# Vulnerabilities published in 2022


- [CVE-2022-24849](https://insights.sbomify.com/CVE-2022-24849/): Contact to DisCatSharp-owned server using authenticated client (medium 6.5)
- [CVE-2022-24848](https://insights.sbomify.com/CVE-2022-24848/): SQL Injection in DHIS2's in OrgUnit program association (high 8.8)
- [CVE-2022-24847](https://insights.sbomify.com/CVE-2022-24847/): Improper Input Validation in GeoServer (high 7.2)
- [CVE-2022-24846](https://insights.sbomify.com/CVE-2022-24846/): Unchecked JNDI lookups in GeoWebCache (critical 9.1)
- [CVE-2022-24845](https://insights.sbomify.com/CVE-2022-24845/): Integer bounds error in Vyper (high 8.8)
- [CVE-2022-24844](https://insights.sbomify.com/CVE-2022-24844/): SQL Injection in github.com/flipped-aurora/gin-vue-admin (high 8.1)
- [CVE-2022-24843](https://insights.sbomify.com/CVE-2022-24843/): Path Traversal in github.com/flipped-aurora/gin-vue-admin (high 7.5)
- [CVE-2022-24842](https://insights.sbomify.com/CVE-2022-24842/): Improper Privilege Management in MinIO (high 8.8)
- [CVE-2022-24841](https://insights.sbomify.com/CVE-2022-24841/): Improper Authorization in github.com/fleetdm/fleet (medium 6.5)
- [CVE-2022-24840](https://insights.sbomify.com/CVE-2022-24840/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file (critical 9.1)
- [CVE-2022-2484](https://insights.sbomify.com/CVE-2022-2484/): Security feature bypass in ASIK AirScale (high 8.4)
- [CVE-2022-24839](https://insights.sbomify.com/CVE-2022-24839/): Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork) (high 7.5)
- [CVE-2022-24838](https://insights.sbomify.com/CVE-2022-24838/): Command Injection in Appointment Emails for Nextcloud Calendar (medium 5.3)
- [CVE-2022-24837](https://insights.sbomify.com/CVE-2022-24837/): Enumerable upload file names in hedgedoc (medium 5.3)
- [CVE-2022-24836](https://insights.sbomify.com/CVE-2022-24836/): Inefficient Regular Expression Complexity in Nokogiri (high 7.5)
- [CVE-2022-24834](https://insights.sbomify.com/CVE-2022-24834/): Heap overflow issue with the Lua cjson library used by Redis (high 7.0)
- [CVE-2022-24833](https://insights.sbomify.com/CVE-2022-24833/): Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin (high 8.2)
- [CVE-2022-24832](https://insights.sbomify.com/CVE-2022-24832/): Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames (high 8.2)
- [CVE-2022-24831](https://insights.sbomify.com/CVE-2022-24831/): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinica (high 8.3)
- [CVE-2022-24830](https://insights.sbomify.com/CVE-2022-24830/): Path Traversal in OpenClinica (medium 6.5)
- [CVE-2022-2483](https://insights.sbomify.com/CVE-2022-2483/): Security feature bypass in ASIK AirScale (high 8.4)
- [CVE-2022-24829](https://insights.sbomify.com/CVE-2022-24829/): Missing authentication in Garden (high 8.1)
- [CVE-2022-24828](https://insights.sbomify.com/CVE-2022-24828/): Missing input validation can lead to command execution in composer (high 8.3)
- [CVE-2022-24827](https://insights.sbomify.com/CVE-2022-24827/): SQL Injection in elide-datastore-aggregation (high 8.1)
- [CVE-2022-24826](https://insights.sbomify.com/CVE-2022-24826/): Git LFS can execute a binary from the current directory on Windows (critical 9.8)
- [CVE-2022-24825](https://insights.sbomify.com/CVE-2022-24825/): Smokescreen SSRF via deny list bypass (medium 5.8)
- [CVE-2022-24824](https://insights.sbomify.com/CVE-2022-24824/): Anonymous user cache poisoning in discourse (medium 5.3)
- [CVE-2022-24823](https://insights.sbomify.com/CVE-2022-24823/): Local Information Disclosure Vulnerability in io.netty:netty-codec-http (medium 5.5)
- [CVE-2022-24822](https://insights.sbomify.com/CVE-2022-24822/): Denial of Service in @podium/layout and @podium/proxy (high 7.5)
- [CVE-2022-24821](https://insights.sbomify.com/CVE-2022-24821/): Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx (medium 6.8)
- [CVE-2022-24820](https://insights.sbomify.com/CVE-2022-24820/): Unauthenticated user can list hidden document from multiple velocity templates (medium 5.3)
- [CVE-2022-2482](https://insights.sbomify.com/CVE-2022-2482/): Code injection in ASIK AirScale (high 8.4)
- [CVE-2022-24819](https://insights.sbomify.com/CVE-2022-24819/): Unauthenticated user can retrieve the list of users through uorgsuggest.vm (medium 5.3)
