# Vulnerabilities published in 2022


- [CVE-2022-25803](https://insights.sbomify.com/CVE-2022-25803/): Open redirect in bestpractical:request tracker (medium 6.1)
- [CVE-2022-25802](https://insights.sbomify.com/CVE-2022-25802/): Cross-site scripting in bestpractical:request tracker (medium 6.1)
- [CVE-2022-25801](https://insights.sbomify.com/CVE-2022-25801/): Server-side request forgery in bestpractical:request tracker for incident response (critical 9.1)
- [CVE-2022-25800](https://insights.sbomify.com/CVE-2022-25800/): Server-side request forgery in bestpractical:request tracker for incident response (critical 9.1)
- [CVE-2022-2580](https://insights.sbomify.com/CVE-2022-2580/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2022-25799](https://insights.sbomify.com/CVE-2022-25799/): An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0 (medium 6.1)
- [CVE-2022-25797](https://insights.sbomify.com/CVE-2022-25797/): Memory corruption in Autodesk Trueview (high 7.8)
- [CVE-2022-25796](https://insights.sbomify.com/CVE-2022-25796/): Memory corruption in Autodesk Navisworks (high 7.8)
- [CVE-2022-25795](https://insights.sbomify.com/CVE-2022-25795/): Memory corruption in Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac (high 7.8)
- [CVE-2022-25794](https://insights.sbomify.com/CVE-2022-25794/): Memory corruption in Autodesk FBX Review (high 7.8)
- [CVE-2022-25793](https://insights.sbomify.com/CVE-2022-25793/): Memory corruption in Autodesk 3ds Max (high 7.8)
- [CVE-2022-25792](https://insights.sbomify.com/CVE-2022-25792/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-25791](https://insights.sbomify.com/CVE-2022-25791/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-25790](https://insights.sbomify.com/CVE-2022-25790/): Memory corruption in Autodesk Navisworks, Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-2579](https://insights.sbomify.com/CVE-2022-2579/): SourceCodester Garage Management System createUser.php cross site scripting (low 3.5)
- [CVE-2022-25789](https://insights.sbomify.com/CVE-2022-25789/): Use after free in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-25788](https://insights.sbomify.com/CVE-2022-25788/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-25787](https://insights.sbomify.com/CVE-2022-25787/): GTA URLs issued by LMM WEB API may leak information (high 7.5)
- [CVE-2022-25786](https://insights.sbomify.com/CVE-2022-25786/): GateManager debug interface is included in production builds (medium 4.9)
- [CVE-2022-25785](https://insights.sbomify.com/CVE-2022-25785/): Buffer overrun (medium 6.6)
- [CVE-2022-25784](https://insights.sbomify.com/CVE-2022-25784/): User controllable HTML element attribute (potential XSS) (critical 9.1)
- [CVE-2022-25783](https://insights.sbomify.com/CVE-2022-25783/): Hacking attempts from logged-in users are not properly logged by GM (medium 4.3)
- [CVE-2022-25782](https://insights.sbomify.com/CVE-2022-25782/): Insufficient privilege checks on object access and updates. (medium 5.4)
- [CVE-2022-25781](https://insights.sbomify.com/CVE-2022-25781/): Reflected XSS issues in GateManager (medium 4.2)
- [CVE-2022-25780](https://insights.sbomify.com/CVE-2022-25780/): Information leak via device availability query function (medium 4.3)
- [CVE-2022-2578](https://insights.sbomify.com/CVE-2022-2578/): SourceCodester Garage Management System createUser.php access control (medium 6.3)
- [CVE-2022-25779](https://insights.sbomify.com/CVE-2022-25779/): Insufficient scope checks allows adding unrelated audit log entries (medium 4.3)
- [CVE-2022-25778](https://insights.sbomify.com/CVE-2022-25778/): Unload handlers may unintentionally defeat CSRF guards (medium 4.2)
- [CVE-2022-25777](https://insights.sbomify.com/CVE-2022-25777/): Server-Side Request Forgery in Asset section (medium 6.5)
- [CVE-2022-25776](https://insights.sbomify.com/CVE-2022-25776/): Sensitive Data Exposure due to inadequate user permission settings (high 8.3)
- [CVE-2022-25775](https://insights.sbomify.com/CVE-2022-25775/): SQL Injection in dynamic Reports (medium 6.6)
- [CVE-2022-25774](https://insights.sbomify.com/CVE-2022-25774/): XSS in Notifications via saving Dashboards (medium 4.8)
