# Vulnerabilities published in 2022


- [CVE-2022-25325](https://insights.sbomify.com/CVE-2022-25325/): Use after free in CX-Programmer (high 7.8)
- [CVE-2022-25324](https://insights.sbomify.com/CVE-2022-25324/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25323](https://insights.sbomify.com/CVE-2022-25323/): Cross-site scripting in zerof:web server (medium 6.1)
- [CVE-2022-25322](https://insights.sbomify.com/CVE-2022-25322/): SQL injection in zerof:web server (critical 9.8)
- [CVE-2022-25321](https://insights.sbomify.com/CVE-2022-25321/): Cross-site scripting in cerebrate-project:cerebrate (medium 6.1)
- [CVE-2022-25320](https://insights.sbomify.com/CVE-2022-25320/): Information disclosure in cerebrate-project:cerebrate (medium 5.3)
- [CVE-2022-2532](https://insights.sbomify.com/CVE-2022-2532/): Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-25319](https://insights.sbomify.com/CVE-2022-25319/): Missing authorization in cerebrate-project:cerebrate (medium 5.3)
- [CVE-2022-25318](https://insights.sbomify.com/CVE-2022-25318/): Missing authorization in cerebrate-project:cerebrate (medium 4.3)
- [CVE-2022-25317](https://insights.sbomify.com/CVE-2022-25317/): Cross-site scripting in cerebrate-project:cerebrate (medium 6.1)
- [CVE-2022-25315](https://insights.sbomify.com/CVE-2022-25315/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-25314](https://insights.sbomify.com/CVE-2022-25314/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2022-25313](https://insights.sbomify.com/CVE-2022-25313/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2022-25312](https://insights.sbomify.com/CVE-2022-25312/): An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor (critical 9.1)
- [CVE-2022-25311](https://insights.sbomify.com/CVE-2022-25311/): Privilege escalation in SINEC NMS (high 7.3)
- [CVE-2022-25310](https://insights.sbomify.com/CVE-2022-25310/): Null dereference in fribidi (medium 5.5)
- [CVE-2022-2531](https://insights.sbomify.com/CVE-2022-2531/): Path traversal in GitLab (medium 5.3)
- [CVE-2022-25309](https://insights.sbomify.com/CVE-2022-25309/): Memory corruption in fribidi (medium 5.5)
- [CVE-2022-25308](https://insights.sbomify.com/CVE-2022-25308/): Memory corruption in fribidi (high 7.8)
- [CVE-2022-25307](https://insights.sbomify.com/CVE-2022-25307/): WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform (high 7.2)
- [CVE-2022-25306](https://insights.sbomify.com/CVE-2022-25306/): WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser (high 7.2)
- [CVE-2022-25305](https://insights.sbomify.com/CVE-2022-25305/): WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP (high 7.2)
- [CVE-2022-25304](https://insights.sbomify.com/CVE-2022-25304/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25303](https://insights.sbomify.com/CVE-2022-25303/): Cross-site Scripting (XSS) (medium 5.4)
- [CVE-2022-25302](https://insights.sbomify.com/CVE-2022-25302/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25301](https://insights.sbomify.com/CVE-2022-25301/): Prototype Pollution (high 7.7)
- [CVE-2022-25299](https://insights.sbomify.com/CVE-2022-25299/): Arbitrary File Write (critical 9.8)
- [CVE-2022-25298](https://insights.sbomify.com/CVE-2022-25298/): Path Traversal (high 7.5)
- [CVE-2022-25297](https://insights.sbomify.com/CVE-2022-25297/): Arbitrary File Write (high 7.5)
- [CVE-2022-25296](https://insights.sbomify.com/CVE-2022-25296/): Prototype Pollution (medium 6.3)
- [CVE-2022-25295](https://insights.sbomify.com/CVE-2022-25295/): Open Redirect (medium 5.4)
- [CVE-2022-25294](https://insights.sbomify.com/CVE-2022-25294/): Privilege escalation in proofpoint:insider threat management (high 7.8)
- [CVE-2022-25293](https://insights.sbomify.com/CVE-2022-25293/): Memory corruption in watchguard:fireware (high 8.8)
- [CVE-2022-25292](https://insights.sbomify.com/CVE-2022-25292/): Memory corruption in watchguard:fireware (high 8.8)
