# Vulnerabilities published in 2022 - [CVE-2022-24660](https://insights.sbomify.com/CVE-2022-24660/): Information disclosure in goldshell:goldshell miner firmware (high 7.5) - [CVE-2022-2466](https://insights.sbomify.com/CVE-2022-2466/): Quarkus does not terminate HTTP requests header context (critical 9.8) - [CVE-2022-24659](https://insights.sbomify.com/CVE-2022-24659/): Path traversal in goldshell:goldshell miner firmware (high 7.5) - [CVE-2022-24657](https://insights.sbomify.com/CVE-2022-24657/): Hardcoded credentials in goldshell:goldshell miner firmware (critical 9.8) - [CVE-2022-24656](https://insights.sbomify.com/CVE-2022-24656/): Cross-site scripting in hexoeditor project:hexoeditor (medium 6.1) - [CVE-2022-24655](https://insights.sbomify.com/CVE-2022-24655/): Memory corruption in netgear:cax80 firmware (high 7.8) - [CVE-2022-24654](https://insights.sbomify.com/CVE-2022-24654/): Cross-site scripting in intelbras:ata 200 firmware (medium 5.4) - [CVE-2022-24652](https://insights.sbomify.com/CVE-2022-24652/): File upload in sentcms:sentcms (critical 9.8) - [CVE-2022-24651](https://insights.sbomify.com/CVE-2022-24651/): File upload in sentcms:sentcms (critical 9.8) - [CVE-2022-2465](https://insights.sbomify.com/CVE-2022-2465/): ISaGRAF Workbench Deserialization of Untrusted Data CWE-502 (high 8.6) - [CVE-2022-24647](https://insights.sbomify.com/CVE-2022-24647/): Path traversal in cuppacms:cuppacms (high 8.1) - [CVE-2022-24646](https://insights.sbomify.com/CVE-2022-24646/): SQL injection in phpgurukul:hospital management system (high 7.5) - [CVE-2022-24644](https://insights.sbomify.com/CVE-2022-24644/): Supply chain in zzinc:keymouse firmware (high 8.8) - [CVE-2022-24643](https://insights.sbomify.com/CVE-2022-24643/): Cross-site scripting in open-emr:openemr (medium 5.4) - [CVE-2022-2464](https://insights.sbomify.com/CVE-2022-2464/): ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 (high 7.7) - [CVE-2022-24637](https://insights.sbomify.com/CVE-2022-24637/): Improper Privilege Management in Open Web Analytics (critical 9.8) - [CVE-2022-24633](https://insights.sbomify.com/CVE-2022-24633/): Information disclosure in filecloud:filecloud (medium 5.3) - [CVE-2022-24632](https://insights.sbomify.com/CVE-2022-24632/): Path traversal in audiocodes:device manager express (medium 5.3) - [CVE-2022-24631](https://insights.sbomify.com/CVE-2022-24631/): Cross-site scripting in audiocodes:device manager express (medium 5.4) - [CVE-2022-24630](https://insights.sbomify.com/CVE-2022-24630/): Command injection in audiocodes:device manager express (high 7.2) - [CVE-2022-2463](https://insights.sbomify.com/CVE-2022-2463/): ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 (medium 6.1) - [CVE-2022-24629](https://insights.sbomify.com/CVE-2022-24629/): Path traversal in audiocodes:device manager express (critical 9.8) - [CVE-2022-24628](https://insights.sbomify.com/CVE-2022-24628/): SQL injection in audiocodes:device manager express (high 7.2) - [CVE-2022-24627](https://insights.sbomify.com/CVE-2022-24627/): SQL injection in audiocodes:device manager express (critical 9.8) - [CVE-2022-24620](https://insights.sbomify.com/CVE-2022-24620/): Cross-site scripting in piwigo:piwigo (medium 5.4) - [CVE-2022-2462](https://insights.sbomify.com/CVE-2022-2462/): Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure (medium 5.3) - [CVE-2022-24618](https://insights.sbomify.com/CVE-2022-24618/): Privilege escalation in heimdalsecurity:heimdal premium security (high 7.8) - [CVE-2022-24615](https://insights.sbomify.com/CVE-2022-24615/): Uncaught Exception in zip4j (medium 5.5) - [CVE-2022-24614](https://insights.sbomify.com/CVE-2022-24614/): Allocation of Resources Without Limits or Throttling in metadata-extractor (medium 5.5) - [CVE-2022-24613](https://insights.sbomify.com/CVE-2022-24613/): Improper Handling of Exceptional Conditions inn metadata-extractor (medium 5.5) - [CVE-2022-24612](https://insights.sbomify.com/CVE-2022-24612/): Cross-site scripting in eyesofnetwork:eyesofnetwork (medium 5.4) - [CVE-2022-24611](https://insights.sbomify.com/CVE-2022-24611/): Denial of service in silabs:sd3502 firmware (medium 6.5) - [CVE-2022-24610](https://insights.sbomify.com/CVE-2022-24610/): Information