- [CVE-2022-25773](https://insights.sbomify.com/CVE-2022-25773/): Relative Path Traversal in assets file upload (medium 4.3)
- [CVE-2022-25772](https://insights.sbomify.com/CVE-2022-25772/): Cross-site Scripting vulnerability in Mautic's tracking pixel functionality (critical 9.6)
- [CVE-2022-25770](https://insights.sbomify.com/CVE-2022-25770/): Insufficient authentication in upgrade flow (high 7.8)
- [CVE-2022-2577](https://insights.sbomify.com/CVE-2022-2577/): SourceCodester Garage Management System edituser.php sql injection (medium 6.3)
- [CVE-2022-25769](https://insights.sbomify.com/CVE-2022-25769/): Improper regex in htaccess file (high 7.2)
- [CVE-2022-25768](https://insights.sbomify.com/CVE-2022-25768/): Improper Access Control in UI upgrade process (high 7.0)
- [CVE-2022-25767](https://insights.sbomify.com/CVE-2022-25767/): Remote Code Execution (critical 9.8)
- [CVE-2022-25766](https://insights.sbomify.com/CVE-2022-25766/): Remote Code Execution (RCE) (high 8.8)
- [CVE-2022-25765](https://insights.sbomify.com/CVE-2022-25765/): Command Injection (high 7.3)
- [CVE-2022-25763](https://insights.sbomify.com/CVE-2022-25763/): Improper input validation on HTTP/2 headers (medium 6.8)
- [CVE-2022-25762](https://insights.sbomify.com/CVE-2022-25762/): Response mix-up with WebSocket concurrent send and close (high 8.6)
- [CVE-2022-25761](https://insights.sbomify.com/CVE-2022-25761/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25760](https://insights.sbomify.com/CVE-2022-25760/): Arbitrary Code Injection (high 7.1)
- [CVE-2022-2576](https://insights.sbomify.com/CVE-2022-2576/): Eclipse Californium denial of service (DoS) via Datagram Transport Layer Security (DTLS) handshake on parameter mismatch (high 7.5)
- [CVE-2022-25759](https://insights.sbomify.com/CVE-2022-25759/): Remote Code Injection (critical 9.9)
- [CVE-2022-25758](https://insights.sbomify.com/CVE-2022-25758/): Regular Expression Denial of Service (ReDoS) (medium 5.3)
- [CVE-2022-25757](https://insights.sbomify.com/CVE-2022-25757/): Apache APISIX: the body_schema check in request-validation plugin can be bypassed (critical 9.8)
- [CVE-2022-25756](https://insights.sbomify.com/CVE-2022-25756/): Cross-site scripting in SCALANCE X302-7 EEC (230V) (medium 6.1)
- [CVE-2022-25755](https://insights.sbomify.com/CVE-2022-25755/): Other in SCALANCE X302-7 EEC (230V) (high 7.5)
- [CVE-2022-25754](https://insights.sbomify.com/CVE-2022-25754/): Cross-site request forgery in SCALANCE X302-7 EEC (230V) (high 8.8)
- [CVE-2022-25753](https://insights.sbomify.com/CVE-2022-25753/): Memory corruption in SCALANCE X302-7 EEC (230V) (high 8.8)
- [CVE-2022-25752](https://insights.sbomify.com/CVE-2022-25752/): Weak cryptography in SCALANCE X302-7 EEC (230V) (critical 9.8)
- [CVE-2022-25751](https://insights.sbomify.com/CVE-2022-25751/): Other in SCALANCE X302-7 EEC (230V) (high 7.5)
- [CVE-2022-25750](https://insights.sbomify.com/CVE-2022-25750/): Memory corruption in Snapdragon Mobile (high 8.4)
- [CVE-2022-2575](https://insights.sbomify.com/CVE-2022-2575/): WBW Currency Switcher for WooCommerce < 1.6.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-25749](https://insights.sbomify.com/CVE-2022-25749/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.5)
- [CVE-2022-25748](https://insights.sbomify.com/CVE-2022-25748/): Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2022-25747](https://insights.sbomify.com/CVE-2022-25747/): Buffer Over-read in MODEM (high 8.2)
- [CVE-2022-25746](https://insights.sbomify.com/CVE-2022-25746/): Buffer Copy Without Checking Size of Input in Kernel (high 8.1)
- [CVE-2022-25745](https://insights.sbomify.com/CVE-2022-25745/): Always Incorrect Control Flow Implementation in MODEM (critical 9.8)
- [CVE-2022-25743](https://insights.sbomify.com/CVE-2022-25743/): Use after free in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 8.4)
- [CVE-2022-25742](https://insights.sbomify.com/CVE-2022-25742/): Denial of service in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music (high 7.5)
- [CVE-2022-25741](https://insights.sbomify.com/CVE-2022-25741/): Null dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.5)
- [CVE-2022-25740](https://insights.sbomify.com/CVE-2022-25740/): Buffer Copy Without Checking Size of Input in MODEM (critical 9.8)
