# Vulnerabilities published in 2022


- [CVE-2022-23852](https://insights.sbomify.com/CVE-2022-23852/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-23851](https://insights.sbomify.com/CVE-2022-23851/): Code injection in netaxis:api orchestrator (critical 9.8)
- [CVE-2022-23850](https://insights.sbomify.com/CVE-2022-23850/): Memory corruption in epub2txt project:epub2txt (high 7.8)
- [CVE-2022-2385](https://insights.sbomify.com/CVE-2022-2385/): AccessKeyID validation bypass (high 8.1)
- [CVE-2022-23849](https://insights.sbomify.com/CVE-2022-23849/): Auth bypass in devolutions:password hub (medium 6.6)
- [CVE-2022-23848](https://insights.sbomify.com/CVE-2022-23848/): Command injection in Alluxio (critical 9.8)
- [CVE-2022-2384](https://insights.sbomify.com/CVE-2022-2384/): Digital Publications by Supsystic < 1.7.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23837](https://insights.sbomify.com/CVE-2022-23837/): Denial of service in sidekiq (high 7.5)
- [CVE-2022-23835](https://insights.sbomify.com/CVE-2022-23835/): Information disclosure in visual voice mail project:visual voice mail (high 8.1)
- [CVE-2022-23833](https://insights.sbomify.com/CVE-2022-23833/): Infinite Loop in Django (high 7.5)
- [CVE-2022-23831](https://insights.sbomify.com/CVE-2022-23831/): Denial of service in AMD μProf (high 7.5)
- [CVE-2022-23830](https://insights.sbomify.com/CVE-2022-23830/): Security feature bypass in 3rd Gen AMD EPYC™ Processors (low 1.9)
- [CVE-2022-2383](https://insights.sbomify.com/CVE-2022-2383/): Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-23829](https://insights.sbomify.com/CVE-2022-23829/): Security feature bypass in 1st Gen AMD EPYC™ Processors (high 8.2)
- [CVE-2022-23826](https://insights.sbomify.com/CVE-2022-23826/): Race condition in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (low 1.8)
- [CVE-2022-23825](https://insights.sbomify.com/CVE-2022-23825/): Information disclosure in AMD Processors (medium 6.5)
- [CVE-2022-23824](https://insights.sbomify.com/CVE-2022-23824/): Information disclosure in AMD Processors (medium 5.5)
- [CVE-2022-23823](https://insights.sbomify.com/CVE-2022-23823/): Information disclosure in AMD Processors (medium 6.5)
- [CVE-2022-23822](https://insights.sbomify.com/CVE-2022-23822/): Security feature bypass in Zynq-7000 SoC FSBL (medium 6.8)
- [CVE-2022-23821](https://insights.sbomify.com/CVE-2022-23821/): Privilege escalation in AMD Ryzen™ Embedded 5000 (critical 9.8)
- [CVE-2022-23820](https://insights.sbomify.com/CVE-2022-23820/): Memory corruption in 3rd Gen AMD EPYC™ Processors (high 7.5)
- [CVE-2022-2382](https://insights.sbomify.com/CVE-2022-2382/): Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options Deletion (medium 4.3)
- [CVE-2022-23818](https://insights.sbomify.com/CVE-2022-23818/): Other in 3rd Gen AMD EPYC™ (high 7.5)
- [CVE-2022-23817](https://insights.sbomify.com/CVE-2022-23817/): Memory corruption in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (high 7.3)
- [CVE-2022-23815](https://insights.sbomify.com/CVE-2022-23815/): Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (high 7.5)
- [CVE-2022-23814](https://insights.sbomify.com/CVE-2022-23814/): Other in 3rd Gen EPYC (medium 5.3)
- [CVE-2022-23813](https://insights.sbomify.com/CVE-2022-23813/): Security feature bypass in 2nd Gen EPYC (medium 5.3)
- [CVE-2022-23812](https://insights.sbomify.com/CVE-2022-23812/): Malicious Package (critical 9.8)
- [CVE-2022-23810](https://insights.sbomify.com/CVE-2022-23810/): Code injection in a-blog cms (medium 6.5)
- [CVE-2022-2381](https://insights.sbomify.com/CVE-2022-2381/): E Unlocked - Student Result <= 1.0.4 - Arbitrary File Upload via CSRF (high 8.8)
- [CVE-2022-23808](https://insights.sbomify.com/CVE-2022-23808/): Cross-site Scripting in phpmyadmin (medium 6.1)
- [CVE-2022-23807](https://insights.sbomify.com/CVE-2022-23807/): Improper Authentication in phpmyadmin (medium 4.3)
- [CVE-2022-23806](https://insights.sbomify.com/CVE-2022-23806/): Weak cryptography in debian:debian linux (critical 9.1)
- [CVE-2022-23805](https://insights.sbomify.com/CVE-2022-23805/): Memory corruption in Trend Micro Worry-Free Business Security (high 7.1)
- [CVE-2022-23804](https://insights.sbomify.com/CVE-2022-23804/): Memory corruption in KiCad (high 7.8)
