# Vulnerabilities published in 2022


- [CVE-2022-24756](https://insights.sbomify.com/CVE-2022-24756/): Missing Release of Memory after Effective Lifetime in Bareos Director (high 7.5)
- [CVE-2022-24755](https://insights.sbomify.com/CVE-2022-24755/): Incorrect Authorization in Bareos Director (high 8.1)
- [CVE-2022-24754](https://insights.sbomify.com/CVE-2022-24754/): Buffer overflow in pjsip (high 8.5)
- [CVE-2022-24753](https://insights.sbomify.com/CVE-2022-24753/): Code injection in Stripe CLI on windows (high 7.7)
- [CVE-2022-24752](https://insights.sbomify.com/CVE-2022-24752/): SQL Injection through sorting parameters in SyliusGridBundle (critical 9.8)
- [CVE-2022-24751](https://insights.sbomify.com/CVE-2022-24751/): Race condition in Zulip (medium 5.4)
- [CVE-2022-24750](https://insights.sbomify.com/CVE-2022-24750/): Low privilege user is able to exploit the service and gain SYSTEM privileges in UltraVNC server (high 8.8)
- [CVE-2022-2475](https://insights.sbomify.com/CVE-2022-2475/): Missing authorization in Haas CNC Controller (critical 9.8)
- [CVE-2022-24749](https://insights.sbomify.com/CVE-2022-24749/): Basic Cross-site Scripting and Unrestricted Upload of File with Dangerous Type in Sylius (medium 6.1)
- [CVE-2022-24748](https://insights.sbomify.com/CVE-2022-24748/): Incorrect Authentication in shopware (medium 6.8)
- [CVE-2022-24747](https://insights.sbomify.com/CVE-2022-24747/): HTTP caching is marking private HTTP headers as public (medium 6.3)
- [CVE-2022-24746](https://insights.sbomify.com/CVE-2022-24746/): HTML injection possibility in voucher code form (medium 6.1)
- [CVE-2022-24745](https://insights.sbomify.com/CVE-2022-24745/): Guest session is shared between customers in shopware (medium 4.8)
- [CVE-2022-24744](https://insights.sbomify.com/CVE-2022-24744/): Insufficient Session Expiration in shopware (low 2.6)
- [CVE-2022-24743](https://insights.sbomify.com/CVE-2022-24743/): Insufficient Session Expiration in Sylius (high 7.1)
- [CVE-2022-24742](https://insights.sbomify.com/CVE-2022-24742/): Exposure of Sensitive Information Due to Incompatible Policies in Sylius (medium 5.0)
- [CVE-2022-24741](https://insights.sbomify.com/CVE-2022-24741/): High memory usage in Nextcloud server (low 3.5)
- [CVE-2022-24740](https://insights.sbomify.com/CVE-2022-24740/): Improper Authentication in Volto (medium 5.0)
- [CVE-2022-2474](https://insights.sbomify.com/CVE-2022-2474/): Auth bypass in Haas CNC Controller (critical 9.8)
- [CVE-2022-24739](https://insights.sbomify.com/CVE-2022-24739/): Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect') in alltube (high 7.3)
- [CVE-2022-24738](https://insights.sbomify.com/CVE-2022-24738/): Account compromise in Evmos (high 8.1)
- [CVE-2022-24737](https://insights.sbomify.com/CVE-2022-24737/): Exposure of Sensitive Information to an Unauthorized Actor in httpie (medium 6.5)
- [CVE-2022-24736](https://insights.sbomify.com/CVE-2022-24736/): A Malformed Lua script can crash Redis (low 3.3)
- [CVE-2022-24735](https://insights.sbomify.com/CVE-2022-24735/): Lua scripts can be manipulated to overcome ACL rules in Redis (low 3.9)
- [CVE-2022-24734](https://insights.sbomify.com/CVE-2022-24734/): Remote code execution in mybb (high 7.2)
- [CVE-2022-24733](https://insights.sbomify.com/CVE-2022-24733/): Improper Restriction of Rendered UI Layers or Frames in Sylius (medium 6.1)
- [CVE-2022-24732](https://insights.sbomify.com/CVE-2022-24732/): Maddy Mail Server does not implement account expiry (medium 6.3)
- [CVE-2022-24731](https://insights.sbomify.com/CVE-2022-24731/): Path traversal allows leaking out-of-bound files from Argo CD repo-server (medium 6.8)
- [CVE-2022-24730](https://insights.sbomify.com/CVE-2022-24730/): Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server (high 7.7)
- [CVE-2022-2473](https://insights.sbomify.com/CVE-2022-2473/): WP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-24729](https://insights.sbomify.com/CVE-2022-24729/): Regular expression Denial of Service in dialog plugin (medium 6.5)
- [CVE-2022-24728](https://insights.sbomify.com/CVE-2022-24728/): Cross-site Scripting in CKEditor4 (medium 5.4)
- [CVE-2022-24726](https://insights.sbomify.com/CVE-2022-24726/): Unauthenticated control plane denial of service attack in Istio (high 7.5)
