# Vulnerabilities published in 2022


- [CVE-2022-24331](https://insights.sbomify.com/CVE-2022-24331/): Auth bypass in jetbrains:teamcity (critical 9.8)
- [CVE-2022-24330](https://insights.sbomify.com/CVE-2022-24330/): Open redirect in jetbrains:teamcity (medium 6.1)
- [CVE-2022-2433](https://insights.sbomify.com/CVE-2022-2433/): WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization (high 7.5)
- [CVE-2022-24329](https://insights.sbomify.com/CVE-2022-24329/): Improper Locking in JetBrains Kotlin (medium 5.3)
- [CVE-2022-24328](https://insights.sbomify.com/CVE-2022-24328/): Denial of service in jetbrains:hub (medium 6.5)
- [CVE-2022-24327](https://insights.sbomify.com/CVE-2022-24327/): Misconfiguration in jetbrains:hub (high 7.5)
- [CVE-2022-24324](https://insights.sbomify.com/CVE-2022-24324/): Memory corruption in IGSS Data Server (IGSSdataServer.exe) (critical 9.8)
- [CVE-2022-24323](https://insights.sbomify.com/CVE-2022-24323/): Denial of service in EcoStruxure Control Expert (medium 5.3)
- [CVE-2022-24322](https://insights.sbomify.com/CVE-2022-24322/): Memory corruption in EcoStruxure Control Expert (medium 5.3)
- [CVE-2022-24321](https://insights.sbomify.com/CVE-2022-24321/): Denial of service in ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) (high 7.5)
- [CVE-2022-24320](https://insights.sbomify.com/CVE-2022-24320/): Weak cryptography in ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) (medium 5.9)
- [CVE-2022-2432](https://insights.sbomify.com/CVE-2022-2432/): Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update (high 8.8)
- [CVE-2022-24319](https://insights.sbomify.com/CVE-2022-24319/): Security feature bypass in ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) (medium 5.9)
- [CVE-2022-24318](https://insights.sbomify.com/CVE-2022-24318/): Weak cryptography in ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) (high 7.5)
- [CVE-2022-24317](https://insights.sbomify.com/CVE-2022-24317/): Missing authorization in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (high 7.5)
- [CVE-2022-24316](https://insights.sbomify.com/CVE-2022-24316/): Information disclosure in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (high 7.5)
- [CVE-2022-24315](https://insights.sbomify.com/CVE-2022-24315/): Memory corruption in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (high 7.5)
- [CVE-2022-24314](https://insights.sbomify.com/CVE-2022-24314/): Memory corruption in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (high 7.5)
- [CVE-2022-24313](https://insights.sbomify.com/CVE-2022-24313/): Memory corruption in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (critical 9.8)
- [CVE-2022-24312](https://insights.sbomify.com/CVE-2022-24312/): Path traversal in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (critical 9.8)
- [CVE-2022-24311](https://insights.sbomify.com/CVE-2022-24311/): Path traversal in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (critical 9.8)
- [CVE-2022-24310](https://insights.sbomify.com/CVE-2022-24310/): Integer overflow in Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) (critical 9.8)
- [CVE-2022-2431](https://insights.sbomify.com/CVE-2022-2431/): Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion (high 8.1)
- [CVE-2022-24309](https://insights.sbomify.com/CVE-2022-24309/): Missing authorization in Mendix Runtime V7 (medium 6.8)
- [CVE-2022-24308](https://insights.sbomify.com/CVE-2022-24308/): Information disclosure in automox:automox (medium 5.5)
- [CVE-2022-24307](https://insights.sbomify.com/CVE-2022-24307/): Missing authorization in joinmastodon:mastodon (critical 9.8)
- [CVE-2022-24306](https://insights.sbomify.com/CVE-2022-24306/): Missing authorization in zohocorp:manageengine sharepoint manager plus (critical 9.8)
- [CVE-2022-24305](https://insights.sbomify.com/CVE-2022-24305/): Information disclosure in zohocorp:manageengine sharepoint manager plus (critical 9.8)
- [CVE-2022-24303](https://insights.sbomify.com/CVE-2022-24303/): Path traversal in Pillow (critical 9.1)
- [CVE-2022-24302](https://insights.sbomify.com/CVE-2022-24302/): Race Condition in Paramiko (medium 5.9)
- [CVE-2022-24301](https://insights.sbomify.com/CVE-2022-24301/): Missing authorization in debian:debian linux (medium 6.5)
- [CVE-2022-24300](https://insights.sbomify.com/CVE-2022-24300/): Other in debian:debian linux (critical 9.8)
- [CVE-2022-2430](https://insights.sbomify.com/CVE-2022-2430/): Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block' (medium 6.4)
