# Vulnerabilities published in 2022


- [CVE-2022-25095](https://insights.sbomify.com/CVE-2022-25095/): Auth bypass in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-25094](https://insights.sbomify.com/CVE-2022-25094/): Code injection in home owners collection management system project:home owners collection management system (high 8.8)
- [CVE-2022-25091](https://insights.sbomify.com/CVE-2022-25091/): Missing authorization in infopop:ultimate bulletin board (medium 5.3)
- [CVE-2022-25090](https://insights.sbomify.com/CVE-2022-25090/): Race condition in kofax:printix (high 8.1)
- [CVE-2022-2509](https://insights.sbomify.com/CVE-2022-2509/): Memory corruption in GnuTLS (high 7.5)
- [CVE-2022-25089](https://insights.sbomify.com/CVE-2022-25089/): Privilege escalation in kofax:printix (critical 9.8)
- [CVE-2022-25084](https://insights.sbomify.com/CVE-2022-25084/): Command injection in totolink:t6 firmware (critical 9.8)
- [CVE-2022-25083](https://insights.sbomify.com/CVE-2022-25083/): Command injection in totolink:a860r firmware (critical 9.8)
- [CVE-2022-25082](https://insights.sbomify.com/CVE-2022-25082/): Command injection in totolink:a950rg firmware (critical 9.8)
- [CVE-2022-25081](https://insights.sbomify.com/CVE-2022-25081/): Command injection in totolink:t10 v2 firmware (critical 9.8)
- [CVE-2022-25080](https://insights.sbomify.com/CVE-2022-25080/): Command injection in totolink:a830r firmware (critical 9.8)
- [CVE-2022-2508](https://insights.sbomify.com/CVE-2022-2508/): Information disclosure in Octopus Server (medium 5.3)
- [CVE-2022-25079](https://insights.sbomify.com/CVE-2022-25079/): Command injection in totolink:a810r firmware (critical 9.8)
- [CVE-2022-25078](https://insights.sbomify.com/CVE-2022-25078/): Command injection in totolink:a3600r firmware (critical 9.8)
- [CVE-2022-25077](https://insights.sbomify.com/CVE-2022-25077/): Command injection in totolink:a3100r firmware (critical 9.8)
- [CVE-2022-25076](https://insights.sbomify.com/CVE-2022-25076/): Command injection in totolink:a800r firmware (critical 9.8)
- [CVE-2022-25075](https://insights.sbomify.com/CVE-2022-25075/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-25074](https://insights.sbomify.com/CVE-2022-25074/): Memory corruption in tp-link:tl-wr902ac firmware (critical 9.8)
- [CVE-2022-25073](https://insights.sbomify.com/CVE-2022-25073/): Memory corruption in tp-link:tl-wr841n firmware (critical 9.8)
- [CVE-2022-25072](https://insights.sbomify.com/CVE-2022-25072/): Memory corruption in tp-link:archer a54 firmware (critical 9.8)
- [CVE-2022-2507](https://insights.sbomify.com/CVE-2022-2507/): Cross-site scripting in Octopus Server (medium 5.3)
- [CVE-2022-25069](https://insights.sbomify.com/CVE-2022-25069/): Cross-site scripting in marktext:marktext (critical 9.6)
- [CVE-2022-25064](https://insights.sbomify.com/CVE-2022-25064/): Command injection in tp-link:tl-wr840n firmware (critical 9.8)
- [CVE-2022-25062](https://insights.sbomify.com/CVE-2022-25062/): Integer overflow in tp-link:tl-wr840n firmware (high 7.5)
- [CVE-2022-25061](https://insights.sbomify.com/CVE-2022-25061/): Command injection in tp-link:tl-wr840n firmware (critical 9.8)
- [CVE-2022-25060](https://insights.sbomify.com/CVE-2022-25060/): Command injection in tp-link:tl-wr840n firmware (critical 9.8)
- [CVE-2022-25051](https://insights.sbomify.com/CVE-2022-25051/): Memory corruption in rtl 433 project:rtl 433 (medium 5.5)
- [CVE-2022-25050](https://insights.sbomify.com/CVE-2022-25050/): Memory corruption in rtl 433 project:rlt 433 (medium 5.5)
- [CVE-2022-2505](https://insights.sbomify.com/CVE-2022-2505/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-25048](https://insights.sbomify.com/CVE-2022-25048/): Command injection in control-webpanel:webpanel (high 8.8)
- [CVE-2022-25047](https://insights.sbomify.com/CVE-2022-25047/): Weak cryptography in control-webpanel:webpanel (medium 5.9)
- [CVE-2022-25046](https://insights.sbomify.com/CVE-2022-25046/): Path traversal in control-webpanel:webpanel (critical 9.8)
- [CVE-2022-25045](https://insights.sbomify.com/CVE-2022-25045/): Hardcoded credentials in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-25044](https://insights.sbomify.com/CVE-2022-25044/): Memory corruption in espruino:espruino (high 7.8)
