# Vulnerabilities published in 2022


- [CVE-2022-24424](https://insights.sbomify.com/CVE-2022-24424/): Path traversal in AppSync (high 7.5)
- [CVE-2022-24423](https://insights.sbomify.com/CVE-2022-24423/): Denial of service in Integrated Dell Remote Access Controller 8 (medium 5.3)
- [CVE-2022-24422](https://insights.sbomify.com/CVE-2022-24422/): Auth bypass in Integrated Dell Remote Access Controller 9 (critical 9.6)
- [CVE-2022-24421](https://insights.sbomify.com/CVE-2022-24421/): Memory corruption in CPG BIOS (high 8.2)
- [CVE-2022-24420](https://insights.sbomify.com/CVE-2022-24420/): Memory corruption in CPG BIOS (high 8.2)
- [CVE-2022-2442](https://insights.sbomify.com/CVE-2022-2442/): Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization (high 7.2)
- [CVE-2022-24419](https://insights.sbomify.com/CVE-2022-24419/): Memory corruption in CPG BIOS (high 8.2)
- [CVE-2022-24418](https://insights.sbomify.com/CVE-2022-24418/): Other in CPG BIOS (high 7.5)
- [CVE-2022-24417](https://insights.sbomify.com/CVE-2022-24417/): Other in CPG BIOS (high 7.5)
- [CVE-2022-24416](https://insights.sbomify.com/CVE-2022-24416/): Memory corruption in CPG BIOS (high 8.2)
- [CVE-2022-24415](https://insights.sbomify.com/CVE-2022-24415/): Memory corruption in CPG BIOS (high 8.2)
- [CVE-2022-24414](https://insights.sbomify.com/CVE-2022-24414/): Information disclosure in CloudLink (high 7.6)
- [CVE-2022-24413](https://insights.sbomify.com/CVE-2022-24413/): Race condition in PowerScale OneFS (medium 4.4)
- [CVE-2022-24412](https://insights.sbomify.com/CVE-2022-24412/): Denial of service in PowerScale OneFS (high 7.5)
- [CVE-2022-24411](https://insights.sbomify.com/CVE-2022-24411/): Privilege escalation in PowerScale OneFS (high 7.8)
- [CVE-2022-24410](https://insights.sbomify.com/CVE-2022-24410/): Information disclosure in CPG BIOS (medium 6.8)
- [CVE-2022-2441](https://insights.sbomify.com/CVE-2022-2441/): ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution (high 8.8)
- [CVE-2022-24409](https://insights.sbomify.com/CVE-2022-24409/): Weak cryptography in Dell BSAFE SSL-J (medium 5.9)
- [CVE-2022-24408](https://insights.sbomify.com/CVE-2022-24408/): Privilege escalation in SINUMERIK MC (high 7.8)
- [CVE-2022-24407](https://insights.sbomify.com/CVE-2022-24407/): SQL injection in cyrusimap:cyrus-sasl (high 8.8)
- [CVE-2022-24406](https://insights.sbomify.com/CVE-2022-24406/): Server-side request forgery in open-xchange:ox app suite (medium 6.5)
- [CVE-2022-24405](https://insights.sbomify.com/CVE-2022-24405/): Deserialization in open-xchange:ox app suite (critical 9.8)
- [CVE-2022-24404](https://insights.sbomify.com/CVE-2022-24404/): Ciphertext Malleability in TETRA (medium 5.9)
- [CVE-2022-24403](https://insights.sbomify.com/CVE-2022-24403/): De-anonymization attack in TETRA (medium 4.3)
- [CVE-2022-24402](https://insights.sbomify.com/CVE-2022-24402/): Intentionally weakened effective strength in TETRA TEA1 (high 8.8)
- [CVE-2022-24401](https://insights.sbomify.com/CVE-2022-24401/): Keystream recovery for arbitrary frames in TETRA (high 8.8)
- [CVE-2022-24400](https://insights.sbomify.com/CVE-2022-24400/): DCK pinning attack in TETRA (high 7.5)
- [CVE-2022-2440](https://insights.sbomify.com/CVE-2022-2440/): Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization (high 7.2)
- [CVE-2022-24399](https://insights.sbomify.com/CVE-2022-24399/): Cross-site scripting in SAP Focused Run (Real User Monitoring) (medium 6.1)
- [CVE-2022-24398](https://insights.sbomify.com/CVE-2022-24398/): Information disclosure in SAP Business Objects Business Intelligence Platform (medium 6.5)
- [CVE-2022-24397](https://insights.sbomify.com/CVE-2022-24397/): Cross-site scripting in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2022-24396](https://insights.sbomify.com/CVE-2022-24396/): Missing authorization in SAP Focused Run (Simple Diagnostics Agent) (high 7.8)