- [CVE-2022-24818](https://insights.sbomify.com/CVE-2022-24818/): Unchecked JNDI lookups in GeoTools (high 8.2)
- [CVE-2022-24817](https://insights.sbomify.com/CVE-2022-24817/): Improper kubeconfig validation allows arbitrary code execution (critical 9.9)
- [CVE-2022-24816](https://insights.sbomify.com/CVE-2022-24816/): OSGeo GeoServer JAI-EXT Code Injection (critical 10.0, exploited in the wild)
- [CVE-2022-24815](https://insights.sbomify.com/CVE-2022-24815/): SQL Injection when creating an application with Reactive SQL backend (high 8.1)
- [CVE-2022-24814](https://insights.sbomify.com/CVE-2022-24814/): Cross-site Scripting in Directus (high 8.8)
- [CVE-2022-24813](https://insights.sbomify.com/CVE-2022-24813/): Authentication Bypass Using an Alternate Path or Channel in CreateWiki (medium 5.3)
- [CVE-2022-24812](https://insights.sbomify.com/CVE-2022-24812/): FGAC API Key privilege escalation in Grafana (high 8.0)
- [CVE-2022-24811](https://insights.sbomify.com/CVE-2022-24811/): Cross-site Scripting in Combodo iTop (medium 5.4)
- [CVE-2022-24810](https://insights.sbomify.com/CVE-2022-24810/): net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (medium 6.5)
- [CVE-2022-2481](https://insights.sbomify.com/CVE-2022-2481/): Use after free in Chrome (high 8.8)
- [CVE-2022-24809](https://insights.sbomify.com/CVE-2022-24809/): net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (medium 6.5)
- [CVE-2022-24808](https://insights.sbomify.com/CVE-2022-24808/): net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (medium 6.5)
- [CVE-2022-24807](https://insights.sbomify.com/CVE-2022-24807/): Memory corruption in net-snmp (medium 6.5)
- [CVE-2022-24806](https://insights.sbomify.com/CVE-2022-24806/): net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (medium 6.5)
- [CVE-2022-24805](https://insights.sbomify.com/CVE-2022-24805/): net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (medium 6.5)
- [CVE-2022-24804](https://insights.sbomify.com/CVE-2022-24804/): Private group name exposure in discourse (medium 5.3)
- [CVE-2022-24803](https://insights.sbomify.com/CVE-2022-24803/): Command Injection vulnerability in asciidoctor-include-ext (critical 10.0)
- [CVE-2022-24802](https://insights.sbomify.com/CVE-2022-24802/): Prototype Pollution in deepmerge-ts (high 8.1)
- [CVE-2022-24801](https://insights.sbomify.com/CVE-2022-24801/): HTTP Request Smuggling in twisted.web (high 8.1)
- [CVE-2022-24800](https://insights.sbomify.com/CVE-2022-24800/): Race Condition in October CMS upload process (high 8.1)
- [CVE-2022-2480](https://insights.sbomify.com/CVE-2022-2480/): Use after free in Chrome (high 8.8)
- [CVE-2022-24799](https://insights.sbomify.com/CVE-2022-24799/): Cross Site Scripting in Wire Webapp (critical 9.6)
- [CVE-2022-24798](https://insights.sbomify.com/CVE-2022-24798/): Insufficient password hash filtering in some IRRd queries and exports (high 7.5)
- [CVE-2022-24797](https://insights.sbomify.com/CVE-2022-24797/): Exposure of Sensitive Information in Pomerium (medium 6.5)
- [CVE-2022-24796](https://insights.sbomify.com/CVE-2022-24796/): Remote Command Injection in RaspberryMatic (critical 10.0)
- [CVE-2022-24795](https://insights.sbomify.com/CVE-2022-24795/): Buffer Overflow and Integer Overflow in yajl-ruby (medium 5.9)
- [CVE-2022-24794](https://insights.sbomify.com/CVE-2022-24794/): Open Redirect in express-openid-connect (high 7.5)
- [CVE-2022-24793](https://insights.sbomify.com/CVE-2022-24793/): Potential heap buffer overflow when parsing DNS packets in PJSIP (high 7.5)
- [CVE-2022-24792](https://insights.sbomify.com/CVE-2022-24792/): Potential infinite loop when parsing WAV format file in PJSIP (high 7.5)
- [CVE-2022-24791](https://insights.sbomify.com/CVE-2022-24791/): Use after free in Wasmtime (high 8.1)
- [CVE-2022-24790](https://insights.sbomify.com/CVE-2022-24790/): HTTP Request Smuggling in puma (critical 9.1)
- [CVE-2022-2479](https://insights.sbomify.com/CVE-2022-2479/): Information disclosure in Chrome (medium 4.3)
- [CVE-2022-24789](https://insights.sbomify.com/CVE-2022-24789/): Deserialization of untrusted data in C1 CMS. (high 7.6)
- [CVE-2022-24788](https://insights.sbomify.com/CVE-2022-24788/): Buffer overflow in Vyper (high 7.1)
