# Vulnerabilities published in 2022


- [CVE-2022-2591](https://insights.sbomify.com/CVE-2022-2591/): TEM FLEX-1085 reboot denial of service (high 7.5)
- [CVE-2022-25908](https://insights.sbomify.com/CVE-2022-25908/): Command Injection in create-choo-electron (high 7.4)
- [CVE-2022-25907](https://insights.sbomify.com/CVE-2022-25907/): Prototype Pollution (high 7.5)
- [CVE-2022-25906](https://insights.sbomify.com/CVE-2022-25906/): is-http2 vulnerable to Improper Input Validation (high 7.4)
- [CVE-2022-25905](https://insights.sbomify.com/CVE-2022-25905/): Privilege escalation in Intel(R) oneAPI Data Analytics Library (oneDAL) for Intel(R) oneAPI Base Toolkit (medium 6.7)
- [CVE-2022-25904](https://insights.sbomify.com/CVE-2022-25904/): Prototype Pollution (high 7.5)
- [CVE-2022-25903](https://insights.sbomify.com/CVE-2022-25903/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25901](https://insights.sbomify.com/CVE-2022-25901/): cookiejar Regular Expression Denial of Service via Cookie.parse function (medium 5.3)
- [CVE-2022-25900](https://insights.sbomify.com/CVE-2022-25900/): Command Injection (high 8.1)
- [CVE-2022-2590](https://insights.sbomify.com/CVE-2022-2590/): Race condition in Linux kernel (high 7.0)
- [CVE-2022-25899](https://insights.sbomify.com/CVE-2022-25899/): Auth bypass in Intel(R) (critical 9.8)
- [CVE-2022-25898](https://insights.sbomify.com/CVE-2022-25898/): Improper Verification of Cryptographic Signature (high 7.7)
- [CVE-2022-25897](https://insights.sbomify.com/CVE-2022-25897/): Denial of Service (DoS) (medium 5.9)
- [CVE-2022-25896](https://insights.sbomify.com/CVE-2022-25896/): Session Fixation (medium 4.8)
- [CVE-2022-25895](https://insights.sbomify.com/CVE-2022-25895/): Directory Traversal (high 7.5)
- [CVE-2022-25894](https://insights.sbomify.com/CVE-2022-25894/): Remote Code Execution in com.bstek.uflo:uflo-core (critical 9.8)
- [CVE-2022-25893](https://insights.sbomify.com/CVE-2022-25893/): Arbitrary Code Execution (critical 9.8)
- [CVE-2022-25892](https://insights.sbomify.com/CVE-2022-25892/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25891](https://insights.sbomify.com/CVE-2022-25891/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25890](https://insights.sbomify.com/CVE-2022-25890/): wifey vulnerable to Command Injection due to improper input sanitization (high 7.4)
- [CVE-2022-2589](https://insights.sbomify.com/CVE-2022-2589/): Cross-site Scripting (XSS) - Reflected in beancount/fava (medium 6.9)
- [CVE-2022-25888](https://insights.sbomify.com/CVE-2022-25888/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25887](https://insights.sbomify.com/CVE-2022-25887/): Regular Expression Denial of Service (ReDoS) (medium 5.3)
- [CVE-2022-25885](https://insights.sbomify.com/CVE-2022-25885/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25883](https://insights.sbomify.com/CVE-2022-25883/): semver vulnerable to Regular Expression Denial of Service (medium 5.3)
- [CVE-2022-25882](https://insights.sbomify.com/CVE-2022-25882/): Directory Traversal in onnx (high 7.5)
- [CVE-2022-25881](https://insights.sbomify.com/CVE-2022-25881/): http-cache-semantics vulnerable to Regular Expression Denial of Service (medium 5.3)
- [CVE-2022-25880](https://insights.sbomify.com/CVE-2022-25880/): Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashx (critical 9.8)
- [CVE-2022-2588](https://insights.sbomify.com/CVE-2022-2588/): Use after free in linux (medium 5.3)
- [CVE-2022-25878](https://insights.sbomify.com/CVE-2022-25878/): Prototype Pollution (high 8.2)
- [CVE-2022-25876](https://insights.sbomify.com/CVE-2022-25876/): Server-side Request Forgery (SSRF) (medium 6.2)
- [CVE-2022-25875](https://insights.sbomify.com/CVE-2022-25875/): Cross-site Scripting (XSS) (medium 5.4)
- [CVE-2022-25873](https://insights.sbomify.com/CVE-2022-25873/): Cross-site Scripting (XSS) (medium 4.6)
- [CVE-2022-25872](https://insights.sbomify.com/CVE-2022-25872/): Out-of-bounds Read (medium 5.3)
