# Vulnerabilities published in 2022


- [CVE-2022-24193](https://insights.sbomify.com/CVE-2022-24193/): Command Injection in CasaOS (critical 9.8)
- [CVE-2022-24191](https://insights.sbomify.com/CVE-2022-24191/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2022-24190](https://insights.sbomify.com/CVE-2022-24190/): Missing authorization in sz-fujia:ourphoto (high 7.5)
- [CVE-2022-2419](https://insights.sbomify.com/CVE-2022-2419/): URVE Web Manager upload.php unrestricted upload (high 8.0)
- [CVE-2022-24189](https://insights.sbomify.com/CVE-2022-24189/): Auth bypass in sz-fujia:ourphoto (medium 6.5)
- [CVE-2022-24188](https://insights.sbomify.com/CVE-2022-24188/): Information disclosure in sz-fujia:ourphoto (high 7.5)
- [CVE-2022-24187](https://insights.sbomify.com/CVE-2022-24187/): Missing authorization in sz-fujia:ourphoto (high 7.5)
- [CVE-2022-24181](https://insights.sbomify.com/CVE-2022-24181/): Cross-site scripting in public knowledge project:open journal systems (medium 6.1)
- [CVE-2022-2418](https://insights.sbomify.com/CVE-2022-2418/): URVE Web Manager img_upload.php unrestricted upload (high 8.0)
- [CVE-2022-24177](https://insights.sbomify.com/CVE-2022-24177/): Cross-site scripting in exlibrisgroup:aleph 500 (medium 6.1)
- [CVE-2022-24172](https://insights.sbomify.com/CVE-2022-24172/): Memory corruption in tendacn:g1 firmware (high 7.5)
- [CVE-2022-24171](https://insights.sbomify.com/CVE-2022-24171/): Command injection in tendacn:g1 firmware (critical 9.8)
- [CVE-2022-24170](https://insights.sbomify.com/CVE-2022-24170/): Command injection in tendacn:g1 firmware (critical 9.8)
- [CVE-2022-2417](https://insights.sbomify.com/CVE-2022-2417/): Other in GitLab (medium 6.2)
- [CVE-2022-24169](https://insights.sbomify.com/CVE-2022-24169/): Memory corruption in tendacn:g1 firmware (high 7.5)
- [CVE-2022-24168](https://insights.sbomify.com/CVE-2022-24168/): Command injection in tendacn:g1 firmware (critical 9.8)
- [CVE-2022-24167](https://insights.sbomify.com/CVE-2022-24167/): Command injection in tendacn:g1 firmware (critical 9.8)
- [CVE-2022-24166](https://insights.sbomify.com/CVE-2022-24166/): Memory corruption in tendacn:g1 firmware (high 7.5)
- [CVE-2022-24165](https://insights.sbomify.com/CVE-2022-24165/): Command injection in tendacn:g1 firmware (critical 9.8)
- [CVE-2022-24164](https://insights.sbomify.com/CVE-2022-24164/): Memory corruption in tendacn:g1 firmware (high 7.5)
- [CVE-2022-24163](https://insights.sbomify.com/CVE-2022-24163/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24162](https://insights.sbomify.com/CVE-2022-24162/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24161](https://insights.sbomify.com/CVE-2022-24161/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24160](https://insights.sbomify.com/CVE-2022-24160/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-2416](https://insights.sbomify.com/CVE-2022-2416/): Server-side request forgery in Octopus Server (medium 5.5)
- [CVE-2022-24159](https://insights.sbomify.com/CVE-2022-24159/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24158](https://insights.sbomify.com/CVE-2022-24158/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24157](https://insights.sbomify.com/CVE-2022-24157/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24156](https://insights.sbomify.com/CVE-2022-24156/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24155](https://insights.sbomify.com/CVE-2022-24155/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24154](https://insights.sbomify.com/CVE-2022-24154/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24153](https://insights.sbomify.com/CVE-2022-24153/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24152](https://insights.sbomify.com/CVE-2022-24152/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24151](https://insights.sbomify.com/CVE-2022-24151/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24150](https://insights.sbomify.com/CVE-2022-24150/): Command injection in tenda:ax3 firmware (critical 9.8)