- [CVE-2022-23803](https://insights.sbomify.com/CVE-2022-23803/): Memory corruption in KiCad (high 7.8)
- [CVE-2022-23802](https://insights.sbomify.com/CVE-2022-23802/): Extension - Insecure Permissions within Joomla Guru extensions (high 7.5)
- [CVE-2022-23801](https://insights.sbomify.com/CVE-2022-23801/): [20220309] - Core - XSS attack vector through SVG (medium 6.1)
- [CVE-2022-23800](https://insights.sbomify.com/CVE-2022-23800/): [20220308] - Core - Inadequate content filtering within the filter code (medium 6.1)
- [CVE-2022-2380](https://insights.sbomify.com/CVE-2022-2380/): Memory corruption in Kernel (medium 5.5)
- [CVE-2022-23799](https://insights.sbomify.com/CVE-2022-23799/): [20220307] - Core - Variable Tampering on JInput $_REQUEST data (critical 9.8)
- [CVE-2022-23798](https://insights.sbomify.com/CVE-2022-23798/): [20220306] - Core - Inadequate validation of internal URLs (medium 6.1)
- [CVE-2022-23797](https://insights.sbomify.com/CVE-2022-23797/): [20220305] - Core - Inadequate filtering on the selected Ids (critical 9.8)
- [CVE-2022-23796](https://insights.sbomify.com/CVE-2022-23796/): [20220304] - Core - Missing input validation within com_fields class inputs (medium 6.1)
- [CVE-2022-23795](https://insights.sbomify.com/CVE-2022-23795/): [20220303] - Core - User row are not bound to a authentication mechanism (critical 9.8)
- [CVE-2022-23794](https://insights.sbomify.com/CVE-2022-23794/): [20220302] - Core - Path Disclosure within filesystem error messages (medium 5.3)
- [CVE-2022-23793](https://insights.sbomify.com/CVE-2022-23793/): [20220301] - Core - Zip Slip within the Tar extractor (high 7.5)
- [CVE-2022-23791](https://insights.sbomify.com/CVE-2022-23791/): XSS in Firmanet Software and Technology Customer Relation Manager (medium 6.1)
- [CVE-2022-23790](https://insights.sbomify.com/CVE-2022-23790/): XSS in Firmanet Software and Technology Customer Relation Manager (medium 6.1)
- [CVE-2022-2379](https://insights.sbomify.com/CVE-2022-2379/): Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API (high 7.5)
- [CVE-2022-2378](https://insights.sbomify.com/CVE-2022-2378/): Easy Student Results <= 2.2.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-23779](https://insights.sbomify.com/CVE-2022-23779/): Information disclosure in zohocorp:manageengine desktop central (medium 5.3)
- [CVE-2022-23775](https://insights.sbomify.com/CVE-2022-23775/): Missing authorization in truestack:direct connect (critical 9.8)
- [CVE-2022-23774](https://insights.sbomify.com/CVE-2022-23774/): Other in docker:docker desktop (medium 5.3)
- [CVE-2022-23773](https://insights.sbomify.com/CVE-2022-23773/): Security feature bypass in golang:go (high 7.5)
- [CVE-2022-23772](https://insights.sbomify.com/CVE-2022-23772/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2022-23771](https://insights.sbomify.com/CVE-2022-23771/): IPTIME NAS1DUAL CSRF Vulnerability (high 8.0)
- [CVE-2022-23770](https://insights.sbomify.com/CVE-2022-23770/): WISA Smart Wing CMS Remote Command Execution Vulnerability (high 8.8)
- [CVE-2022-2377](https://insights.sbomify.com/CVE-2022-2377/): Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending (medium 4.3)
- [CVE-2022-23769](https://insights.sbomify.com/CVE-2022-23769/): Secuever reverseWall-MDS Remote Code Execution Vulnerability (high 7.5)
- [CVE-2022-23768](https://insights.sbomify.com/CVE-2022-23768/): Neo Information Sys. NIS-HAP11AC remote access and manipulation vulnerability (high 8.8)
- [CVE-2022-23767](https://insights.sbomify.com/CVE-2022-23767/): SecureGate authentication bypass vulnerability (high 8.8)
- [CVE-2022-23766](https://insights.sbomify.com/CVE-2022-23766/): BigFileAgent arbitrary file execution vulnerability (high 7.8)
- [CVE-2022-23765](https://insights.sbomify.com/CVE-2022-23765/): IPTIME NAS family CSRF vulnerability (high 8.0)
- [CVE-2022-23764](https://insights.sbomify.com/CVE-2022-23764/): TERUTEN WebCube update remote code execution vulnerability (high 8.8)
- [CVE-2022-23763](https://insights.sbomify.com/CVE-2022-23763/): DOUZONE BIZON NeoRS file download and execute vulnerability (high 7.8)
- [CVE-2022-2376](https://insights.sbomify.com/CVE-2022-2376/): Directorist < 7.3.1 - Unauthenticated Email Address Disclosure (medium 5.3)