- [CVE-2022-25871](https://insights.sbomify.com/CVE-2022-25871/): Prototype Pollution (medium 5.9)
- [CVE-2022-2587](https://insights.sbomify.com/CVE-2022-2587/): Memory corruption in Chrome (critical 9.8)
- [CVE-2022-25869](https://insights.sbomify.com/CVE-2022-25869/): Angular (deprecated package) Cross-site Scripting (medium 4.2)
- [CVE-2022-25867](https://insights.sbomify.com/CVE-2022-25867/): NULL Pointer Dereference (high 7.5)
- [CVE-2022-25866](https://insights.sbomify.com/CVE-2022-25866/): Command Injection (high 8.1)
- [CVE-2022-25865](https://insights.sbomify.com/CVE-2022-25865/): Command Injection (high 8.1)
- [CVE-2022-25864](https://insights.sbomify.com/CVE-2022-25864/): Privilege escalation in Intel(R) oneMKL software (medium 6.7)
- [CVE-2022-25863](https://insights.sbomify.com/CVE-2022-25863/): Deserialization of Untrusted Data (high 8.1)
- [CVE-2022-25862](https://insights.sbomify.com/CVE-2022-25862/): Prototype Pollution (medium 4.0)
- [CVE-2022-25860](https://insights.sbomify.com/CVE-2022-25860/): Remote code execution in simple-git (high 8.1)
- [CVE-2022-2586](https://insights.sbomify.com/CVE-2022-2586/): Linux Kernel Use-After-Free (medium 5.3, exploited in the wild)
- [CVE-2022-25858](https://insights.sbomify.com/CVE-2022-25858/): Regular Expression Denial of Service (ReDoS) (medium 5.3)
- [CVE-2022-25857](https://insights.sbomify.com/CVE-2022-25857/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25856](https://insights.sbomify.com/CVE-2022-25856/): Directory Traversal (high 7.5)
- [CVE-2022-25855](https://insights.sbomify.com/CVE-2022-25855/): create-choo-app3 is vulnerable to Command Injection via the devInstall function (high 7.4)
- [CVE-2022-25854](https://insights.sbomify.com/CVE-2022-25854/): Cross-site Scripting (XSS) (medium 5.4)
- [CVE-2022-25853](https://insights.sbomify.com/CVE-2022-25853/): semver-tags is vulnerable to Command Injection via the getGitTagsRemote function (high 7.4)
- [CVE-2022-25852](https://insights.sbomify.com/CVE-2022-25852/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25851](https://insights.sbomify.com/CVE-2022-25851/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25850](https://insights.sbomify.com/CVE-2022-25850/): Server-side Request Forgery (SSRF) (high 7.5)
- [CVE-2022-2585](https://insights.sbomify.com/CVE-2022-2585/): Use after free in linux (medium 5.3)
- [CVE-2022-25849](https://insights.sbomify.com/CVE-2022-25849/): Cross-site Scripting (XSS) (medium 5.4)
- [CVE-2022-25848](https://insights.sbomify.com/CVE-2022-25848/): Directory Traversal (high 7.5)
- [CVE-2022-25847](https://insights.sbomify.com/CVE-2022-25847/): Cross-site Scripting (XSS) in serve-lite (medium 5.4)
- [CVE-2022-25845](https://insights.sbomify.com/CVE-2022-25845/): Deserialization of Untrusted Data (high 8.1)
- [CVE-2022-25844](https://insights.sbomify.com/CVE-2022-25844/): Regular Expression Denial of Service (ReDoS) (medium 5.3)
- [CVE-2022-25842](https://insights.sbomify.com/CVE-2022-25842/): Arbitrary File Write via Archive Extraction (Zip Slip) (medium 6.9)
- [CVE-2022-25841](https://insights.sbomify.com/CVE-2022-25841/): Privilege escalation in version (high 7.8)
- [CVE-2022-2584](https://insights.sbomify.com/CVE-2022-2584/): Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb (high 7.5)
- [CVE-2022-25839](https://insights.sbomify.com/CVE-2022-25839/): Improper Input Validation (medium 4.3)
- [CVE-2022-25838](https://insights.sbomify.com/CVE-2022-25838/): Multi-Factor Authentication issue in Laravel Fortify (high 8.1)
- [CVE-2022-25837](https://insights.sbomify.com/CVE-2022-25837/): Auth bypass in bluetooth:bluetooth core specification (high 7.5)
- [CVE-2022-25836](https://insights.sbomify.com/CVE-2022-25836/): Auth bypass in bluetooth:bluetooth core specification (high 7.5)
- [CVE-2022-25834](https://insights.sbomify.com/CVE-2022-25834/): Command injection in percona:xtrabackup (high 7.8)