- [CVE-2022-24725](https://insights.sbomify.com/CVE-2022-24725/): Exposure of home directory through shescape on Unix with Bash (medium 6.2)
- [CVE-2022-24724](https://insights.sbomify.com/CVE-2022-24724/): Integer overflow in table parsing extension leads to heap memory corruption (high 8.8)
- [CVE-2022-24723](https://insights.sbomify.com/CVE-2022-24723/): Improper Input Validation in URI.js (medium 5.3)
- [CVE-2022-24722](https://insights.sbomify.com/CVE-2022-24722/): Cross-site Scripting in view_component (high 8.1)
- [CVE-2022-24721](https://insights.sbomify.com/CVE-2022-24721/): Incorrect Authorization in org.cometd.oort (high 8.1)
- [CVE-2022-24720](https://insights.sbomify.com/CVE-2022-24720/): Improper Input Validation in image_processing (critical 9.8)
- [CVE-2022-2472](https://insights.sbomify.com/CVE-2022-2472/): Improper Initialization vulnerability in local server authentication logic (high 7.6)
- [CVE-2022-24719](https://insights.sbomify.com/CVE-2022-24719/): Unauthorized forwarding of confidential headers in fluture-node (low 2.6)
- [CVE-2022-24718](https://insights.sbomify.com/CVE-2022-24718/): Path Traversal in ssr-pages (high 7.6)
- [CVE-2022-24717](https://insights.sbomify.com/CVE-2022-24717/): Cross Site Scripting (XSS) in ssr-pages (medium 6.1)
- [CVE-2022-24716](https://insights.sbomify.com/CVE-2022-24716/): Path traversal in Icinga Web 2 (high 7.5)
- [CVE-2022-24715](https://insights.sbomify.com/CVE-2022-24715/): Arbitrary code execution for authenticated users in Icinga Web 2 (high 8.5)
- [CVE-2022-24714](https://insights.sbomify.com/CVE-2022-24714/): Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2 (medium 5.3)
- [CVE-2022-24713](https://insights.sbomify.com/CVE-2022-24713/): Regular expression denial of service in Rust's regex crate (high 7.5)
- [CVE-2022-24712](https://insights.sbomify.com/CVE-2022-24712/): Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 (medium 6.3)
- [CVE-2022-24711](https://insights.sbomify.com/CVE-2022-24711/): Remote CLI Command Execution Vulnerability in CodeIgniter4 (critical 9.4)
- [CVE-2022-24710](https://insights.sbomify.com/CVE-2022-24710/): Cross-site Scripting in Weblate (medium 5.4)
- [CVE-2022-2471](https://insights.sbomify.com/CVE-2022-2471/): Stack-Based Buffer Overflow Vulnerability in the EZVIZ Motion Detection component (critical 9.9)
- [CVE-2022-24709](https://insights.sbomify.com/CVE-2022-24709/): Cross site scripting in @awsui/components-react (high 8.8)
- [CVE-2022-24708](https://insights.sbomify.com/CVE-2022-24708/): Stored XSS vulnerability in anuko/timetracker (medium 6.5)
- [CVE-2022-24707](https://insights.sbomify.com/CVE-2022-24707/): SQL injection in anuko timetracker (high 7.4)
- [CVE-2022-24706](https://insights.sbomify.com/CVE-2022-24706/): Apache CouchDB Insecure Default Initialization of Resource (critical 9.8, exploited in the wild)
- [CVE-2022-24705](https://insights.sbomify.com/CVE-2022-24705/): Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12 (critical 9.8)
- [CVE-2022-24704](https://insights.sbomify.com/CVE-2022-24704/): Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12 (critical 9.8)
- [CVE-2022-24702](https://insights.sbomify.com/CVE-2022-24702/): Memory corruption in winaprs:winaprs (critical 9.8)
- [CVE-2022-24701](https://insights.sbomify.com/CVE-2022-24701/): Memory corruption in winaprs:winaprs (high 7.8)
- [CVE-2022-24700](https://insights.sbomify.com/CVE-2022-24700/): Memory corruption in winaprs:winaprs (high 7.5)
- [CVE-2022-2470](https://insights.sbomify.com/CVE-2022-2470/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (medium 6.5)
- [CVE-2022-24697](https://insights.sbomify.com/CVE-2022-24697/): Apache Kylin vulnerable to remote code execution (critical 9.8)
- [CVE-2022-24696](https://insights.sbomify.com/CVE-2022-24696/): Privilege escalation in mirametrix:glance (high 7.8)
- [CVE-2022-24695](https://insights.sbomify.com/CVE-2022-24695/): Information disclosure in bluetooth:bluetooth core specification (medium 4.3)
- [CVE-2022-24694](https://insights.sbomify.com/CVE-2022-24694/): Information disclosure in mahara:mahara (medium 4.3)
- [CVE-2022-24693](https://insights.sbomify.com/CVE-2022-24693/): Hardcoded credentials in baicells:neutrino 430 firmware (critical 9.8)
- [CVE-2022-24692](https://insights.sbomify.com/CVE-2022-24692/): Cross-site scripting in dsk:dsknet (medium 5.4)
