# Vulnerabilities published in 2022


- [CVE-2022-23717](https://insights.sbomify.com/CVE-2022-23717/): PingID Windows Login prior to 2.8 denial of service condition (medium 5.0)
- [CVE-2022-23716](https://insights.sbomify.com/CVE-2022-23716/): Information disclosure in Elastic Cloud Enterprise (medium 5.3)
- [CVE-2022-23715](https://insights.sbomify.com/CVE-2022-23715/): Information disclosure in Elastic Cloud Enterprise (medium 6.5)
- [CVE-2022-23714](https://insights.sbomify.com/CVE-2022-23714/): Privilege escalation in Endpoint Security (high 7.8)
- [CVE-2022-23713](https://insights.sbomify.com/CVE-2022-23713/): Cross-site scripting in kibana (medium 6.1)
- [CVE-2022-23712](https://insights.sbomify.com/CVE-2022-23712/): Improper Check for Unusual or Exceptional Conditions in Elasticsearch (high 7.5)
- [CVE-2022-23711](https://insights.sbomify.com/CVE-2022-23711/): Information disclosure in kibana (medium 5.3)
- [CVE-2022-23710](https://insights.sbomify.com/CVE-2022-23710/): Cross-site scripting in kibana (medium 6.1)
- [CVE-2022-2371](https://insights.sbomify.com/CVE-2022-2371/): YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-23709](https://insights.sbomify.com/CVE-2022-23709/): Missing authorization in kibana (medium 4.3)
- [CVE-2022-23708](https://insights.sbomify.com/CVE-2022-23708/): Elasticsearch privilege escalation (medium 4.3)
- [CVE-2022-23707](https://insights.sbomify.com/CVE-2022-23707/): Cross-site scripting in Kibana (medium 5.4)
- [CVE-2022-23706](https://insights.sbomify.com/CVE-2022-23706/): Cross-site scripting in HPE OneView (medium 6.1)
- [CVE-2022-23705](https://insights.sbomify.com/CVE-2022-23705/): Security feature bypass in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays (high 7.5)
- [CVE-2022-23704](https://insights.sbomify.com/CVE-2022-23704/): Denial of service in HPE Integrated Lights-Out 4 (iLO 4) (high 7.5)
- [CVE-2022-23703](https://insights.sbomify.com/CVE-2022-23703/): Other in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays (high 7.5)
- [CVE-2022-23702](https://insights.sbomify.com/CVE-2022-23702/): Privilege escalation in HPE Superdome Flex Server; HPE Superdome Flex 280 Server (medium 6.7)
- [CVE-2022-23701](https://insights.sbomify.com/CVE-2022-23701/): Open redirect in HPE Integrated Lights-Out 4 (iLO 4) (medium 5.3)
- [CVE-2022-23700](https://insights.sbomify.com/CVE-2022-23700/): Information disclosure in HPE OneView (medium 5.5)
- [CVE-2022-2370](https://insights.sbomify.com/CVE-2022-2370/): YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak (medium 6.5)
- [CVE-2022-23699](https://insights.sbomify.com/CVE-2022-23699/): Auth bypass in HPE OneView (high 7.8)
- [CVE-2022-23698](https://insights.sbomify.com/CVE-2022-23698/): Information disclosure in HPE OneView (high 7.5)
- [CVE-2022-23697](https://insights.sbomify.com/CVE-2022-23697/): Cross-site scripting in HPE OneView (medium 6.1)
- [CVE-2022-23696](https://insights.sbomify.com/CVE-2022-23696/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23695](https://insights.sbomify.com/CVE-2022-23695/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23694](https://insights.sbomify.com/CVE-2022-23694/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23693](https://insights.sbomify.com/CVE-2022-23693/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23692](https://insights.sbomify.com/CVE-2022-23692/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23691](https://insights.sbomify.com/CVE-2022-23691/): Auth bypass in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (medium 6.8)
- [CVE-2022-23690](https://insights.sbomify.com/CVE-2022-23690/): Information disclosure in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (medium 5.3)
- [CVE-2022-2369](https://insights.sbomify.com/CVE-2022-2369/): YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure (medium 4.3)
- [CVE-2022-23689](https://insights.sbomify.com/CVE-2022-23689/): Other in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (medium 4.3)
- [CVE-2022-23688](https://insights.sbomify.com/CVE-2022-23688/): Other in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (medium 4.3)
- [CVE-2022-23687](https://insights.sbomify.com/CVE-2022-23687/): Denial of service in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (medium 4.3)
- [CVE-2022-23686](https://insights.sbomify.com/CVE-2022-23686/): Other in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (medium 4.3)