- [CVE-2022-24299](https://insights.sbomify.com/CVE-2022-24299/): Command injection in pfSense CE and pfSense Plus (high 8.8)
- [CVE-2022-24298](https://insights.sbomify.com/CVE-2022-24298/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-24297](https://insights.sbomify.com/CVE-2022-24297/): Memory corruption in Intel(R) NUCs (medium 6.7)
- [CVE-2022-24296](https://insights.sbomify.com/CVE-2022-24296/): Weak cryptography in Air Conditioning System G-150AD; Air Conditioning System AG-150A-A; Air Conditioning System AG-150A-J; Air Conditioning System GB-50AD; Air Conditioning System GB-50ADA-A; Air Conditioning System GB-50ADA-J; Air Conditioning System EB-50GU-A; Air Conditioning System EB-50GU-J; Air Conditioning System AE-200J; Air Conditioning System AE-200A; Air Conditioning System AE-200E; Air Conditioning System AE-50J; Air Conditioning System AE-50A; Air Conditioning System AE-50E; Air Conditioning System EW-50J; Air Conditioning System EW-50A; Air Conditioning System EW-50E; Air Conditioning System TE-200A; Air Conditioning System TE-50A; Air Conditioning System TW-50A (high 7.5)
- [CVE-2022-24295](https://insights.sbomify.com/CVE-2022-24295/): Command injection in Okta Advanced Server Access Client (high 8.8)
- [CVE-2022-24294](https://insights.sbomify.com/CVE-2022-24294/): ReDoS in Apache MXNet RTC Module (high 7.5)
- [CVE-2022-24293](https://insights.sbomify.com/CVE-2022-24293/): Other in HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Officejet Printers (critical 9.8)
- [CVE-2022-24292](https://insights.sbomify.com/CVE-2022-24292/): Other in HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Officejet Printers (critical 9.8)
- [CVE-2022-24291](https://insights.sbomify.com/CVE-2022-24291/): Other in HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Officejet Printers (high 7.5)
- [CVE-2022-24290](https://insights.sbomify.com/CVE-2022-24290/): Memory corruption in Teamcenter V12.4 (high 7.5)
- [CVE-2022-2429](https://insights.sbomify.com/CVE-2022-2429/): Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection (medium 6.5)
- [CVE-2022-24289](https://insights.sbomify.com/CVE-2022-24289/): Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions (high 8.8)
- [CVE-2022-24288](https://insights.sbomify.com/CVE-2022-24288/): Apache Airflow: RCE in example DAGs (high 8.8)
- [CVE-2022-24287](https://insights.sbomify.com/CVE-2022-24287/): Security feature bypass in SIMATIC PCS 7 V8.2 (high 7.8)
- [CVE-2022-24286](https://insights.sbomify.com/CVE-2022-24286/): Privilege escalation in acer:quickaccess (high 7.8)
- [CVE-2022-24285](https://insights.sbomify.com/CVE-2022-24285/): Privilege escalation in acer:care center (high 7.8)
- [CVE-2022-24282](https://insights.sbomify.com/CVE-2022-24282/): Deserialization in SINEC NMS (high 7.2)
- [CVE-2022-24281](https://insights.sbomify.com/CVE-2022-24281/): SQL injection in SINEC NMS (high 7.2)
- [CVE-2022-24280](https://insights.sbomify.com/CVE-2022-24280/): Apache Pulsar Proxy target broker address isn't validated (medium 6.5)
- [CVE-2022-2428](https://insights.sbomify.com/CVE-2022-2428/): Cross-site scripting in GitLab (medium 6.4)
- [CVE-2022-24279](https://insights.sbomify.com/CVE-2022-24279/): Prototype Pollution (high 7.5)
- [CVE-2022-24278](https://insights.sbomify.com/CVE-2022-24278/): Directory Traversal (high 7.5)
- [CVE-2022-24272](https://insights.sbomify.com/CVE-2022-24272/): MongoDB Server (mongod) may crash in response to unexpected requests (medium 6.5)
- [CVE-2022-24266](https://insights.sbomify.com/CVE-2022-24266/): SQL injection in cuppacms:cuppacms (high 7.5)
- [CVE-2022-24265](https://insights.sbomify.com/CVE-2022-24265/): SQL injection in cuppacms:cuppacms (high 7.5)
- [CVE-2022-24264](https://insights.sbomify.com/CVE-2022-24264/): SQL injection in cuppacms:cuppacms (high 7.5)
- [CVE-2022-24263](https://insights.sbomify.com/CVE-2022-24263/): SQL injection in phpgurukul:hospital management system (critical 9.8)
- [CVE-2022-24262](https://insights.sbomify.com/CVE-2022-24262/): File upload in voipmonitor:voipmonitor (high 8.8)
- [CVE-2022-24260](https://insights.sbomify.com/CVE-2022-24260/): SQL injection in voipmonitor:voipmonitor (critical 9.8)
- [CVE-2022-2426](https://insights.sbomify.com/CVE-2022-2426/): Thinkific Uploader <= 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24259](https://insights.sbomify.com/CVE-2022-24259/): Auth bypass in voipmonitor:voipmonitor (critical 9.8)