- [CVE-2022-2415](https://insights.sbomify.com/CVE-2022-2415/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-24149](https://insights.sbomify.com/CVE-2022-24149/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24148](https://insights.sbomify.com/CVE-2022-24148/): Command injection in tenda:ax3 firmware (critical 9.8)
- [CVE-2022-24147](https://insights.sbomify.com/CVE-2022-24147/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24146](https://insights.sbomify.com/CVE-2022-24146/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24145](https://insights.sbomify.com/CVE-2022-24145/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24144](https://insights.sbomify.com/CVE-2022-24144/): Command injection in tenda:ax3 firmware (critical 9.8)
- [CVE-2022-24143](https://insights.sbomify.com/CVE-2022-24143/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2022-24142](https://insights.sbomify.com/CVE-2022-24142/): Memory corruption in tenda:ax3 firmware (high 7.5)
- [CVE-2022-24141](https://insights.sbomify.com/CVE-2022-24141/): Privilege escalation in iobit:itop vpn (medium 5.4)
- [CVE-2022-24140](https://insights.sbomify.com/CVE-2022-24140/): Supply chain in iobit:advanced system care (medium 6.6)
- [CVE-2022-2414](https://insights.sbomify.com/CVE-2022-2414/): XML external entity in Dogtag PKI (high 7.5)
- [CVE-2022-24139](https://insights.sbomify.com/CVE-2022-24139/): Privilege escalation in iobit:advanced system care (high 7.8)
- [CVE-2022-24138](https://insights.sbomify.com/CVE-2022-24138/): Privilege escalation in iobit:advanced systemcare (high 7.8)
- [CVE-2022-24136](https://insights.sbomify.com/CVE-2022-24136/): File upload in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-24135](https://insights.sbomify.com/CVE-2022-24135/): Cross-site scripting in qingscan project:qingscan (medium 6.1)
- [CVE-2022-24132](https://insights.sbomify.com/CVE-2022-24132/): Denial of service in phpshe:phpshe (high 7.5)
- [CVE-2022-24131](https://insights.sbomify.com/CVE-2022-24131/): Cross-site scripting in douco:douphp (medium 6.1)
- [CVE-2022-24130](https://insights.sbomify.com/CVE-2022-24130/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-2413](https://insights.sbomify.com/CVE-2022-2413/): Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title (medium 5.4)
- [CVE-2022-24129](https://insights.sbomify.com/CVE-2022-24129/): Server-side request forgery in shibboleth:oidc op (high 8.2)
- [CVE-2022-24128](https://insights.sbomify.com/CVE-2022-24128/): Privilege escalation in timescale:timescaledb (high 8.0)
- [CVE-2022-24127](https://insights.sbomify.com/CVE-2022-24127/): Cross-site scripting in vanderbilt:redcap (medium 5.4)
- [CVE-2022-24126](https://insights.sbomify.com/CVE-2022-24126/): Memory corruption in fromsoftware:dark souls iii (critical 9.8)
- [CVE-2022-24125](https://insights.sbomify.com/CVE-2022-24125/): Missing authorization in fromsoftware:dark souls iii (high 8.8)
- [CVE-2022-24124](https://insights.sbomify.com/CVE-2022-24124/): SQL Injection in Casdoor (high 7.5)
- [CVE-2022-24123](https://insights.sbomify.com/CVE-2022-24123/): Cross-site scripting in marktext:marktext (critical 9.0)
- [CVE-2022-24122](https://insights.sbomify.com/CVE-2022-24122/): Use after free in fedoraproject:fedora (high 7.8)
- [CVE-2022-24121](https://insights.sbomify.com/CVE-2022-24121/): SQL injection in unifiedoffice:total connect now (high 7.5)
- [CVE-2022-24120](https://insights.sbomify.com/CVE-2022-24120/): Information disclosure in ge:inet 900 firmware (medium 4.6)
- [CVE-2022-2412](https://insights.sbomify.com/CVE-2022-2412/): Better Tag Cloud <= 0.99.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24119](https://insights.sbomify.com/CVE-2022-24119/): Auth bypass in ge:inet 900 firmware (critical 9.8)
- [CVE-2022-24118](https://insights.sbomify.com/CVE-2022-24118/): Denial of service in ge:inet 900 firmware (critical 9.1)
- [CVE-2022-24117](https://insights.sbomify.com/CVE-2022-24117/): Security feature bypass in ge:inet 900 firmware (critical 9.8)