- [CVE-2022-25041](https://insights.sbomify.com/CVE-2022-25041/): Missing authorization in open-emr:openemr (medium 4.3)
- [CVE-2022-2504](https://insights.sbomify.com/CVE-2022-2504/): SQLi in SDD-Baro (critical 9.8)
- [CVE-2022-25038](https://insights.sbomify.com/CVE-2022-25038/): wanEditor v4.7.11 was discovered to contain a cross-site scripting (XSS) vulnerability via the video upload function. (medium 6.1)
- [CVE-2022-25037](https://insights.sbomify.com/CVE-2022-25037/): wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function (medium 5.4)
- [CVE-2022-25031](https://insights.sbomify.com/CVE-2022-25031/): Privilege escalation in rdpsoft:remote desktop commander suite agent (high 7.8)
- [CVE-2022-2503](https://insights.sbomify.com/CVE-2022-2503/): Linux Kernel LoadPin bypass via dm-verity table reload (medium 6.9)
- [CVE-2022-25028](https://insights.sbomify.com/CVE-2022-25028/): Cross-site scripting in home owners collection management system project:home owners collection management system (medium 6.1)
- [CVE-2022-25027](https://insights.sbomify.com/CVE-2022-25027/): Auth bypass in rocketsoftware:trufusion enterprise (high 7.5)
- [CVE-2022-25026](https://insights.sbomify.com/CVE-2022-25026/): Server-side request forgery in rocketsoftware:trufusion enterprise (high 7.5)
- [CVE-2022-25024](https://insights.sbomify.com/CVE-2022-25024/): json2xml Uncaught Exception vulnerability (high 7.5)
- [CVE-2022-25023](https://insights.sbomify.com/CVE-2022-25023/): Memory corruption in audio file project:audio file (high 8.8)
- [CVE-2022-25022](https://insights.sbomify.com/CVE-2022-25022/): Cross-site scripting in htmly:htmly (medium 5.4)
- [CVE-2022-25020](https://insights.sbomify.com/CVE-2022-25020/): Cross-site scripting in pluxml:pluxml (medium 5.4)
- [CVE-2022-2502](https://insights.sbomify.com/CVE-2022-2502/): Memory corruption in RTU500 series (high 7.5)
- [CVE-2022-25018](https://insights.sbomify.com/CVE-2022-25018/): Code injection in pluxml:pluxml (high 8.8)
- [CVE-2022-25017](https://insights.sbomify.com/CVE-2022-25017/): Command injection in hitrontech:chita firmware (critical 9.1)
- [CVE-2022-25016](https://insights.sbomify.com/CVE-2022-25016/): File upload in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-25015](https://insights.sbomify.com/CVE-2022-25015/): Cross-site scripting in icehrm:icehrm (medium 5.4)
- [CVE-2022-25014](https://insights.sbomify.com/CVE-2022-25014/): Cross-site scripting in icehrm:icehrm (medium 6.1)
- [CVE-2022-25013](https://insights.sbomify.com/CVE-2022-25013/): Cross-site scripting in icehrm:icehrm (medium 6.1)
- [CVE-2022-25012](https://insights.sbomify.com/CVE-2022-25012/): Weak cryptography in argussurveillance:dvr (medium 5.5)
- [CVE-2022-25010](https://insights.sbomify.com/CVE-2022-25010/): Misconfiguration in stepmania:stepmania (critical 9.1)
- [CVE-2022-2501](https://insights.sbomify.com/CVE-2022-2501/): Security feature bypass in GitLab (medium 5.9)
- [CVE-2022-25008](https://insights.sbomify.com/CVE-2022-25008/): Auth bypass in totolink:ex1200t firmware (high 8.8)
- [CVE-2022-25004](https://insights.sbomify.com/CVE-2022-25004/): SQL injection in hospital\'s patient records management system project:hospital\'s patient records management system (critical 9.8)
- [CVE-2022-25003](https://insights.sbomify.com/CVE-2022-25003/): SQL injection in hospital\'s patient records management system project:hospital\'s patient records management system (critical 9.8)
- [CVE-2022-2500](https://insights.sbomify.com/CVE-2022-2500/): Cross-site scripting in GitLab (medium 4.4)
- [CVE-2022-24999](https://insights.sbomify.com/CVE-2022-24999/): qs vulnerable to Prototype Pollution (high 7.5)
- [CVE-2022-24995](https://insights.sbomify.com/CVE-2022-24995/): Memory corruption in tenda:ax3 firmware (critical 9.8)
- [CVE-2022-24992](https://insights.sbomify.com/CVE-2022-24992/): Path traversal in qr code generator project:qr code generator (high 7.5)
- [CVE-2022-24990](https://insights.sbomify.com/CVE-2022-24990/): TerraMaster OS Remote Command Execution (critical 9.8, exploited in the wild)