- [CVE-2022-23685](https://insights.sbomify.com/CVE-2022-23685/): Cross-site request forgery in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23684](https://insights.sbomify.com/CVE-2022-23684/): Privilege escalation in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (high 8.8)
- [CVE-2022-23683](https://insights.sbomify.com/CVE-2022-23683/): Command injection in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (high 7.2)
- [CVE-2022-23682](https://insights.sbomify.com/CVE-2022-23682/): Command injection in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (high 7.8)
- [CVE-2022-23681](https://insights.sbomify.com/CVE-2022-23681/): Command injection in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches (high 7.8)
- [CVE-2022-23680](https://insights.sbomify.com/CVE-2022-23680/): Cross-site request forgery in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches; (high 8.8)
- [CVE-2022-2368](https://insights.sbomify.com/CVE-2022-2368/): Authentication Bypass by Spoofing in microweber/microweber (medium 6.5)
- [CVE-2022-23679](https://insights.sbomify.com/CVE-2022-23679/): Cross-site request forgery in Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aruba 6400 Switch Series; Aruba 8325 Switch Series; Aruba 8400 Switch Series; Aruba CX 8360 Switch Series; ArubaOS-CX Switches; (high 8.8)
- [CVE-2022-23678](https://insights.sbomify.com/CVE-2022-23678/): Information disclosure in Aruba Virtual Intranet Access (VIA) (medium 5.9)
- [CVE-2022-23677](https://insights.sbomify.com/CVE-2022-23677/): Memory corruption in ArubaOS-Switch Devices (high 8.1)
- [CVE-2022-23676](https://insights.sbomify.com/CVE-2022-23676/): Memory corruption in ArubaOS-Switch Devices (critical 9.8)
- [CVE-2022-23675](https://insights.sbomify.com/CVE-2022-23675/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 4.8)
- [CVE-2022-23674](https://insights.sbomify.com/CVE-2022-23674/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 5.4)
- [CVE-2022-23673](https://insights.sbomify.com/CVE-2022-23673/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-23672](https://insights.sbomify.com/CVE-2022-23672/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-23671](https://insights.sbomify.com/CVE-2022-23671/): Information disclosure in Aruba ClearPass Policy Manager (high 7.5)
- [CVE-2022-23670](https://insights.sbomify.com/CVE-2022-23670/): Information disclosure in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2022-2367](https://insights.sbomify.com/CVE-2022-2367/): WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass (high 7.5)
- [CVE-2022-23669](https://insights.sbomify.com/CVE-2022-23669/): Auth bypass in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-23668](https://insights.sbomify.com/CVE-2022-23668/): Server-side request forgery in Aruba ClearPass Policy Manager (medium 4.9)
- [CVE-2022-23667](https://insights.sbomify.com/CVE-2022-23667/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-23666](https://insights.sbomify.com/CVE-2022-23666/): Command injection in Aruba ClearPass Policy Manager (critical 9.1)
- [CVE-2022-23665](https://insights.sbomify.com/CVE-2022-23665/): Command injection in Aruba ClearPass Policy Manager (critical 9.1)
- [CVE-2022-23664](https://insights.sbomify.com/CVE-2022-23664/): Command injection in Aruba ClearPass Policy Manager (critical 9.1)
- [CVE-2022-23663](https://insights.sbomify.com/CVE-2022-23663/): Command injection in Aruba ClearPass Policy Manager (critical 9.1)
- [CVE-2022-23662](https://insights.sbomify.com/CVE-2022-23662/): Command injection in Aruba ClearPass Policy Manager (critical 9.1)
- [CVE-2022-23661](https://insights.sbomify.com/CVE-2022-23661/): Command injection in Aruba ClearPass Policy Manager (critical 9.1)
- [CVE-2022-23660](https://insights.sbomify.com/CVE-2022-23660/): Auth bypass in Aruba ClearPass Policy Manager (critical 10.0)
- [CVE-2022-2366](https://insights.sbomify.com/CVE-2022-2366/): Incorrect defaults can cause attackers to bypass rate limitations (medium 5.6)
- [CVE-2022-23659](https://insights.sbomify.com/CVE-2022-23659/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 6.1)
- [CVE-2022-23658](https://insights.sbomify.com/CVE-2022-23658/): Auth bypass in Aruba ClearPass Policy Manager (critical 10.0)