- [CVE-2022-24116](https://insights.sbomify.com/CVE-2022-24116/): Weak cryptography in ge:inet 900 firmware (critical 9.8)
- [CVE-2022-24115](https://insights.sbomify.com/CVE-2022-24115/): Local privilege escalation due to unrestricted loading of unsigned libraries (high 7.8)
- [CVE-2022-24114](https://insights.sbomify.com/CVE-2022-24114/): Local privilege escalation due to race condition on application startup (high 7.0)
- [CVE-2022-24113](https://insights.sbomify.com/CVE-2022-24113/): Local privilege escalation due to excessive permissions assigned to child processes (high 7.8)
- [CVE-2022-24112](https://insights.sbomify.com/CVE-2022-24112/): Apache APISIX Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2022-24111](https://insights.sbomify.com/CVE-2022-24111/): Missing authorization in mahara:mahara (medium 5.3)
- [CVE-2022-24110](https://insights.sbomify.com/CVE-2022-24110/): Missing authorization in accellion:managed file transfer (medium 6.5)
- [CVE-2022-2411](https://insights.sbomify.com/CVE-2022-2411/): Auto More Tag <= 4.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24109](https://insights.sbomify.com/CVE-2022-24109/): Business logic in opennetworking:onos (medium 6.5)
- [CVE-2022-24108](https://insights.sbomify.com/CVE-2022-24108/): Deserialization in skyoftech:so listing tabs (critical 9.8)
- [CVE-2022-24107](https://insights.sbomify.com/CVE-2022-24107/): Integer overflow in glyphandcog:xpdfreader (high 7.8)
- [CVE-2022-24106](https://insights.sbomify.com/CVE-2022-24106/): Integer overflow in glyphandcog:xpdfreader (high 7.8)
- [CVE-2022-24105](https://insights.sbomify.com/CVE-2022-24105/): Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24104](https://insights.sbomify.com/CVE-2022-24104/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24103](https://insights.sbomify.com/CVE-2022-24103/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24102](https://insights.sbomify.com/CVE-2022-24102/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24101](https://insights.sbomify.com/CVE-2022-24101/): Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2022-2410](https://insights.sbomify.com/CVE-2022-2410/): mTouch Quiz <= 3.1.3 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-24099](https://insights.sbomify.com/CVE-2022-24099/): Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2022-24098](https://insights.sbomify.com/CVE-2022-24098/): Adobe Photoshop PCX File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24097](https://insights.sbomify.com/CVE-2022-24097/): Adobe After Effects Out-of-bounds Write could lead to Arbitrary code execution (high 7.8)
- [CVE-2022-24096](https://insights.sbomify.com/CVE-2022-24096/): Adobe After Effects Heap-based Buffer Overflow Arbitrary code execution (high 7.8)
- [CVE-2022-24095](https://insights.sbomify.com/CVE-2022-24095/): Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution (high 7.8)
- [CVE-2022-24094](https://insights.sbomify.com/CVE-2022-24094/): Adobe After Effects Stack-based Buffer Overflow Arbitrary code execution (high 7.8)
- [CVE-2022-24093](https://insights.sbomify.com/CVE-2022-24093/): Adobe Commerce post-auth improper input validation leads to remote code execution (critical 9.1)
- [CVE-2022-24092](https://insights.sbomify.com/CVE-2022-24092/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24091](https://insights.sbomify.com/CVE-2022-24091/): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-24090](https://insights.sbomify.com/CVE-2022-24090/): Adobe Photoshop 2022 Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-2409](https://insights.sbomify.com/CVE-2022-2409/): Rough Chart <= 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-24086](https://insights.sbomify.com/CVE-2022-24086/): Adobe Commerce and Magento Open Source Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2022-24083](https://insights.sbomify.com/CVE-2022-24083/): Auth bypass in Pega Infinity (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/376/