# Vulnerabilities published in 2022


- [CVE-2022-23526](https://insights.sbomify.com/CVE-2022-23526/): Helm contains Denial of service through schema file (medium 5.3)
- [CVE-2022-23525](https://insights.sbomify.com/CVE-2022-23525/): Helm vulnerable to Denial of service via NULL Pointer Dereference (medium 5.3)
- [CVE-2022-23524](https://insights.sbomify.com/CVE-2022-23524/): Helm vulnerable to Denial of service through string value parsing (medium 5.3)
- [CVE-2022-23523](https://insights.sbomify.com/CVE-2022-23523/): rust-vmm linux-loader vulnerable to Out-of-bounds Read (medium 4.0)
- [CVE-2022-23522](https://insights.sbomify.com/CVE-2022-23522/): Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb (high 8.5)
- [CVE-2022-23521](https://insights.sbomify.com/CVE-2022-23521/): gitattributes parsing integer overflow in git (critical 9.8)
- [CVE-2022-23520](https://insights.sbomify.com/CVE-2022-23520/): rails-html-sanitizer contains an incomplete fix for an XSS vulnerability (medium 6.1)
- [CVE-2022-2352](https://insights.sbomify.com/CVE-2022-2352/): Post SMTP < 2.1.7 - Admin+ Blind SSRF (high 7.2)
- [CVE-2022-23519](https://insights.sbomify.com/CVE-2022-23519/): Possible XSS vulnerability with certain configurations of rails-html-sanitizer (high 7.2)
- [CVE-2022-23518](https://insights.sbomify.com/CVE-2022-23518/): Improper neutralization of data URIs allows XSS in rails-html-sanitizer (medium 6.1)
- [CVE-2022-23517](https://insights.sbomify.com/CVE-2022-23517/): Inefficient Regular Expression Complexity in rails-html-sanitizer (high 7.5)
- [CVE-2022-23516](https://insights.sbomify.com/CVE-2022-23516/): Uncontrolled Recursion in Loofah (high 7.5)
- [CVE-2022-23515](https://insights.sbomify.com/CVE-2022-23515/): Improper neutralization of data URIs may allow XSS in Loofah (medium 6.1)
- [CVE-2022-23514](https://insights.sbomify.com/CVE-2022-23514/): Inefficient Regular Expression Complexity in Loofah (high 7.5)
- [CVE-2022-23513](https://insights.sbomify.com/CVE-2022-23513/): Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint (medium 5.3)
- [CVE-2022-23512](https://insights.sbomify.com/CVE-2022-23512/): Metersphere is vulnerable to Path Injection. (high 7.7)
- [CVE-2022-23511](https://insights.sbomify.com/CVE-2022-23511/): Amazon CloudWatch Agent for Windows has Privilege Escalation Vector (high 7.1)
- [CVE-2022-23510](https://insights.sbomify.com/CVE-2022-23510/): SQl injection in cube-js (critical 9.6)
- [CVE-2022-2351](https://insights.sbomify.com/CVE-2022-2351/): Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23509](https://insights.sbomify.com/CVE-2022-23509/): Weave Gitops Run vulnerable to insecure communication (high 7.4)
- [CVE-2022-23508](https://insights.sbomify.com/CVE-2022-23508/): GitOps Run allows for Kubernetes workload injection (high 8.9)
- [CVE-2022-23507](https://insights.sbomify.com/CVE-2022-23507/): Light client verification not taking into account chain ID (medium 5.4)
- [CVE-2022-23506](https://insights.sbomify.com/CVE-2022-23506/): Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds (medium 4.3)
- [CVE-2022-23505](https://insights.sbomify.com/CVE-2022-23505/): Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication (medium 5.3)
- [CVE-2022-23504](https://insights.sbomify.com/CVE-2022-23504/): TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration (medium 5.7)
- [CVE-2022-23503](https://insights.sbomify.com/CVE-2022-23503/): TYPO3 vulnerable to Arbitrary Code Execution via Form Framework (high 7.5)
- [CVE-2022-23502](https://insights.sbomify.com/CVE-2022-23502/): TYPO3 contains Insufficient Session Expiration after Password Reset (medium 5.4)
- [CVE-2022-23501](https://insights.sbomify.com/CVE-2022-23501/): TYPO3 vulnerable to Improper Authentication in Frontend Login (medium 5.9)
- [CVE-2022-23500](https://insights.sbomify.com/CVE-2022-23500/): TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service (medium 5.9)
- [CVE-2022-2350](https://insights.sbomify.com/CVE-2022-2350/): Disable User Login <= 1.0.1 - Unauthenticated Settings Update (medium 5.3)
- [CVE-2022-23499](https://insights.sbomify.com/CVE-2022-23499/): Cross-Site Scripting Protection bypass in HTML Sanitizer (medium 6.1)