- [CVE-2022-2499](https://insights.sbomify.com/CVE-2022-2499/): Missing authorization in GitLab (low 3.5)
- [CVE-2022-24989](https://insights.sbomify.com/CVE-2022-24989/): Code injection in terra-master:terramaster operating system (critical 9.8)
- [CVE-2022-24988](https://insights.sbomify.com/CVE-2022-24988/): Buffer Overflow in galois_2p8 (critical 9.8)
- [CVE-2022-24986](https://insights.sbomify.com/CVE-2022-24986/): Race condition in kde:kcron (high 7.8)
- [CVE-2022-24985](https://insights.sbomify.com/CVE-2022-24985/): Auth bypass in jqueryform:jqueryform (high 8.8)
- [CVE-2022-24984](https://insights.sbomify.com/CVE-2022-24984/): File upload in jqueryform:jqueryform (critical 9.8)
- [CVE-2022-24983](https://insights.sbomify.com/CVE-2022-24983/): Information disclosure in jqueryform:jqueryform (high 7.5)
- [CVE-2022-24982](https://insights.sbomify.com/CVE-2022-24982/): Information disclosure in jqueryform:jqueryform (medium 6.5)
- [CVE-2022-24981](https://insights.sbomify.com/CVE-2022-24981/): Cross-site scripting in jqueryform:jqueryform (medium 6.1)
- [CVE-2022-24980](https://insights.sbomify.com/CVE-2022-24980/): SSRF in Kitodo.Presentation (high 7.5)
- [CVE-2022-2498](https://insights.sbomify.com/CVE-2022-2498/): Business logic in GitLab (medium 6.4)
- [CVE-2022-24979](https://insights.sbomify.com/CVE-2022-24979/): Missing authorization in mittwald:varnishcache (medium 5.3)
- [CVE-2022-24978](https://insights.sbomify.com/CVE-2022-24978/): Information disclosure in zohocorp:manageengine adaudit plus (high 8.8)
- [CVE-2022-24977](https://insights.sbomify.com/CVE-2022-24977/): Path Traversal in ImpressCMS (critical 9.8)
- [CVE-2022-24976](https://insights.sbomify.com/CVE-2022-24976/): Auth bypass in atheme:atheme (critical 9.1)
- [CVE-2022-24975](https://insights.sbomify.com/CVE-2022-24975/): Information disclosure in git-scm:git (high 7.5)
- [CVE-2022-24974](https://insights.sbomify.com/CVE-2022-24974/): Security feature bypass in menlosecurity:email isolation (medium 5.3)
- [CVE-2022-24973](https://insights.sbomify.com/CVE-2022-24973/): Memory corruption in TL-WR940N (medium 6.8)
- [CVE-2022-24972](https://insights.sbomify.com/CVE-2022-24972/): Missing authorization in TL-WR940N (medium 6.5)
- [CVE-2022-24971](https://insights.sbomify.com/CVE-2022-24971/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-2497](https://insights.sbomify.com/CVE-2022-2497/): Information disclosure in GitLab (high 8.5)
- [CVE-2022-24969](https://insights.sbomify.com/CVE-2022-24969/): bypass of CVE-2021-25640 (medium 6.1)
- [CVE-2022-24968](https://insights.sbomify.com/CVE-2022-24968/): Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket (medium 5.9)
- [CVE-2022-24967](https://insights.sbomify.com/CVE-2022-24967/): Cross-site scripting in blackrainbow:nimbus (medium 6.5)
- [CVE-2022-24963](https://insights.sbomify.com/CVE-2022-24963/): Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions (critical 9.8)
- [CVE-2022-24961](https://insights.sbomify.com/CVE-2022-24961/): Other in portainer:portainer (critical 9.8)
- [CVE-2022-24960](https://insights.sbomify.com/CVE-2022-24960/): Use after free vulnerability in PDFTron SDK (medium 6.5)
- [CVE-2022-24959](https://insights.sbomify.com/CVE-2022-24959/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2022-24958](https://insights.sbomify.com/CVE-2022-24958/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-24957](https://insights.sbomify.com/CVE-2022-24957/): Cross-site scripting in dhc-vision:eqms (medium 5.4)
- [CVE-2022-24956](https://insights.sbomify.com/CVE-2022-24956/): SQL injection in shopware:b2b suite (medium 6.5)
- [CVE-2022-24955](https://insights.sbomify.com/CVE-2022-24955/): Other in foxit:pdf editor (critical 9.8)
- [CVE-2022-24954](https://insights.sbomify.com/CVE-2022-24954/): Memory corruption in foxit:pdf editor (critical 9.8)
- [CVE-2022-24953](https://insights.sbomify.com/CVE-2022-24953/): Crypt_GPG does not prevent additional options in GPG calls (medium 5.3)
- [CVE-2022-24952](https://insights.sbomify.com/CVE-2022-24952/): Denial of service in Eternal Terminal (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/368/