- [CVE-2022-2574](https://insights.sbomify.com/CVE-2022-2574/): Meks Easy Social Share < 1.2.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-25739](https://insights.sbomify.com/CVE-2022-25739/): Null Point Dereference in MODEM (high 7.5)
- [CVE-2022-25738](https://insights.sbomify.com/CVE-2022-25738/): Buffer Over-read in MODEM (high 8.2)
- [CVE-2022-25737](https://insights.sbomify.com/CVE-2022-25737/): Use of Uninitialized Variable in MODEM (high 7.5)
- [CVE-2022-25736](https://insights.sbomify.com/CVE-2022-25736/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.5)
- [CVE-2022-25735](https://insights.sbomify.com/CVE-2022-25735/): Null Pointer Dereference in MODEM (high 7.5)
- [CVE-2022-25734](https://insights.sbomify.com/CVE-2022-25734/): Loop with Unreachable Exit Condition in MODEM (high 7.5)
- [CVE-2022-25733](https://insights.sbomify.com/CVE-2022-25733/): Null Pointer Dereference in MODEM (high 7.5)
- [CVE-2022-25732](https://insights.sbomify.com/CVE-2022-25732/): Buffer Over-read in MODEM (high 8.2)
- [CVE-2022-25731](https://insights.sbomify.com/CVE-2022-25731/): Incorrect Calculation of Buffer Size in MODEM (high 7.5)
- [CVE-2022-25730](https://insights.sbomify.com/CVE-2022-25730/): Buffer Over-read in MODEM (high 8.2)
- [CVE-2022-25729](https://insights.sbomify.com/CVE-2022-25729/): Improper Input Validation in MODEM (critical 9.8)
- [CVE-2022-25728](https://insights.sbomify.com/CVE-2022-25728/): Buffer Over-read in MODEM (high 8.2)
- [CVE-2022-25727](https://insights.sbomify.com/CVE-2022-25727/): Memory corruption in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music (critical 9.8)
- [CVE-2022-25726](https://insights.sbomify.com/CVE-2022-25726/): Buffer Over-read in MODEM (high 8.2)
- [CVE-2022-25725](https://insights.sbomify.com/CVE-2022-25725/): Use-after-Free in MODEM (medium 6.2)
- [CVE-2022-25724](https://insights.sbomify.com/CVE-2022-25724/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 8.4)
- [CVE-2022-25723](https://insights.sbomify.com/CVE-2022-25723/): Use after free in Snapdragon Mobile (high 8.4)
- [CVE-2022-25722](https://insights.sbomify.com/CVE-2022-25722/): Information Exposure in DSP Services (medium 6.0)
- [CVE-2022-25721](https://insights.sbomify.com/CVE-2022-25721/): Incorrect Type Conversion in Video driver (medium 6.7)
- [CVE-2022-25720](https://insights.sbomify.com/CVE-2022-25720/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2022-2572](https://insights.sbomify.com/CVE-2022-2572/): Auth bypass in Octopus Server (critical 9.8)
- [CVE-2022-25719](https://insights.sbomify.com/CVE-2022-25719/): Information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 8.2)
- [CVE-2022-25718](https://insights.sbomify.com/CVE-2022-25718/): Weak cryptography in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.1)
- [CVE-2022-25717](https://insights.sbomify.com/CVE-2022-25717/): Use-After-Free Issue in Display (medium 6.7)
- [CVE-2022-25716](https://insights.sbomify.com/CVE-2022-25716/): Time-of-check Time-of-use Race Condition in Multimedia Framework (medium 6.7)
- [CVE-2022-25715](https://insights.sbomify.com/CVE-2022-25715/): Incorrect type casting in Display driver (medium 6.7)
- [CVE-2022-25713](https://insights.sbomify.com/CVE-2022-25713/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive (high 7.8)
- [CVE-2022-25712](https://insights.sbomify.com/CVE-2022-25712/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables (medium 6.7)
- [CVE-2022-25711](https://insights.sbomify.com/CVE-2022-25711/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (medium 6.7)
- [CVE-2022-25710](https://insights.sbomify.com/CVE-2022-25710/): Null dereference in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (high 7.5)
- [CVE-2022-2571](https://insights.sbomify.com/CVE-2022-2571/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-25709](https://insights.sbomify.com/CVE-2022-25709/): Use of Out-of-range Pointer Offset in Data Modem (high 8.4)
- [CVE-2022-25708](https://insights.sbomify.com/CVE-2022-25708/): Memory corruption in Snapdragon Connectivity, Snapdragon Mobile (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/362/