- [CVE-2022-24787](https://insights.sbomify.com/CVE-2022-24787/): Incorrect Comparison in Vyper (high 7.5)
- [CVE-2022-24786](https://insights.sbomify.com/CVE-2022-24786/): Potential out-of-bound read/write in PJSIP (critical 9.8)
- [CVE-2022-24785](https://insights.sbomify.com/CVE-2022-24785/): Path Traversal in Moment.js (high 7.5)
- [CVE-2022-24784](https://insights.sbomify.com/CVE-2022-24784/): Discoverability of user password hash in Statamic CMS (low 3.7)
- [CVE-2022-24783](https://insights.sbomify.com/CVE-2022-24783/): Sandbox bypass leading to arbitrary code execution in Deno (critical 10.0)
- [CVE-2022-24782](https://insights.sbomify.com/CVE-2022-24782/): Secure category names leaked via user activity export in Discourse (medium 4.3)
- [CVE-2022-24781](https://insights.sbomify.com/CVE-2022-24781/): Malicious users can take over the session of other players (high 7.1)
- [CVE-2022-24780](https://insights.sbomify.com/CVE-2022-24780/): Code Injection in Combodo iTop (high 8.8)
- [CVE-2022-2478](https://insights.sbomify.com/CVE-2022-2478/): Use after free in Chrome (high 8.8)
- [CVE-2022-24778](https://insights.sbomify.com/CVE-2022-24778/): Incorrect Authorization in imgcrypt (high 7.5)
- [CVE-2022-24777](https://insights.sbomify.com/CVE-2022-24777/): Denial of Service via reachable assertion in grpc-swift (high 7.5)
- [CVE-2022-24776](https://insights.sbomify.com/CVE-2022-24776/): Open Redirect in Flask-AppBuilder (medium 6.1)
- [CVE-2022-24775](https://insights.sbomify.com/CVE-2022-24775/): Improper Input Validation in guzzlehttp/psr7 (high 7.5)
- [CVE-2022-24774](https://insights.sbomify.com/CVE-2022-24774/): Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server (high 7.1)
- [CVE-2022-24773](https://insights.sbomify.com/CVE-2022-24773/): Improper Verification of Cryptographic Signature in `node-forge` (medium 5.3)
- [CVE-2022-24772](https://insights.sbomify.com/CVE-2022-24772/): Improper Verification of Cryptographic Signature in `node-forge` (high 7.5)
- [CVE-2022-24771](https://insights.sbomify.com/CVE-2022-24771/): Improper Verification of Cryptographic Signature in node-forge (high 7.5)
- [CVE-2022-24770](https://insights.sbomify.com/CVE-2022-24770/): Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging (high 8.8)
- [CVE-2022-2477](https://insights.sbomify.com/CVE-2022-2477/): Use after free in Chrome (high 8.8)
- [CVE-2022-24769](https://insights.sbomify.com/CVE-2022-24769/): Default inheritable capabilities for linux container should be empty (medium 5.9)
- [CVE-2022-24768](https://insights.sbomify.com/CVE-2022-24768/): Improper access control allows admin privilege escalation in Argo CD (critical 9.9)
- [CVE-2022-24767](https://insights.sbomify.com/CVE-2022-24767/): Privilege escalation in Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) (high 7.8)
- [CVE-2022-24766](https://insights.sbomify.com/CVE-2022-24766/): Insufficient Protection against HTTP Request Smuggling in mitmproxy (critical 9.8)
- [CVE-2022-24765](https://insights.sbomify.com/CVE-2022-24765/): Uncontrolled search for the Git directory in Git for Windows (medium 6.0)
- [CVE-2022-24764](https://insights.sbomify.com/CVE-2022-24764/): Stack buffer overflow in pjproject (high 7.5)
- [CVE-2022-24763](https://insights.sbomify.com/CVE-2022-24763/): Infinite Loop in PJSIP (high 7.5)
- [CVE-2022-24762](https://insights.sbomify.com/CVE-2022-24762/): Exposure of Sensitive Information to an Unauthorized Actor in sysend.js (medium 6.5)
- [CVE-2022-24761](https://insights.sbomify.com/CVE-2022-24761/): HTTP Request Smuggling in waitress (high 7.5)
- [CVE-2022-24760](https://insights.sbomify.com/CVE-2022-24760/): Command Injection in Parse server (critical 10.0)
- [CVE-2022-2476](https://insights.sbomify.com/CVE-2022-2476/): Null dereference in Wavpack (medium 5.5)
- [CVE-2022-24759](https://insights.sbomify.com/CVE-2022-24759/): Failure to validate signature during handshake in @chainsafe/libp2p-noise (high 8.1)
- [CVE-2022-24758](https://insights.sbomify.com/CVE-2022-24758/): Insertion of Sensitive Information into Log File affects Jupyter Notebook (high 7.5)
- [CVE-2022-24757](https://insights.sbomify.com/CVE-2022-24757/): Sensitive Auth & Cookie data stored in Jupyter server logs (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/370/