# Vulnerabilities published in 2022


- [CVE-2022-24951](https://insights.sbomify.com/CVE-2022-24951/): Race condition in Eternal Terminal (high 7.0)
- [CVE-2022-24950](https://insights.sbomify.com/CVE-2022-24950/): Race condition in Eternal Terminal (high 7.5)
- [CVE-2022-2495](https://insights.sbomify.com/CVE-2022-2495/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 6.8)
- [CVE-2022-24949](https://insights.sbomify.com/CVE-2022-24949/): Race condition in Eternal Terminal (high 7.5)
- [CVE-2022-24948](https://insights.sbomify.com/CVE-2022-24948/): Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen (medium 6.1)
- [CVE-2022-24947](https://insights.sbomify.com/CVE-2022-24947/): Apache JSPWiki CSRF Account Takeover (high 8.8)
- [CVE-2022-24946](https://insights.sbomify.com/CVE-2022-24946/): Denial of service in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V; Mitsubishi Electric MELSEC-Q Series Q03UDECPU; Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V; Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G); Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS; Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC-L series L26CPU-(P)BT; Mitsubishi Electric MELIPC Series MI5122-VW (high 7.5)
- [CVE-2022-24942](https://insights.sbomify.com/CVE-2022-24942/): Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution (critical 9.1)
- [CVE-2022-2494](https://insights.sbomify.com/CVE-2022-2494/): Cross-site Scripting (XSS) - Stored in openemr/openemr (medium 6.3)
- [CVE-2022-24939](https://insights.sbomify.com/CVE-2022-24939/): Malformed Zigbee packet with invalid destination address causes Assert (medium 5.7)
- [CVE-2022-24938](https://insights.sbomify.com/CVE-2022-24938/): Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earlier (medium 6.5)
- [CVE-2022-24937](https://insights.sbomify.com/CVE-2022-24937/): Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier (medium 6.5)
- [CVE-2022-24936](https://insights.sbomify.com/CVE-2022-24936/): Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices (high 8.3)
- [CVE-2022-24935](https://insights.sbomify.com/CVE-2022-24935/): Missing authorization in lexmark:lexmark firmware (high 7.5)
- [CVE-2022-24934](https://insights.sbomify.com/CVE-2022-24934/): Code injection in wps:wps office (critical 9.8)
- [CVE-2022-24932](https://insights.sbomify.com/CVE-2022-24932/): Security feature bypass in Samsung Clould (medium 4.2)
- [CVE-2022-24931](https://insights.sbomify.com/CVE-2022-24931/): Missing authorization in Samsung Mobile Devices (high 7.9)
- [CVE-2022-24930](https://insights.sbomify.com/CVE-2022-24930/): Missing authorization in Samsung Wearable Devices (medium 4.4)
- [CVE-2022-2493](https://insights.sbomify.com/CVE-2022-2493/): Data Access from Outside Expected Data Manager Component in openemr/openemr (high 8.3)
- [CVE-2022-24929](https://insights.sbomify.com/CVE-2022-24929/): Missing authorization in Samsung Mobile Devices (medium 4.1)
- [CVE-2022-24928](https://insights.sbomify.com/CVE-2022-24928/): Misconfiguration in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-24927](https://insights.sbomify.com/CVE-2022-24927/): Privilege escalation in Samsung Video Player (medium 4.2)
- [CVE-2022-24926](https://insights.sbomify.com/CVE-2022-24926/): Cross-site scripting in SmartTagPlugin (medium 5.7)
- [CVE-2022-24925](https://insights.sbomify.com/CVE-2022-24925/): Denial of service in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-24924](https://insights.sbomify.com/CVE-2022-24924/): Missing authorization in LiveWallpaper (low 2.2)
- [CVE-2022-24923](https://insights.sbomify.com/CVE-2022-24923/): Missing authorization in SearchWidget (medium 4.0)
- [CVE-2022-24921](https://insights.sbomify.com/CVE-2022-24921/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2022-2492](https://insights.sbomify.com/CVE-2022-2492/): SourceCodester Library Management System index.php sql injection (medium 6.3)
- [CVE-2022-24919](https://insights.sbomify.com/CVE-2022-24919/): Reflected XSS in graph configuration window of Zabbix Frontend (low 3.7)
- [CVE-2022-24918](https://insights.sbomify.com/CVE-2022-24918/): Reflected XSS in item configuration window of Zabbix Frontend (low 3.7)
- [CVE-2022-24917](https://insights.sbomify.com/CVE-2022-24917/): Reflected XSS in service configuration window of Zabbix Frontend (low 3.7)
