE-2022-26851/): Weak cryptography in PowerScale OneFS (critical 9.1)
- [CVE-2022-26850](https://insights.sbomify.com/CVE-2022-26850/): Insufficiently protected credentials (medium 4.3)
- [CVE-2022-2685](https://insights.sbomify.com/CVE-2022-2685/): SourceCodester Interview Management System addQuestion.php cross site scripting (low 3.5)
- [CVE-2022-26847](https://insights.sbomify.com/CVE-2022-26847/): Missing authorization in debian:debian linux (medium 5.3)
- [CVE-2022-26846](https://insights.sbomify.com/CVE-2022-26846/): Code injection in debian:debian linux (high 8.8)
- [CVE-2022-26845](https://insights.sbomify.com/CVE-2022-26845/): Auth bypass in Intel(R) AMT (high 8.7)
- [CVE-2022-26844](https://insights.sbomify.com/CVE-2022-26844/): Information disclosure in version (high 7.8)
- [CVE-2022-26843](https://insights.sbomify.com/CVE-2022-26843/): Other in Intel(R) oneAPI DPC++/C++ Compiler (high 8.3)
- [CVE-2022-26842](https://insights.sbomify.com/CVE-2022-26842/): Cross-site scripting in AVideo (critical 9.6)
- [CVE-2022-26841](https://insights.sbomify.com/CVE-2022-26841/): Information disclosure in Intel(R) SGX SDK software for Linux (low 2.5)
- [CVE-2022-26840](https://insights.sbomify.com/CVE-2022-26840/): Privilege escalation in Intel(R) Quartus Prime Pro and Standard edition software (high 7.3)
- [CVE-2022-2684](https://insights.sbomify.com/CVE-2022-2684/): SourceCodester Apartment Visitor Management System manage-apartment.php cross site scripting (low 3.5)
- [CVE-2022-26839](https://insights.sbomify.com/CVE-2022-26839/): Delta Electronics DIAEnergie Incorrect Default Permissions (high 7.8)
- [CVE-2022-26838](https://insights.sbomify.com/CVE-2022-26838/): Path traversal in Cybozu Remote Service (medium 6.5)
- [CVE-2022-26837](https://insights.sbomify.com/CVE-2022-26837/): Privilege escalation in Intel(R) Processors (high 7.5)
- [CVE-2022-26836](https://insights.sbomify.com/CVE-2022-26836/): Delta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashx (critical 9.8)
- [CVE-2022-26835](https://insights.sbomify.com/CVE-2022-26835/): Path traversal in BIG-IP (medium 4.9)
- [CVE-2022-26834](https://insights.sbomify.com/CVE-2022-26834/): Misconfiguration in Rakuten Casa (high 7.5)
- [CVE-2022-26833](https://insights.sbomify.com/CVE-2022-26833/): Auth bypass in OAS Platform (critical 9.4)
- [CVE-2022-26832](https://insights.sbomify.com/CVE-2022-26832/): .NET Framework Denial of Service Vulnerability (high 7.5)
- [CVE-2022-26831](https://insights.sbomify.com/CVE-2022-26831/): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (high 7.5)
- [CVE-2022-26830](https://insights.sbomify.com/CVE-2022-26830/): DiskUsage.exe Remote Code Execution Vulnerability (high 7.5)
- [CVE-2022-2683](https://insights.sbomify.com/CVE-2022-2683/): SourceCodester Simple Food Ordering System login.php cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/353/