disclosure in alecto:dvc-215ip firmware (high 8.6) - [CVE-2022-2461](https://insights.sbomify.com/CVE-2022-2461/): Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change (medium 5.3) - [CVE-2022-24609](https://insights.sbomify.com/CVE-2022-24609/): Missing authorization in luocms project:luocms (critical 9.8) - [CVE-2022-24608](https://insights.sbomify.com/CVE-2022-24608/): Cross-site scripting in luocms project:luocms (medium 6.1) - [CVE-2022-24607](https://insights.sbomify.com/CVE-2022-24607/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-24606](https://insights.sbomify.com/CVE-2022-24606/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-24605](https://insights.sbomify.com/CVE-2022-24605/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-24604](https://insights.sbomify.com/CVE-2022-24604/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-24603](https://insights.sbomify.com/CVE-2022-24603/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-24602](https://insights.sbomify.com/CVE-2022-24602/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-24601](https://insights.sbomify.com/CVE-2022-24601/): SQL injection in luocms project:luocms (high 7.5) - [CVE-2022-24600](https://insights.sbomify.com/CVE-2022-24600/): SQL injection in luocms project:luocms (critical 9.8) - [CVE-2022-2460](https://insights.sbomify.com/CVE-2022-2460/): WPDating < 7.4.0 - Multiple Unauthenticated SQLi (medium 4.3) - [CVE-2022-24599](https://insights.sbomify.com/CVE-2022-24599/): Information disclosure in audiofile:audiofile (medium 6.5) - [CVE-2022-24595](https://insights.sbomify.com/CVE-2022-24595/): Missing authorization in automotivelinux:kooky koi (critical 9.8) - [CVE-2022-24594](https://insights.sbomify.com/CVE-2022-24594/): Security feature bypass in waline:waline (medium 5.3) - [CVE-2022-24590](https://insights.sbomify.com/CVE-2022-24590/): Cross-site scripting in backdropcms:backdrop (medium 5.4) - [CVE-2022-2459](https://insights.sbomify.com/CVE-2022-2459/): Missing authorization in GitLab (low 2.7) - [CVE-2022-24589](https://insights.sbomify.com/CVE-2022-24589/): Cross-site scripting in burden project:burden (medium 6.1) - [CVE-2022-24588](https://insights.sbomify.com/CVE-2022-24588/): Cross-site scripting in flatpress:flatpress (medium 5.4) - [CVE-2022-24587](https://insights.sbomify.com/CVE-2022-24587/): Cross-site scripting in pluxml:pluxml (medium 5.4) - [CVE-2022-24586](https://insights.sbomify.com/CVE-2022-24586/): Cross-site scripting in pluxml:pluxml (medium 5.4) - [CVE-2022-24585](https://insights.sbomify.com/CVE-2022-24585/): Cross-site scripting in pluxml:pluxml (medium 5.4) - [CVE-2022-24584](https://insights.sbomify.com/CVE-2022-24584/): Missing authorization in yubico:otp (medium 6.5) - [CVE-2022-24582](https://insights.sbomify.com/CVE-2022-24582/): Cross-site scripting in accounting journal management project:accounting journal management (medium 5.4) - [CVE-2022-24581](https://insights.sbomify.com/CVE-2022-24581/): Information disclosure in aceware:aceweb online portal (high 7.5) - [CVE-2022-2458](https://insights.sbomify.com/CVE-2022-2458/): XML external entity in Red Hat Process Automation Manager 7 (high 8.2) - [CVE-2022-24578](https://insights.sbomify.com/CVE-2022-24578/): Memory corruption in gpac:gpac (high 7.8) - [CVE-2022-24577](https://insights.sbomify.com/CVE-2022-24577/): Null dereference in gpac:gpac (high 7.8) - [CVE-2022-24576](https://insights.sbomify.com/CVE-2022-24576/): Use after free in gpac:gpac (medium 5.5) - [CVE-2022-24575](https://insights.sbomify.com/CVE-2022-24575/): Memory corruption in gpac:gpac (high 7.8) - [CVE-2022-24574](https://insights.sbomify.com/CVE-2022-24574/): Null dereference in gpac:gpac (medium 5.5) - [CVE-2022-24573](https://insights.sbomify.com/CVE-2022-24573/): Cross-site scripting in element-it:http commander (medium 6.1) - [CVE-2022-24572](https://insights.sbomify.com/CVE-2022-24572/): Cross-site scripting in car driving school management system project:car driving school management system (medium 6.1) - [CVE-2022-24571](https://insights.sbomify.com/CVE-2022-24571/): SQL injection in car driving school management system