- [CVE-2022-2375](https://insights.sbomify.com/CVE-2022-2375/): WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS (medium 5.4)
- [CVE-2022-23748](https://insights.sbomify.com/CVE-2022-23748/): Dante Discovery Process Control (high 7.8, exploited in the wild)
- [CVE-2022-23747](https://insights.sbomify.com/CVE-2022-23747/): Memory corruption in Sony Xperia (critical 9.8)
- [CVE-2022-23746](https://insights.sbomify.com/CVE-2022-23746/): Auth bypass in Gateway & Management, IPsec VPN blade SNX portal. (high 7.5)
- [CVE-2022-23745](https://insights.sbomify.com/CVE-2022-23745/): Memory corruption in Checkpoint Harmony Capsule Workspace (high 7.5)
- [CVE-2022-23744](https://insights.sbomify.com/CVE-2022-23744/): Security feature bypass in Enterprise Endpoint Security Windows Clients. (low 2.3)
- [CVE-2022-23743](https://insights.sbomify.com/CVE-2022-23743/): Privilege escalation in ZoneAlarm. (high 7.8)
- [CVE-2022-23742](https://insights.sbomify.com/CVE-2022-23742/): Privilege escalation in Check Point Endpoint Security Client for Windows (high 7.8)
- [CVE-2022-23741](https://insights.sbomify.com/CVE-2022-23741/): Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access (high 7.2)
- [CVE-2022-23740](https://insights.sbomify.com/CVE-2022-23740/): Command injection in GitHub Enterprise Server (high 8.8)
- [CVE-2022-2374](https://insights.sbomify.com/CVE-2022-2374/): Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23739](https://insights.sbomify.com/CVE-2022-23739/): Missing authorization in GitHub Enterprise Server (critical 9.8)
- [CVE-2022-23738](https://insights.sbomify.com/CVE-2022-23738/): Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files (medium 5.7)
- [CVE-2022-23737](https://insights.sbomify.com/CVE-2022-23737/): Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion (medium 6.5)
- [CVE-2022-23734](https://insights.sbomify.com/CVE-2022-23734/): Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution (high 8.8)
- [CVE-2022-23733](https://insights.sbomify.com/CVE-2022-23733/): Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes (medium 5.4)
- [CVE-2022-23732](https://insights.sbomify.com/CVE-2022-23732/): Path traversal in GitHub Enterprise Server management console leading to a bypass of CSRF protections (high 8.8)
- [CVE-2022-23731](https://insights.sbomify.com/CVE-2022-23731/): Memory corruption in LG webOS TV (high 7.8)
- [CVE-2022-23730](https://insights.sbomify.com/CVE-2022-23730/): Security feature bypass in LG webOS TV (critical 9.8)
- [CVE-2022-2373](https://insights.sbomify.com/CVE-2022-2373/): Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address Disclosure (medium 5.3)
- [CVE-2022-23729](https://insights.sbomify.com/CVE-2022-23729/): Auth bypass in LG mobile devices (high 7.8)
- [CVE-2022-23728](https://insights.sbomify.com/CVE-2022-23728/): Security feature bypass in LG mobile devices (medium 6.1)
- [CVE-2022-23727](https://insights.sbomify.com/CVE-2022-23727/): Privilege escalation in lg:webos (high 7.8)
- [CVE-2022-23726](https://insights.sbomify.com/CVE-2022-23726/): Information disclosure in PingCentral (medium 5.4)
- [CVE-2022-23725](https://insights.sbomify.com/CVE-2022-23725/): Misconfiguration in PingID Windows Login (high 7.7)
- [CVE-2022-23724](https://insights.sbomify.com/CVE-2022-23724/): PingID Integration for Windows Login MFA Bypass (medium 6.4)
- [CVE-2022-23723](https://insights.sbomify.com/CVE-2022-23723/): PingFederate PingOneMFA Integration Kit MFA Bypass (high 7.7)
- [CVE-2022-23722](https://insights.sbomify.com/CVE-2022-23722/): PingFederate Password Reset via Authentication API Mishandling (medium 6.5)
- [CVE-2022-23721](https://insights.sbomify.com/CVE-2022-23721/): PingID integration for Windows login duplicate username collision. (low 3.8)
- [CVE-2022-23720](https://insights.sbomify.com/CVE-2022-23720/): Misconfiguration in PingID Windows Login (high 7.5)
- [CVE-2022-2372](https://insights.sbomify.com/CVE-2022-2372/): YaySMTP < 2.2.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23719](https://insights.sbomify.com/CVE-2022-23719/): Auth bypass in PingID Windows Login (high 7.2)
- [CVE-2022-23718](https://insights.sbomify.com/CVE-2022-23718/): PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/379/