- [CVE-2022-24916](https://insights.sbomify.com/CVE-2022-24916/): Business logic in optimism:eth-optimism\/l2geth (high 7.5)
- [CVE-2022-24915](https://insights.sbomify.com/CVE-2022-24915/): ICSA-22-062-01 IPCOMM ipDIO (high 8.0)
- [CVE-2022-24913](https://insights.sbomify.com/CVE-2022-24913/): Java Merge-sort Insecure Temporary File vulnerability (medium 5.5)
- [CVE-2022-24912](https://insights.sbomify.com/CVE-2022-24912/): Timing Attack (high 7.5)
- [CVE-2022-24910](https://insights.sbomify.com/CVE-2022-24910/): Memory corruption in InRouter302 (high 8.2)
- [CVE-2022-2491](https://insights.sbomify.com/CVE-2022-2491/): SourceCodester Library Management System lab.php sql injection (medium 6.3)
- [CVE-2022-24908](https://insights.sbomify.com/CVE-2022-24908/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-24907](https://insights.sbomify.com/CVE-2022-24907/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-24906](https://insights.sbomify.com/CVE-2022-24906/): Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck (low 3.5)
- [CVE-2022-24905](https://insights.sbomify.com/CVE-2022-24905/): Argo CD login screen allows message spoofing if SSO is enabled (medium 4.3)
- [CVE-2022-24904](https://insights.sbomify.com/CVE-2022-24904/): Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server (medium 4.3)
- [CVE-2022-24903](https://insights.sbomify.com/CVE-2022-24903/): Buffer overflow in TCP syslog server (receiver) components in rsyslog (high 8.1)
- [CVE-2022-24902](https://insights.sbomify.com/CVE-2022-24902/): Memory issue in playing videos (low 2.9)
- [CVE-2022-24901](https://insights.sbomify.com/CVE-2022-24901/): Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (high 7.5)
- [CVE-2022-24900](https://insights.sbomify.com/CVE-2022-24900/): Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer (critical 9.9)
- [CVE-2022-2490](https://insights.sbomify.com/CVE-2022-2490/): SourceCodester Simple E-Learning System search.php sql injection (medium 6.3)
- [CVE-2022-24899](https://insights.sbomify.com/CVE-2022-24899/): Cross site scripting via canonical tag (high 7.2)
- [CVE-2022-24898](https://insights.sbomify.com/CVE-2022-24898/): Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml (medium 4.9)
- [CVE-2022-24897](https://insights.sbomify.com/CVE-2022-24897/): Arbitrary filesystem write access from Velocity (high 7.5)
- [CVE-2022-24896](https://insights.sbomify.com/CVE-2022-24896/): Tracker report renderer and chart widgets leak information in Tuleap (medium 4.3)
- [CVE-2022-24895](https://insights.sbomify.com/CVE-2022-24895/): Symfony vulnerable to Session Fixation of CSRF tokens (medium 6.3)
- [CVE-2022-24894](https://insights.sbomify.com/CVE-2022-24894/): Symfony storing cookie headers in HttpCache (medium 5.9)
- [CVE-2022-24893](https://insights.sbomify.com/CVE-2022-24893/): Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption (high 7.5)
- [CVE-2022-24892](https://insights.sbomify.com/CVE-2022-24892/): Multiple valid tokens for password reset in Shopware (medium 6.4)
- [CVE-2022-24891](https://insights.sbomify.com/CVE-2022-24891/): Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file (medium 5.4)
- [CVE-2022-24890](https://insights.sbomify.com/CVE-2022-24890/): Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk (low 2.4)
- [CVE-2022-2489](https://insights.sbomify.com/CVE-2022-2489/): SourceCodester Simple E-Learning System classRoom.php sql injection (medium 6.3)
- [CVE-2022-24889](https://insights.sbomify.com/CVE-2022-24889/): Insufficient Verification of Data Authenticity in Nextcloud Server (low 2.4)
- [CVE-2022-24888](https://insights.sbomify.com/CVE-2022-24888/): Possible Injection in Nextcloud Server (medium 4.3)
- [CVE-2022-24887](https://insights.sbomify.com/CVE-2022-24887/): Open Redirect in Nextcloud Talk (medium 4.3)
- [CVE-2022-24886](https://insights.sbomify.com/CVE-2022-24886/): Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client (low 2.2)
- [CVE-2022-24885](https://insights.sbomify.com/CVE-2022-24885/): Improper Authentication in Nextcloud Android Files (low 2.0)
- [CVE-2022-24884](https://insights.sbomify.com/CVE-2022-24884/): Trivial signature forgery in ecdsautils (critical 10.0)
- [CVE-2022-24883](https://insights.sbomify.com/CVE-2022-24883/): FreeRDP Server authentication might allow invalid credentials to pass (high 7.4)
- [CVE-2022-24882](https://insights.sbomify.com/CVE-2022-24882/): Server side NTLM does not properly check parameters in FreeRDP (critical 9.1)