- [CVE-2022-24691](https://insights.sbomify.com/CVE-2022-24691/): SQL injection in dsk:dsknet (high 7.1)
- [CVE-2022-24690](https://insights.sbomify.com/CVE-2022-24690/): SQL injection in dsk:dsknet (high 8.2)
- [CVE-2022-2469](https://insights.sbomify.com/CVE-2022-2469/): Memory corruption in GNU SASL (low 3.8)
- [CVE-2022-24689](https://insights.sbomify.com/CVE-2022-24689/): Missing authorization in dsk:dsknet (medium 5.3)
- [CVE-2022-24688](https://insights.sbomify.com/CVE-2022-24688/): File upload in dsk:dsknet (high 8.8)
- [CVE-2022-24687](https://insights.sbomify.com/CVE-2022-24687/): HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers (medium 6.5)
- [CVE-2022-24686](https://insights.sbomify.com/CVE-2022-24686/): HashiCorp Nomad Artifact Download Race Condition (medium 5.9)
- [CVE-2022-24685](https://insights.sbomify.com/CVE-2022-24685/): HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling (high 7.5)
- [CVE-2022-24684](https://insights.sbomify.com/CVE-2022-24684/): Nomad Spread Job Stanza May Trigger Panic in Servers (medium 6.5)
- [CVE-2022-24683](https://insights.sbomify.com/CVE-2022-24683/): Arbitrary file reads in HashiCorp Nomad (high 7.5)
- [CVE-2022-24682](https://insights.sbomify.com/CVE-2022-24682/): Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting (medium 6.1, exploited in the wild)
- [CVE-2022-24681](https://insights.sbomify.com/CVE-2022-24681/): Cross-site scripting in zohocorp:manageengine adselfservice plus (medium 6.1)
- [CVE-2022-24680](https://insights.sbomify.com/CVE-2022-24680/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-2468](https://insights.sbomify.com/CVE-2022-2468/): SourceCodester Garage Management System editbrand.php sql injection (medium 6.3)
- [CVE-2022-24679](https://insights.sbomify.com/CVE-2022-24679/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-24678](https://insights.sbomify.com/CVE-2022-24678/): Denial of service in Trend Micro Apex One (high 7.5)
- [CVE-2022-24677](https://insights.sbomify.com/CVE-2022-24677/): Code injection in hyphp:hybbs2 (critical 9.8)
- [CVE-2022-24676](https://insights.sbomify.com/CVE-2022-24676/): File upload in hyphp:hybbs2 (high 8.8)
- [CVE-2022-24675](https://insights.sbomify.com/CVE-2022-24675/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2022-24674](https://insights.sbomify.com/CVE-2022-24674/): Memory corruption in imageCLASS MF644Cdw (high 8.8)
- [CVE-2022-24673](https://insights.sbomify.com/CVE-2022-24673/): Memory corruption in imageCLASS MF644Cdw (high 8.8)
- [CVE-2022-24672](https://insights.sbomify.com/CVE-2022-24672/): Memory corruption in imageCLASS MF644Cdw (high 8.8)
- [CVE-2022-24671](https://insights.sbomify.com/CVE-2022-24671/): Privilege escalation in Trend Micro Antivirus for Mac (high 7.8)
- [CVE-2022-24670](https://insights.sbomify.com/CVE-2022-24670/): Any user can run unrestricted LDAP queries against a configuration endpoint (high 7.1)
- [CVE-2022-2467](https://insights.sbomify.com/CVE-2022-2467/): SourceCodester Garage Management System login.php sql injection (high 7.3)
- [CVE-2022-24669](https://insights.sbomify.com/CVE-2022-24669/): Anonymous users can register / de-register for configuration change notifications (medium 6.5)
- [CVE-2022-24668](https://insights.sbomify.com/CVE-2022-24668/): swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames (high 7.5)
- [CVE-2022-24667](https://insights.sbomify.com/CVE-2022-24667/): swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding (high 7.5)
- [CVE-2022-24666](https://insights.sbomify.com/CVE-2022-24666/): swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length (high 7.5)
- [CVE-2022-24665](https://insights.sbomify.com/CVE-2022-24665/): Remote Code Execution by by Contributor+ users via WordPress gutenberg block (critical 9.9)
- [CVE-2022-24664](https://insights.sbomify.com/CVE-2022-24664/): Remote Code Execution by by Contributor+ users via WordPress metabox (critical 9.9)
- [CVE-2022-24663](https://insights.sbomify.com/CVE-2022-24663/): Remote Code Execution by Subscriber+ users via WordPress shortcode (critical 9.9)
- [CVE-2022-24661](https://insights.sbomify.com/CVE-2022-24661/): Memory corruption in Simcenter STAR-CCM+ Viewer (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/371/