- [CVE-2022-25291](https://insights.sbomify.com/CVE-2022-25291/): Integer overflow in watchguard:fireware (high 8.8)
- [CVE-2022-25290](https://insights.sbomify.com/CVE-2022-25290/): Information disclosure in watchguard:fireware (medium 6.5)
- [CVE-2022-2529](https://insights.sbomify.com/CVE-2022-2529/): Multiple DoS Attack Vectors in sflow packet handling (high 7.5)
- [CVE-2022-2528](https://insights.sbomify.com/CVE-2022-2528/): Missing authorization in Octopus Server (medium 6.5)
- [CVE-2022-25278](https://insights.sbomify.com/CVE-2022-25278/): Access bypass in Drupal Core (medium 6.5)
- [CVE-2022-25277](https://insights.sbomify.com/CVE-2022-25277/): Drupal core arbitrary PHP code execution (high 7.2)
- [CVE-2022-25276](https://insights.sbomify.com/CVE-2022-25276/): Lack of domain validation in Druple core (medium 6.1)
- [CVE-2022-25275](https://insights.sbomify.com/CVE-2022-25275/): Drupal core Information Disclosure vulnerability (high 7.5)
- [CVE-2022-25274](https://insights.sbomify.com/CVE-2022-25274/): Access bypass in Drupal core (medium 5.4)
- [CVE-2022-25273](https://insights.sbomify.com/CVE-2022-25273/): Improper input validation in Drupal core (high 7.5)
- [CVE-2022-25271](https://insights.sbomify.com/CVE-2022-25271/): Improper input validation in Drupal core (high 7.5)
- [CVE-2022-25270](https://insights.sbomify.com/CVE-2022-25270/): Incorrect authorization in Drupal core (medium 6.5)
- [CVE-2022-2527](https://insights.sbomify.com/CVE-2022-2527/): Cross-site scripting in GitLab (high 7.3)
- [CVE-2022-25269](https://insights.sbomify.com/CVE-2022-25269/): Cross-site scripting in passwork:passwork (medium 6.1)
- [CVE-2022-25268](https://insights.sbomify.com/CVE-2022-25268/): Cross-site request forgery in passwork:passwork (high 8.8)
- [CVE-2022-25267](https://insights.sbomify.com/CVE-2022-25267/): Path traversal in passwork:passwork (high 8.8)
- [CVE-2022-25266](https://insights.sbomify.com/CVE-2022-25266/): Path traversal in passwork:passwork (medium 4.3)
- [CVE-2022-25265](https://insights.sbomify.com/CVE-2022-25265/): Security feature bypass in linux:linux kernel (high 7.8)
- [CVE-2022-25264](https://insights.sbomify.com/CVE-2022-25264/): Information disclosure in jetbrains:teamcity (high 7.5)
- [CVE-2022-25263](https://insights.sbomify.com/CVE-2022-25263/): Command injection in jetbrains:teamcity (critical 9.8)
- [CVE-2022-25262](https://insights.sbomify.com/CVE-2022-25262/): Auth bypass in jetbrains:hub (critical 9.8)
- [CVE-2022-25261](https://insights.sbomify.com/CVE-2022-25261/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2022-25260](https://insights.sbomify.com/CVE-2022-25260/): Server-side request forgery in jetbrains:hub (critical 9.1)
- [CVE-2022-2526](https://insights.sbomify.com/CVE-2022-2526/): Use after free in systemd-resolved (critical 9.8)
- [CVE-2022-25259](https://insights.sbomify.com/CVE-2022-25259/): Cross-site scripting in jetbrains:hub (medium 6.1)
- [CVE-2022-25258](https://insights.sbomify.com/CVE-2022-25258/): Memory corruption in debian:debian linux (medium 4.6)
- [CVE-2022-25256](https://insights.sbomify.com/CVE-2022-25256/): Cross-site scripting in sas:web report studio (medium 6.1)
- [CVE-2022-25255](https://insights.sbomify.com/CVE-2022-25255/): Code injection in qt:qt (high 7.8)
- [CVE-2022-25252](https://insights.sbomify.com/CVE-2022-25252/): PTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional Conditions (high 7.5)
- [CVE-2022-25251](https://insights.sbomify.com/CVE-2022-25251/): PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function (critical 9.8)
- [CVE-2022-25250](https://insights.sbomify.com/CVE-2022-25250/): PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function (high 7.5)
- [CVE-2022-2525](https://insights.sbomify.com/CVE-2022-2525/): Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web (high 7.3)
- [CVE-2022-25249](https://insights.sbomify.com/CVE-2022-25249/): PTC Axeda agent and Axeda Desktop Server Path Traversal (high 7.5)