- [CVE-2022-24395](https://insights.sbomify.com/CVE-2022-24395/): Cross-site scripting in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2022-24394](https://insights.sbomify.com/CVE-2022-24394/): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-24393](https://insights.sbomify.com/CVE-2022-24393/): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-24392](https://insights.sbomify.com/CVE-2022-24392/): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-24391](https://insights.sbomify.com/CVE-2022-24391/): Authenticated SQL Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-24390](https://insights.sbomify.com/CVE-2022-24390/): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-2439](https://insights.sbomify.com/CVE-2022-2439/): Deserialization in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (high 7.2)
- [CVE-2022-24389](https://insights.sbomify.com/CVE-2022-24389/): Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-24388](https://insights.sbomify.com/CVE-2022-24388/): Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception (high 8.8)
- [CVE-2022-24387](https://insights.sbomify.com/CVE-2022-24387/): File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010 (critical 9.1)
- [CVE-2022-24386](https://insights.sbomify.com/CVE-2022-24386/): Stored XSS in SmarterTrack v100.0.8019.14010 (high 8.8)
- [CVE-2022-24385](https://insights.sbomify.com/CVE-2022-24385/): Information disclosure via direct object access on SmarterTrack v100.0.8019.14010 (medium 6.5)
- [CVE-2022-24384](https://insights.sbomify.com/CVE-2022-24384/): Reflective XSS on SmarterTrack v100.0.8019.14010 (high 8.8)
- [CVE-2022-24383](https://insights.sbomify.com/CVE-2022-24383/): ICSA-22-090-03 Fuji Electric Alpha5 (high 7.8)
- [CVE-2022-24382](https://insights.sbomify.com/CVE-2022-24382/): Privilege escalation in Intel(R) NUCs (medium 6.7)
- [CVE-2022-24381](https://insights.sbomify.com/CVE-2022-24381/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-2438](https://insights.sbomify.com/CVE-2022-2438/): Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization (high 7.2)
- [CVE-2022-24379](https://insights.sbomify.com/CVE-2022-24379/): Privilege escalation in Intel(R) Server System M70KLP Family BIOS firmware (high 7.5)
- [CVE-2022-24378](https://insights.sbomify.com/CVE-2022-24378/): Denial of service in Intel(R) Data Center Manager software (medium 5.5)
- [CVE-2022-24377](https://insights.sbomify.com/CVE-2022-24377/): Command Injection (high 7.4)
- [CVE-2022-24376](https://insights.sbomify.com/CVE-2022-24376/): Command Injection (high 7.2)
- [CVE-2022-24375](https://insights.sbomify.com/CVE-2022-24375/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-24374](https://insights.sbomify.com/CVE-2022-24374/): Cross-site scripting in a-blog cms (medium 6.1)
- [CVE-2022-24373](https://insights.sbomify.com/CVE-2022-24373/): Regular Expression Denial of Service (ReDoS) (medium 5.3)
- [CVE-2022-24372](https://insights.sbomify.com/CVE-2022-24372/): Path traversal in linksys:mr9600 firmware (medium 4.6)
- [CVE-2022-24370](https://insights.sbomify.com/CVE-2022-24370/): Memory corruption in PDF Reader (low 3.3)
- [CVE-2022-2437](https://insights.sbomify.com/CVE-2022-2437/): Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization (critical 9.8)
- [CVE-2022-24369](https://insights.sbomify.com/CVE-2022-24369/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-24368](https://insights.sbomify.com/CVE-2022-24368/): Use after free in PDF Reader (low 3.3)
- [CVE-2022-24367](https://insights.sbomify.com/CVE-2022-24367/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24366](https://insights.sbomify.com/CVE-2022-24366/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24365](https://insights.sbomify.com/CVE-2022-24365/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24364](https://insights.sbomify.com/CVE-2022-24364/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24363](https://insights.sbomify.com/CVE-2022-24363/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24362](https://insights.sbomify.com/CVE-2022-24362/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24361](https://insights.sbomify.com/CVE-2022-24361/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-24360](https://insights.sbomify.com/CVE-2022-24360/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-2436](https://insights.sbomify.com/CVE-2022-2436/): Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization (high 8.8)