- [CVE-2022-24255](https://insights.sbomify.com/CVE-2022-24255/): Hardcoded credentials in extensis:portfolio (high 8.8)
- [CVE-2022-24254](https://insights.sbomify.com/CVE-2022-24254/): File upload in extensis:portfolio (high 8.8)
- [CVE-2022-24253](https://insights.sbomify.com/CVE-2022-24253/): File upload in extensis:portfolio (high 8.8)
- [CVE-2022-24252](https://insights.sbomify.com/CVE-2022-24252/): File upload in extensis:portfolio (high 8.8)
- [CVE-2022-24251](https://insights.sbomify.com/CVE-2022-24251/): File upload in extensis:portfolio (high 8.8)
- [CVE-2022-2425](https://insights.sbomify.com/CVE-2022-2425/): WP DS Blog Map <= 3.1.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24249](https://insights.sbomify.com/CVE-2022-24249/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2022-24248](https://insights.sbomify.com/CVE-2022-24248/): Path traversal in ritecms:ritecms (medium 6.5)
- [CVE-2022-24247](https://insights.sbomify.com/CVE-2022-24247/): Path traversal in ritecms:ritecms (medium 6.5)
- [CVE-2022-24241](https://insights.sbomify.com/CVE-2022-24241/): Path traversal in aceware:aceweb online portal (high 7.5)
- [CVE-2022-24240](https://insights.sbomify.com/CVE-2022-24240/): SQL injection in aceware:aceweb online portal (critical 9.8)
- [CVE-2022-2424](https://insights.sbomify.com/CVE-2022-2424/): Google Maps Anywhere <= 1.2.6.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24239](https://insights.sbomify.com/CVE-2022-24239/): File upload in aceware:aceweb online portal (critical 9.8)
- [CVE-2022-24238](https://insights.sbomify.com/CVE-2022-24238/): Cross-site scripting in aceware:aceweb online portal (medium 6.1)
- [CVE-2022-24237](https://insights.sbomify.com/CVE-2022-24237/): Command injection in snapt:aria (high 8.8)
- [CVE-2022-24236](https://insights.sbomify.com/CVE-2022-24236/): Missing authorization in snapt:aria (low 3.5)
- [CVE-2022-24235](https://insights.sbomify.com/CVE-2022-24235/): Cross-site request forgery in snapt:aria (high 8.8)
- [CVE-2022-24232](https://insights.sbomify.com/CVE-2022-24232/): Path traversal in hospital\'s patient records management system project:hospital\'s patient records management system (high 7.8)
- [CVE-2022-24231](https://insights.sbomify.com/CVE-2022-24231/): SQL injection in simple student information system project:simple student information system (critical 9.8)
- [CVE-2022-2423](https://insights.sbomify.com/CVE-2022-2423/): DW Promobar <= 1.0.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24229](https://insights.sbomify.com/CVE-2022-24229/): Cross-site scripting in onlyoffice:document server (medium 6.1)
- [CVE-2022-24227](https://insights.sbomify.com/CVE-2022-24227/): Cross-site scripting in boltwire:boltwire (medium 6.1)
- [CVE-2022-24226](https://insights.sbomify.com/CVE-2022-24226/): SQL injection in phpgurukul:hospital management system (high 7.5)
- [CVE-2022-24223](https://insights.sbomify.com/CVE-2022-24223/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-24222](https://insights.sbomify.com/CVE-2022-24222/): SQL injection in elitecms:elite cms (critical 9.8)
- [CVE-2022-24221](https://insights.sbomify.com/CVE-2022-24221/): SQL injection in elitecms:elite cms (critical 9.8)
- [CVE-2022-24220](https://insights.sbomify.com/CVE-2022-24220/): SQL injection in elitecms:elite cms (critical 9.8)
- [CVE-2022-2422](https://insights.sbomify.com/CVE-2022-2422/): Feathers - SQL injection via attribute aliases (critical 10.0)
- [CVE-2022-24219](https://insights.sbomify.com/CVE-2022-24219/): SQL injection in elitecms:elite cms (critical 9.8)
- [CVE-2022-24218](https://insights.sbomify.com/CVE-2022-24218/): Path traversal in elitecms:elite cms (critical 9.1)
- [CVE-2022-2421](https://insights.sbomify.com/CVE-2022-2421/): Socket.io - Improper type validation in attachment parsing (critical 10.0)
- [CVE-2022-24206](https://insights.sbomify.com/CVE-2022-24206/): SQL injection in tongda2000:tongda office anywhere (critical 9.8)
- [CVE-2022-2420](https://insights.sbomify.com/CVE-2022-2420/): URVE Web Manager uploader.php unrestricted upload (high 8.0)
- [CVE-2022-24198](https://insights.sbomify.com/CVE-2022-24198/): Out-of-bounds Read in iText (medium 6.5)
- [CVE-2022-24197](https://insights.sbomify.com/CVE-2022-24197/): Out-of-bounds Write in iText (medium 6.5)
- [CVE-2022-24196](https://insights.sbomify.com/CVE-2022-24196/): Allocation of Resources Without Limits or Throttling in iText (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/375/