- [CVE-2022-23498](https://insights.sbomify.com/CVE-2022-23498/): When query caching is enabled in Grafana users can query another users session (high 7.1)
- [CVE-2022-23497](https://insights.sbomify.com/CVE-2022-23497/): Insecure file access in FreshRSS (medium 6.5)
- [CVE-2022-23496](https://insights.sbomify.com/CVE-2022-23496/): A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa (high 7.5)
- [CVE-2022-23495](https://insights.sbomify.com/CVE-2022-23495/): ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag (high 7.5)
- [CVE-2022-23494](https://insights.sbomify.com/CVE-2022-23494/): Cross-site scripting vulnerability in TinyMCE alerts (medium 5.4)
- [CVE-2022-23493](https://insights.sbomify.com/CVE-2022-23493/): Out of Bound Read in xrdp (critical 9.1)
- [CVE-2022-23492](https://insights.sbomify.com/CVE-2022-23492/): go-libp2p denial of service vulnerability from lack of resource management (high 7.5)
- [CVE-2022-23491](https://insights.sbomify.com/CVE-2022-23491/): Removal of TrustCor root certificate (medium 6.8)
- [CVE-2022-23490](https://insights.sbomify.com/CVE-2022-23490/): Improper access control to polling votes (medium 4.3)
- [CVE-2022-23488](https://insights.sbomify.com/CVE-2022-23488/): BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data (medium 6.5)
- [CVE-2022-23487](https://insights.sbomify.com/CVE-2022-23487/): libp2p denial of service vulnerability from lack of resource management (high 7.5)
- [CVE-2022-23486](https://insights.sbomify.com/CVE-2022-23486/): libp2p-rust denial of service vulnerability from lack of resource management (high 7.5)
- [CVE-2022-23485](https://insights.sbomify.com/CVE-2022-23485/): Invite code reuse via cookie manipulation in sentry (medium 6.4)
- [CVE-2022-23484](https://insights.sbomify.com/CVE-2022-23484/): Integer Overflow in xrdp (high 8.2)
- [CVE-2022-23483](https://insights.sbomify.com/CVE-2022-23483/): Out-of-Bound Read in libxrdp (high 7.5)
- [CVE-2022-23482](https://insights.sbomify.com/CVE-2022-23482/): Out-of-Bound Read in xrdp (not scored)
- [CVE-2022-23481](https://insights.sbomify.com/CVE-2022-23481/): Out-of-Bound Read in xrdp (not scored)
- [CVE-2022-23480](https://insights.sbomify.com/CVE-2022-23480/): Buffer Overflow in xrdp (critical 9.1)
- [CVE-2022-23479](https://insights.sbomify.com/CVE-2022-23479/): Buffer Overflow occurs in xrdp (critical 9.1)
- [CVE-2022-23478](https://insights.sbomify.com/CVE-2022-23478/): Out of Bound Write in xrdp (critical 9.1)
- [CVE-2022-23477](https://insights.sbomify.com/CVE-2022-23477/): Buffer Overflow in xrdp (critical 9.1)
- [CVE-2022-23476](https://insights.sbomify.com/CVE-2022-23476/): Unchecked return value from xmlTextReaderExpand in Nokogiri (high 7.5)
- [CVE-2022-23475](https://insights.sbomify.com/CVE-2022-23475/): dalorRadius full account take over (high 8.8)
- [CVE-2022-23474](https://insights.sbomify.com/CVE-2022-23474/): editor.js contains Code Injection (medium 6.1)
- [CVE-2022-23473](https://insights.sbomify.com/CVE-2022-23473/): Tuleap MediaWiki standalone "readers" can also edit pages (medium 4.3)
- [CVE-2022-23472](https://insights.sbomify.com/CVE-2022-23472/): Use of insecure random number generator in Passeo (medium 5.9)
- [CVE-2022-23471](https://insights.sbomify.com/CVE-2022-23471/): containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak (medium 5.7)
- [CVE-2022-23470](https://insights.sbomify.com/CVE-2022-23470/): Arbitrary file access in the Galaxy data analysis platform (high 8.6)
- [CVE-2022-2347](https://insights.sbomify.com/CVE-2022-2347/): Unchecked Download size in Uboot (high 7.7)
- [CVE-2022-23469](https://insights.sbomify.com/CVE-2022-23469/): Authorization header displayed in the debug logs (low 3.5)
- [CVE-2022-23468](https://insights.sbomify.com/CVE-2022-23468/): Buffer Overflow in xrdp (medium 6.5)
- [CVE-2022-23467](https://insights.sbomify.com/CVE-2022-23467/): Out of Bounds Read in OpenRazer Driver (medium 4.4)
- [CVE-2022-23466](https://insights.sbomify.com/CVE-2022-23466/): DOM-based cross-site scripting (XSS) in teler dashboard (medium 5.4)
- [CVE-2022-23465](https://insights.sbomify.com/CVE-2022-23465/): SwiftTerm vulnerable to arbitrary command execution (high 7.1)