- [CVE-2022-25248](https://insights.sbomify.com/CVE-2022-25248/): PTC Axeda agent and Axeda Desktop Server Information Exposure (medium 5.3)
- [CVE-2022-25247](https://insights.sbomify.com/CVE-2022-25247/): PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function (critical 9.8)
- [CVE-2022-25246](https://insights.sbomify.com/CVE-2022-25246/): PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials (critical 9.8)
- [CVE-2022-25245](https://insights.sbomify.com/CVE-2022-25245/): Information disclosure in zohocorp:manageengine servicedesk plus (medium 5.3)
- [CVE-2022-25244](https://insights.sbomify.com/CVE-2022-25244/): Information disclosure in hashicorp:vault (medium 6.5)
- [CVE-2022-25243](https://insights.sbomify.com/CVE-2022-25243/): Security feature bypass in hashicorp:vault (medium 6.5)
- [CVE-2022-25242](https://insights.sbomify.com/CVE-2022-25242/): Cross-site request forgery in filecloud:filecloud (high 8.8)
- [CVE-2022-25241](https://insights.sbomify.com/CVE-2022-25241/): Cross-site request forgery in filecloud:filecloud (high 8.8)
- [CVE-2022-25238](https://insights.sbomify.com/CVE-2022-25238/): Stored XSS via HTML fields in SilverStripe Framework (medium 5.4)
- [CVE-2022-25237](https://insights.sbomify.com/CVE-2022-25237/): Auth bypass in bonitasoft:bonita web (critical 9.8)
- [CVE-2022-25236](https://insights.sbomify.com/CVE-2022-25236/): Other in debian:debian linux (critical 9.8)
- [CVE-2022-25235](https://insights.sbomify.com/CVE-2022-25235/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2022-25234](https://insights.sbomify.com/CVE-2022-25234/): Memory corruption in CX-Programmer (high 7.8)
- [CVE-2022-25231](https://insights.sbomify.com/CVE-2022-25231/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25230](https://insights.sbomify.com/CVE-2022-25230/): Use after free in CX-Programmer (high 7.8)
- [CVE-2022-2523](https://insights.sbomify.com/CVE-2022-2523/): Cross-site Scripting (XSS) - Reflected in beancount/fava (high 8.0)
- [CVE-2022-25229](https://insights.sbomify.com/CVE-2022-25229/): Cross-site scripting in Popcorn Time (medium 5.4)
- [CVE-2022-25228](https://insights.sbomify.com/CVE-2022-25228/): SQL injection in CandidATS (medium 6.5)
- [CVE-2022-25227](https://insights.sbomify.com/CVE-2022-25227/): Misconfiguration in Thinfinity VNC (high 8.8)
- [CVE-2022-25226](https://insights.sbomify.com/CVE-2022-25226/): Auth bypass in ThinVNC (critical 10.0)
- [CVE-2022-25225](https://insights.sbomify.com/CVE-2022-25225/): SQL injection in Network Olympus (high 7.2)
- [CVE-2022-25224](https://insights.sbomify.com/CVE-2022-25224/): Cross-site scripting in Proton (medium 5.4)
- [CVE-2022-25223](https://insights.sbomify.com/CVE-2022-25223/): SQL injection in Money Transfer Management System (medium 4.3)
- [CVE-2022-25222](https://insights.sbomify.com/CVE-2022-25222/): SQL injection in Money Transfer Management System (critical 9.8)
- [CVE-2022-25221](https://insights.sbomify.com/CVE-2022-25221/): Cross-site scripting in Money Transfer Management System (medium 6.1)
- [CVE-2022-25220](https://insights.sbomify.com/CVE-2022-25220/): Cross-site scripting in PeTeReport (medium 4.8)
- [CVE-2022-2522](https://insights.sbomify.com/CVE-2022-2522/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-25219](https://insights.sbomify.com/CVE-2022-25219/): Weak cryptography in Phicomm Routers (high 8.4)
- [CVE-2022-25218](https://insights.sbomify.com/CVE-2022-25218/): Weak cryptography in Phicomm Routers (high 8.1)
- [CVE-2022-25217](https://insights.sbomify.com/CVE-2022-25217/): Hardcoded credentials in Phicomm Routers (high 7.8)
- [CVE-2022-25216](https://insights.sbomify.com/CVE-2022-25216/): Path traversal in DVDFab 12 Player / PlayerFab (high 7.5)
- [CVE-2022-25215](https://insights.sbomify.com/CVE-2022-25215/): Missing authorization in Phicomm Routers (medium 5.3)
- [CVE-2022-25214](https://insights.sbomify.com/CVE-2022-25214/): Missing authorization in Phicomm Routers (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/366/