- [CVE-2022-23657](https://insights.sbomify.com/CVE-2022-23657/): Auth bypass in Aruba ClearPass Policy Manager (critical 10.0)
- [CVE-2022-23656](https://insights.sbomify.com/CVE-2022-23656/): Cross-site scripting vulnerability in Zulip Server (medium 4.6)
- [CVE-2022-23655](https://insights.sbomify.com/CVE-2022-23655/): Missing server signature validation in OctoberCMS (medium 4.8)
- [CVE-2022-23654](https://insights.sbomify.com/CVE-2022-23654/): Improper write access check in Requarks/wiki (high 8.1)
- [CVE-2022-23653](https://insights.sbomify.com/CVE-2022-23653/): B2 Command Line Tool TOCTOU application key disclosure (medium 4.7)
- [CVE-2022-23652](https://insights.sbomify.com/CVE-2022-23652/): Privilege escalation using hop-by-hop Connection header (high 8.8)
- [CVE-2022-23651](https://insights.sbomify.com/CVE-2022-23651/): b2-sdk-python TOCTOU application key disclosure (medium 4.7)
- [CVE-2022-23650](https://insights.sbomify.com/CVE-2022-23650/): Use of Hard-coded Cryptographic Key in Netmaker (high 7.2)
- [CVE-2022-2365](https://insights.sbomify.com/CVE-2022-2365/): Cross-site Scripting (XSS) - Stored in zadam/trilium (medium 4.0)
- [CVE-2022-23649](https://insights.sbomify.com/CVE-2022-23649/): Improper Certificate Validation in Cosign (low 3.3)
- [CVE-2022-23648](https://insights.sbomify.com/CVE-2022-23648/): Insecure handling of image volumes in containerd CRI plugin (high 7.5)
- [CVE-2022-23647](https://insights.sbomify.com/CVE-2022-23647/): Cross-site Scripting in Prism (high 7.5)
- [CVE-2022-23646](https://insights.sbomify.com/CVE-2022-23646/): Improper CSP in Image Optimization API for Next.js (medium 5.9)
- [CVE-2022-23645](https://insights.sbomify.com/CVE-2022-23645/): Out-of-bounds read in swtpm (medium 6.2)
- [CVE-2022-23644](https://insights.sbomify.com/CVE-2022-23644/): Server-side request forgery in BookWyrm (high 8.8)
- [CVE-2022-23643](https://insights.sbomify.com/CVE-2022-23643/): Side-channel attack in Sourcegraph Code Monitors (medium 6.5)
- [CVE-2022-23642](https://insights.sbomify.com/CVE-2022-23642/): Code Injection in Sourcegraph (high 8.8)
- [CVE-2022-23641](https://insights.sbomify.com/CVE-2022-23641/): Denial of Service in Discourse (medium 6.5)
- [CVE-2022-23640](https://insights.sbomify.com/CVE-2022-23640/): Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader (critical 9.8)
- [CVE-2022-2364](https://insights.sbomify.com/CVE-2022-2364/): SourceCodester Simple Parking Management System category cross site scripting (low 3.5)
- [CVE-2022-23639](https://insights.sbomify.com/CVE-2022-23639/): Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils (high 8.1)
- [CVE-2022-23638](https://insights.sbomify.com/CVE-2022-23638/): Cross-site Scripting in svg-sanitizer (medium 6.2)
- [CVE-2022-23637](https://insights.sbomify.com/CVE-2022-23637/): Stored Cross-Site-Scripting (XSS) in Markdown Editor (medium 6.1)
- [CVE-2022-23636](https://insights.sbomify.com/CVE-2022-23636/): Invalid drop of partially-initialized instances in wasmtime (medium 5.1)
- [CVE-2022-23635](https://insights.sbomify.com/CVE-2022-23635/): Unauthenticated control plane denial of service attack in Istio (high 7.5)
- [CVE-2022-23634](https://insights.sbomify.com/CVE-2022-23634/): Information Exposure when using Puma with Rails (high 8.0)
- [CVE-2022-23633](https://insights.sbomify.com/CVE-2022-23633/): Exposure of sensitive information in Action Pack (high 7.4)
- [CVE-2022-23632](https://insights.sbomify.com/CVE-2022-23632/): Traefik skips the router TLS configuration when the host header is an FQDN (high 7.4)
- [CVE-2022-23631](https://insights.sbomify.com/CVE-2022-23631/): Prototype Pollution leading to Remote Code Execution in superjson (critical 9.1)
- [CVE-2022-23630](https://insights.sbomify.com/CVE-2022-23630/): Dependency verification bypass in Gradle (high 7.5)
- [CVE-2022-2363](https://insights.sbomify.com/CVE-2022-2363/): SourceCodester Simple Parking Management System cross site scripting (low 3.5)
- [CVE-2022-23628](https://insights.sbomify.com/CVE-2022-23628/): Array literal misordering in github.com/open-policy-agent/opa (medium 6.3)
- [CVE-2022-23627](https://insights.sbomify.com/CVE-2022-23627/): Inadequate access verification when using proxy commands in ArchiSteamFarm (medium 5.0)
- [CVE-2022-23626](https://insights.sbomify.com/CVE-2022-23626/): Insufficient file checks in m1k1o/blog (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/380/