project:car driving school management system (critical 9.8) - [CVE-2022-2457](https://insights.sbomify.com/CVE-2022-2457/): Auth bypass in Red Hat Process Automation Manager 7 (medium 6.5) - [CVE-2022-24568](https://insights.sbomify.com/CVE-2022-24568/): Server-side request forgery in xxyopen:novel-plus (critical 9.8) - [CVE-2022-24566](https://insights.sbomify.com/CVE-2022-24566/): Cross-site scripting in checkmk:checkmk (medium 5.4) - [CVE-2022-24565](https://insights.sbomify.com/CVE-2022-24565/): Cross-site scripting in checkmk:checkmk (medium 5.4) - [CVE-2022-24564](https://insights.sbomify.com/CVE-2022-24564/): Cross-site scripting in checkmk:checkmk (medium 6.1) - [CVE-2022-24563](https://insights.sbomify.com/CVE-2022-24563/): Cross-site Scripting in GeniXCMS (medium 5.4) - [CVE-2022-24562](https://insights.sbomify.com/CVE-2022-24562/): Auth bypass in iobit:iotransfer (critical 9.8) - [CVE-2022-2456](https://insights.sbomify.com/CVE-2022-2456/): Missing authorization in GitLab (medium 4.9) - [CVE-2022-24553](https://insights.sbomify.com/CVE-2022-24553/): File upload in zfaka project:zfaka (critical 9.8) - [CVE-2022-24552](https://insights.sbomify.com/CVE-2022-24552/): Command injection in starwindsoftware:nas (critical 9.8) - [CVE-2022-24551](https://insights.sbomify.com/CVE-2022-24551/): Auth bypass in starwindsoftware:nas (high 8.8) - [CVE-2022-24550](https://insights.sbomify.com/CVE-2022-24550/): Windows Telephony Server Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-2455](https://insights.sbomify.com/CVE-2022-2455/): Denial of service in GitLab (medium 6.5) - [CVE-2022-24549](https://insights.sbomify.com/CVE-2022-24549/): Windows AppX Package Manager Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-24548](https://insights.sbomify.com/CVE-2022-24548/): Microsoft Defender Denial of Service Vulnerability (medium 5.5) - [CVE-2022-24547](https://insights.sbomify.com/CVE-2022-24547/): Windows Digital Media Receiver Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-24546](https://insights.sbomify.com/CVE-2022-24546/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-24545](https://insights.sbomify.com/CVE-2022-24545/): Windows Kerberos Remote Code Execution Vulnerability (high 8.1) - [CVE-2022-24544](https://insights.sbomify.com/CVE-2022-24544/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-24543](https://insights.sbomify.com/CVE-2022-24543/): Windows Upgrade Assistant Remote Code Execution Vulnerability (high 7.8) - [CVE-2022-24542](https://insights.sbomify.com/CVE-2022-24542/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-24541](https://insights.sbomify.com/CVE-2022-24541/): Windows Server Service Remote Code Execution Vulnerability (high 8.8) - [CVE-2022-24540](https://insights.sbomify.com/CVE-2022-24540/): Windows ALPC Elevation of Privilege Vulnerability (high 7.0) - [CVE-2022-2454](https://insights.sbomify.com/CVE-2022-2454/): Integer Overflow or Wraparound in gpac/gpac (high 7.8) - [CVE-2022-24539](https://insights.sbomify.com/CVE-2022-24539/): Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability (high 8.1) - [CVE-2022-24538](https://insights.sbomify.com/CVE-2022-24538/): Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability (medium 6.5) - [CVE-2022-24537](https://insights.sbomify.com/CVE-2022-24537/): Windows Hyper-V Remote Code Execution Vulnerability (high 7.8) - [CVE-2022-24536](https://insights.sbomify.com/CVE-2022-24536/): Windows DNS Server Remote Code Execution Vulnerability (high 7.2) - [CVE-2022-24534](https://insights.sbomify.com/CVE-2022-24534/): Win32 Stream Enumeration Remote Code Execution Vulnerability (high 7.5) - [CVE-2022-24533](https://insights.sbomify.com/CVE-2022-24533/): Remote Desktop Protocol Remote Code Execution Vulnerability (high 8.0) - [CVE-2022-24532](https://insights.sbomify.com/CVE-2022-24532/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8) - [CVE-2022-24530](https://insights.sbomify.com/CVE-2022-24530/): Windows Installer Elevation of Privilege Vulnerability (high 7.8) - [CVE-2022-2453](https://insights.sbomify.com/CVE-2022-2453/): Use After Free in gpac/gpac (high 7.8) --- From sbomify Insights: https://insights.sbomify.com/years/2022/page/372/