- [CVE-2022-23464](https://insights.sbomify.com/CVE-2022-23464/): Potential Server Side Request Forgery (SSRF) in Nepxion Discovery (medium 4.3)
- [CVE-2022-23463](https://insights.sbomify.com/CVE-2022-23463/): SpEL Injection in Nepxion Discovery (critical 9.4)
- [CVE-2022-23462](https://insights.sbomify.com/CVE-2022-23462/): Stack Buffer Overflow in iowow (medium 6.2)
- [CVE-2022-23461](https://insights.sbomify.com/CVE-2022-23461/): Cross-Site Scripting (XSS) in Jodit Editor (medium 5.4)
- [CVE-2022-23460](https://insights.sbomify.com/CVE-2022-23460/): Stack overflow in Jsonxx (medium 5.9)
- [CVE-2022-2346](https://insights.sbomify.com/CVE-2022-2346/): Missing authorization in Octopus Server (medium 5.5)
- [CVE-2022-23459](https://insights.sbomify.com/CVE-2022-23459/): Double free or Use after Free in Value class of Jsonxx (high 8.1)
- [CVE-2022-23458](https://insights.sbomify.com/CVE-2022-23458/): Toast UI Grid vulnerable to Cross-site scripting (medium 6.1)
- [CVE-2022-23457](https://insights.sbomify.com/CVE-2022-23457/): Path Traversal in ESAPI (high 7.5)
- [CVE-2022-23456](https://insights.sbomify.com/CVE-2022-23456/): Other in hp:support assistant (medium 5.5)
- [CVE-2022-23455](https://insights.sbomify.com/CVE-2022-23455/): Privilege escalation in HP Support Assistant (high 7.8)
- [CVE-2022-23454](https://insights.sbomify.com/CVE-2022-23454/): Misconfiguration in HP Support Assistant (high 7.8)
- [CVE-2022-23453](https://insights.sbomify.com/CVE-2022-23453/): Misconfiguration in HP Support Assistant (high 7.8)
- [CVE-2022-23452](https://insights.sbomify.com/CVE-2022-23452/): openstack-barbican Denial of Service vulnerability (medium 4.9)
- [CVE-2022-23451](https://insights.sbomify.com/CVE-2022-23451/): Barbican authorization flaw before v14.0.0 (high 8.1)
- [CVE-2022-23450](https://insights.sbomify.com/CVE-2022-23450/): Deserialization in SIMATIC Energy Manager Basic (critical 9.8)
- [CVE-2022-2345](https://insights.sbomify.com/CVE-2022-2345/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-23449](https://insights.sbomify.com/CVE-2022-23449/): Privilege escalation in SIMATIC Energy Manager Basic (high 7.3)
- [CVE-2022-23448](https://insights.sbomify.com/CVE-2022-23448/): Misconfiguration in SIMATIC Energy Manager Basic (high 7.8)
- [CVE-2022-23447](https://insights.sbomify.com/CVE-2022-23447/): Path traversal in FortiExtender (high 7.3)
- [CVE-2022-23446](https://insights.sbomify.com/CVE-2022-23446/): Denial of service in Fortinet FortiEDR (medium 4.4)
- [CVE-2022-23443](https://insights.sbomify.com/CVE-2022-23443/): Missing authorization in Fortinet FortiSOAR (high 7.5)
- [CVE-2022-23442](https://insights.sbomify.com/CVE-2022-23442/): Missing authorization in Fortinet FortiOS (medium 4.3)
- [CVE-2022-23441](https://insights.sbomify.com/CVE-2022-23441/): Hardcoded credentials in Fortinet FortiEDR (critical 9.1)
- [CVE-2022-23440](https://insights.sbomify.com/CVE-2022-23440/): Hardcoded credentials in Fortinet FortiEDR (high 7.8)
- [CVE-2022-2344](https://insights.sbomify.com/CVE-2022-2344/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-23439](https://insights.sbomify.com/CVE-2022-23439/): Other in FortiADC (medium 4.1)
- [CVE-2022-23438](https://insights.sbomify.com/CVE-2022-23438/): Cross-site scripting in Fortinet FortiOS (medium 4.7)
- [CVE-2022-23437](https://insights.sbomify.com/CVE-2022-23437/): Infinite loop within Apache XercesJ xml parser (medium 6.5)
- [CVE-2022-23435](https://insights.sbomify.com/CVE-2022-23435/): android-gif-drawable vulerable to denial of service due to unrestricted comment length (high 7.5)
- [CVE-2022-23434](https://insights.sbomify.com/CVE-2022-23434/): Privilege escalation in Bixby Vision (medium 4.4)
- [CVE-2022-23433](https://insights.sbomify.com/CVE-2022-23433/): Missing authorization in Reminder (medium 4.3)
- [CVE-2022-23432](https://insights.sbomify.com/CVE-2022-23432/): Memory corruption in Samsung Mobile Devices with Exynos chipsets (medium 6.4)
- [CVE-2022-23431](https://insights.sbomify.com/CVE-2022-23431/): Memory corruption in Samsung Mobile Devices with Exynos chipsets (medium 6.4)
- [CVE-2022-2343](https://insights.sbomify.com/CVE-2022-2343/): Heap-based Buffer Overflow in vim/vim (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/382/