- [CVE-2022-24881](https://insights.sbomify.com/CVE-2022-24881/): Command Injection in Ballcat Codegen (high 8.8)
- [CVE-2022-24880](https://insights.sbomify.com/CVE-2022-24880/): Potential Captcha Validate Bypass in flask-session-captcha (medium 5.3)
- [CVE-2022-2488](https://insights.sbomify.com/CVE-2022-2488/): WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection (high 8.0)
- [CVE-2022-24879](https://insights.sbomify.com/CVE-2022-24879/): Malfunction of Cross-Site Request Forgery token validation (high 7.5)
- [CVE-2022-24878](https://insights.sbomify.com/CVE-2022-24878/): Improper path handling in Kustomization files allows for denial of service (high 7.7)
- [CVE-2022-24877](https://insights.sbomify.com/CVE-2022-24877/): Improper path handling in kustomization files allows path traversal (critical 9.9)
- [CVE-2022-24876](https://insights.sbomify.com/CVE-2022-24876/): Stored cross site scrpting in GLPI's Kanban (medium 5.4)
- [CVE-2022-24875](https://insights.sbomify.com/CVE-2022-24875/): Potential Secrets being logged to disk in CVEProject/cve-services (medium 5.3)
- [CVE-2022-24873](https://insights.sbomify.com/CVE-2022-24873/): Non-Stored Cross-site Scripting in Shopware storefront (medium 5.4)
- [CVE-2022-24872](https://insights.sbomify.com/CVE-2022-24872/): Improper Access Control in shopware (high 8.1)
- [CVE-2022-24871](https://insights.sbomify.com/CVE-2022-24871/): Server-Side Request Forgery (SSRF) in Shopware (high 7.2)
- [CVE-2022-24870](https://insights.sbomify.com/CVE-2022-24870/): Stored Cross-site Scripting in Combodo iTop (high 8.7)
- [CVE-2022-2487](https://insights.sbomify.com/CVE-2022-2487/): WAVLINK WN535K2/WN535K3 nightled.cgi os command injection (high 8.0)
- [CVE-2022-24869](https://insights.sbomify.com/CVE-2022-24869/): Cross Site Scripting in GLPI (medium 4.6)
- [CVE-2022-24868](https://insights.sbomify.com/CVE-2022-24868/): Cross site scripting via SVG file upload in GLPI (high 7.3)
- [CVE-2022-24867](https://insights.sbomify.com/CVE-2022-24867/): LDAP password exposure in glpi (high 7.5)
- [CVE-2022-24866](https://insights.sbomify.com/CVE-2022-24866/): Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign (medium 4.3)
- [CVE-2022-24865](https://insights.sbomify.com/CVE-2022-24865/): Improper access control in humhub (medium 6.5)
- [CVE-2022-24864](https://insights.sbomify.com/CVE-2022-24864/): Malicious Javascript injection in OriginProtocol/origin-website (medium 4.1)
- [CVE-2022-24863](https://insights.sbomify.com/CVE-2022-24863/): Denial of service in http-swagger (high 7.5)
- [CVE-2022-24862](https://insights.sbomify.com/CVE-2022-24862/): Server-Side Request Forgery in Databasir (high 7.7)
- [CVE-2022-24861](https://insights.sbomify.com/CVE-2022-24861/): Remote Code Execution in Databasir (critical 9.9)
- [CVE-2022-24860](https://insights.sbomify.com/CVE-2022-24860/): Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. (high 7.4)
- [CVE-2022-2486](https://insights.sbomify.com/CVE-2022-2486/): WAVLINK WN535K2/WN535K3 os command injection (high 8.0)
- [CVE-2022-24859](https://insights.sbomify.com/CVE-2022-24859/): Manipulated inline images can cause Infinite Loop in PyPDF2 (medium 6.2)
- [CVE-2022-24858](https://insights.sbomify.com/CVE-2022-24858/): Default redirect callback vulnerable to open redirects (medium 6.1)
- [CVE-2022-24857](https://insights.sbomify.com/CVE-2022-24857/): Multi factor authentication bypass in django-mfa3 (high 7.3)
- [CVE-2022-24856](https://insights.sbomify.com/CVE-2022-24856/): Server-Side Request Forgery in FlyteConsole (critical 9.1)
- [CVE-2022-24855](https://insights.sbomify.com/CVE-2022-24855/): XSS vulnerability in Metabase (high 8.7)
- [CVE-2022-24854](https://insights.sbomify.com/CVE-2022-24854/): Database bypassing any permissions in Metabase via SQlite attach (high 8.0)
- [CVE-2022-24853](https://insights.sbomify.com/CVE-2022-24853/): File system exposure in Metabase (medium 5.9)
- [CVE-2022-24851](https://insights.sbomify.com/CVE-2022-24851/): Stored XSS and path traversal in LDAPAccountManager/lam (high 8.1)
- [CVE-2022-24850](https://insights.sbomify.com/CVE-2022-24850/): Category group permissions leaked in Discourse (medium 5.3)
- [CVE-2022-2485](https://insights.sbomify.com/CVE-2022-2485/): AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/369/