- [CVE-2022-25833](https://insights.sbomify.com/CVE-2022-25833/): Auth bypass in Samsung Mobile Devices (low 3.3)
- [CVE-2022-25832](https://insights.sbomify.com/CVE-2022-25832/): Auth bypass in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-25831](https://insights.sbomify.com/CVE-2022-25831/): Missing authorization in Samsung Mobile Devices (low 2.0)
- [CVE-2022-25830](https://insights.sbomify.com/CVE-2022-25830/): Information disclosure in Galaxy Watch3 Plugin (low 1.9)
- [CVE-2022-2583](https://insights.sbomify.com/CVE-2022-2583/): Race condition in github.com/ntbosscher/gobase (low 3.7)
- [CVE-2022-25829](https://insights.sbomify.com/CVE-2022-25829/): Information disclosure in Watch Active2 PlugIn (low 1.9)
- [CVE-2022-25828](https://insights.sbomify.com/CVE-2022-25828/): Information disclosure in Watch Active PlugIn (low 1.9)
- [CVE-2022-25827](https://insights.sbomify.com/CVE-2022-25827/): Information disclosure in Galaxy Watch PlugIn (low 1.9)
- [CVE-2022-25826](https://insights.sbomify.com/CVE-2022-25826/): Information disclosure in Galaxy S3 PlugIn (low 1.9)
- [CVE-2022-25825](https://insights.sbomify.com/CVE-2022-25825/): Auth bypass in Samsung Account (medium 6.2)
- [CVE-2022-25824](https://insights.sbomify.com/CVE-2022-25824/): Missing authorization in BixbyTouch (medium 4.0)
- [CVE-2022-25823](https://insights.sbomify.com/CVE-2022-25823/): Information disclosure in Galaxy Watch Plugin (low 1.9)
- [CVE-2022-25822](https://insights.sbomify.com/CVE-2022-25822/): Use after free in Samsung Mobile devices (medium 4.0)
- [CVE-2022-25821](https://insights.sbomify.com/CVE-2022-25821/): Memory corruption in Samsung Mobile Devices (low 3.3)
- [CVE-2022-25820](https://insights.sbomify.com/CVE-2022-25820/): Auth bypass in Samsung Mobile Devices (medium 4.2)
- [CVE-2022-2582](https://insights.sbomify.com/CVE-2022-2582/): Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go (medium 4.3)
- [CVE-2022-25819](https://insights.sbomify.com/CVE-2022-25819/): Memory corruption in Samsung Mobile Devices with Exynos chipsets (medium 5.3)
- [CVE-2022-25818](https://insights.sbomify.com/CVE-2022-25818/): Memory corruption in Samsung Mobile Devices (medium 6.5)
- [CVE-2022-25817](https://insights.sbomify.com/CVE-2022-25817/): Auth bypass in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-25816](https://insights.sbomify.com/CVE-2022-25816/): Auth bypass in Samsung Mobile Devices (medium 4.1)
- [CVE-2022-25815](https://insights.sbomify.com/CVE-2022-25815/): Privilege escalation in Samsung Mobile Devices (medium 5.5)
- [CVE-2022-25814](https://insights.sbomify.com/CVE-2022-25814/): Privilege escalation in Samsung Mobile Devices (medium 5.5)
- [CVE-2022-25813](https://insights.sbomify.com/CVE-2022-25813/): Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz (high 7.5)
- [CVE-2022-25812](https://insights.sbomify.com/CVE-2022-25812/): Transposh WordPress Translation < 1.0.8 - Admin+ RCE (high 7.2)
- [CVE-2022-25811](https://insights.sbomify.com/CVE-2022-25811/): Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-25810](https://insights.sbomify.com/CVE-2022-25810/): Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls (medium 6.5)
- [CVE-2022-2581](https://insights.sbomify.com/CVE-2022-2581/): Out-of-bounds Read in vim/vim (high 7.8)
- [CVE-2022-25809](https://insights.sbomify.com/CVE-2022-25809/): Other in amazon:echo dot firmware (critical 9.8)
- [CVE-2022-25807](https://insights.sbomify.com/CVE-2022-25807/): Hardcoded credentials in igel:universal management suite (medium 5.5)
- [CVE-2022-25806](https://insights.sbomify.com/CVE-2022-25806/): Hardcoded credentials in igel:universal management suite (high 8.8)
- [CVE-2022-25805](https://insights.sbomify.com/CVE-2022-25805/): Information disclosure in igel:universal management suite (medium 6.5)
- [CVE-2022-25804](https://insights.sbomify.com/CVE-2022-25804/): Misconfiguration in igel:universal management suite (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/361/