- [CVE-2022-24359](https://insights.sbomify.com/CVE-2022-24359/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24358](https://insights.sbomify.com/CVE-2022-24358/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-24357](https://insights.sbomify.com/CVE-2022-24357/): Use after free in PDF Reader (high 7.8)
- [CVE-2022-24356](https://insights.sbomify.com/CVE-2022-24356/): Memory corruption in PDF Reader (high 7.8)
- [CVE-2022-24355](https://insights.sbomify.com/CVE-2022-24355/): Memory corruption in TL-WR940N (high 8.8)
- [CVE-2022-24354](https://insights.sbomify.com/CVE-2022-24354/): Integer overflow in AC1750 (high 8.8)
- [CVE-2022-24353](https://insights.sbomify.com/CVE-2022-24353/): Memory corruption in AC1750 (high 8.8)
- [CVE-2022-24352](https://insights.sbomify.com/CVE-2022-24352/): Memory corruption in AC1750 (high 8.8)
- [CVE-2022-24351](https://insights.sbomify.com/CVE-2022-24351/): Race condition in insyde:insydeh2o (medium 4.7)
- [CVE-2022-24350](https://insights.sbomify.com/CVE-2022-24350/): Memory corruption in insyde:insydeh2o (medium 5.5)
- [CVE-2022-2435](https://insights.sbomify.com/CVE-2022-2435/): AnyMind Widget <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-24349](https://insights.sbomify.com/CVE-2022-24349/): Reflected XSS in action configuration window of Zabbix Frontend (medium 4.6)
- [CVE-2022-24348](https://insights.sbomify.com/CVE-2022-24348/): Path traversal and dereference of symlinks in Argo CD (high 7.7)
- [CVE-2022-24347](https://insights.sbomify.com/CVE-2022-24347/): Cross-site scripting in jetbrains:youtrack (medium 5.4)
- [CVE-2022-24346](https://insights.sbomify.com/CVE-2022-24346/): Code injection in jetbrains:intellij idea (high 7.8)
- [CVE-2022-24345](https://insights.sbomify.com/CVE-2022-24345/): Code injection in jetbrains:intellij idea (high 7.8)
- [CVE-2022-24344](https://insights.sbomify.com/CVE-2022-24344/): Cross-site scripting in jetbrains:youtrack (medium 5.4)
- [CVE-2022-24343](https://insights.sbomify.com/CVE-2022-24343/): Missing authorization in jetbrains:youtrack (medium 4.3)
- [CVE-2022-24342](https://insights.sbomify.com/CVE-2022-24342/): Cross-site request forgery in jetbrains:teamcity (high 8.8)
- [CVE-2022-24341](https://insights.sbomify.com/CVE-2022-24341/): Auth bypass in jetbrains:teamcity (high 7.5)
- [CVE-2022-24340](https://insights.sbomify.com/CVE-2022-24340/): XML external entity in jetbrains:teamcity (critical 9.8)
- [CVE-2022-2434](https://insights.sbomify.com/CVE-2022-2434/): String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization (high 8.8)
- [CVE-2022-24339](https://insights.sbomify.com/CVE-2022-24339/): Cross-site scripting in jetbrains:teamcity (medium 5.4)
- [CVE-2022-24338](https://insights.sbomify.com/CVE-2022-24338/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2022-24337](https://insights.sbomify.com/CVE-2022-24337/): Missing authorization in jetbrains:teamcity (medium 6.5)
- [CVE-2022-24336](https://insights.sbomify.com/CVE-2022-24336/): Missing authorization in jetbrains:teamcity (medium 5.3)
- [CVE-2022-24335](https://insights.sbomify.com/CVE-2022-24335/): Race condition in jetbrains:teamcity (high 8.1)
- [CVE-2022-24334](https://insights.sbomify.com/CVE-2022-24334/): Missing authorization in jetbrains:teamcity (medium 5.3)
- [CVE-2022-24333](https://insights.sbomify.com/CVE-2022-24333/): Server-side request forgery in jetbrains:teamcity (medium 6.5)
- [CVE-2022-24332](https://insights.sbomify.com/CVE-2022-24332/): Auth bypass in jetbrains:teamcity (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/374/