# Vulnerabilities published in 2022


- [CVE-2022-23282](https://insights.sbomify.com/CVE-2022-23282/): Paint 3D Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-23281](https://insights.sbomify.com/CVE-2022-23281/): Windows Common Log File System Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-23280](https://insights.sbomify.com/CVE-2022-23280/): Microsoft Outlook for Mac Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2022-2328](https://insights.sbomify.com/CVE-2022-2328/): Flexi Quote Rotator <= 0.9.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23279](https://insights.sbomify.com/CVE-2022-23279/): Windows ALPC Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-23278](https://insights.sbomify.com/CVE-2022-23278/): Microsoft Defender for Endpoint Spoofing Vulnerability (medium 5.9)
- [CVE-2022-23277](https://insights.sbomify.com/CVE-2022-23277/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-23276](https://insights.sbomify.com/CVE-2022-23276/): SQL Server for Linux Containers Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-23274](https://insights.sbomify.com/CVE-2022-23274/): Microsoft Dynamics GP Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-23273](https://insights.sbomify.com/CVE-2022-23273/): Microsoft Dynamics GP Elevation Of Privilege Vulnerability (high 7.1)
- [CVE-2022-23272](https://insights.sbomify.com/CVE-2022-23272/): Microsoft Dynamics GP Elevation Of Privilege Vulnerability (high 8.1)
- [CVE-2022-23271](https://insights.sbomify.com/CVE-2022-23271/): Microsoft Dynamics GP Elevation Of Privilege Vulnerability (medium 6.5)
- [CVE-2022-23270](https://insights.sbomify.com/CVE-2022-23270/): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (high 8.1)
- [CVE-2022-2327](https://insights.sbomify.com/CVE-2022-2327/): Use-after-free in io_uring ad work_flags in Linux Kernel (high 7.5)
- [CVE-2022-23269](https://insights.sbomify.com/CVE-2022-23269/): Microsoft Dynamics GP Spoofing Vulnerability (medium 5.4)
- [CVE-2022-23268](https://insights.sbomify.com/CVE-2022-23268/): Windows Hyper-V Denial of Service Vulnerability (medium 6.5)
- [CVE-2022-23267](https://insights.sbomify.com/CVE-2022-23267/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2022-23266](https://insights.sbomify.com/CVE-2022-23266/): Microsoft Defender for IoT Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-23265](https://insights.sbomify.com/CVE-2022-23265/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 7.2)
- [CVE-2022-23264](https://insights.sbomify.com/CVE-2022-23264/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.7)
- [CVE-2022-23263](https://insights.sbomify.com/CVE-2022-23263/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 7.7)
- [CVE-2022-23262](https://insights.sbomify.com/CVE-2022-23262/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 6.3)
- [CVE-2022-23261](https://insights.sbomify.com/CVE-2022-23261/): Microsoft Edge (Chromium-based) Tampering Vulnerability (medium 5.3)
- [CVE-2022-2326](https://insights.sbomify.com/CVE-2022-2326/): Auth bypass in GitLab (medium 6.4)
- [CVE-2022-23259](https://insights.sbomify.com/CVE-2022-23259/): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-23258](https://insights.sbomify.com/CVE-2022-23258/): Microsoft Edge for Android Spoofing Vulnerability (medium 4.3)
- [CVE-2022-23257](https://insights.sbomify.com/CVE-2022-23257/): Windows Hyper-V Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-23256](https://insights.sbomify.com/CVE-2022-23256/): Azure Data Explorer Spoofing Vulnerability (high 8.1)
- [CVE-2022-23255](https://insights.sbomify.com/CVE-2022-23255/): Microsoft OneDrive for Android Security Feature Bypass Vulnerability (medium 5.9)
- [CVE-2022-23254](https://insights.sbomify.com/CVE-2022-23254/): Microsoft Power BI Information Disclosure Vulnerability (medium 4.9)
- [CVE-2022-23253](https://insights.sbomify.com/CVE-2022-23253/): Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability (medium 6.5)
- [CVE-2022-23252](https://insights.sbomify.com/CVE-2022-23252/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-2325](https://insights.sbomify.com/CVE-2022-2325/): Invitation Based Registrations <= 2.2.84 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23242](https://insights.sbomify.com/CVE-2022-23242/): TeamViewer Linux - Deletion command not properly executed after process crash (medium 6.3)
- [CVE-2022-23241](https://insights.sbomify.com/CVE-2022-23241/): Missing authorization in Clustered Data ONTAP (high 8.1)
- [CVE-2022-23240](https://insights.sbomify.com/CVE-2022-23240/): Missing authorization in Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows (medium 6.5)
- [CVE-2022-2324](https://insights.sbomify.com/CVE-2022-2324/): Security feature bypass in SonicWall Email Security (high 7.5)
- [CVE-2022-23239](https://insights.sbomify.com/CVE-2022-23239/): Cross-site scripting in Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows (medium 4.8)
- [CVE-2022-23238](https://insights.sbomify.com/CVE-2022-23238/): Missing authorization in StorageGRID (formerly StorageGRID Webscale) (medium 6.5)
- [CVE-2022-23237](https://insights.sbomify.com/CVE-2022-23237/): Open redirect in E-Series SANtricity OS Controller Software 11.x (medium 6.1)
- [CVE-2022-23236](https://insights.sbomify.com/CVE-2022-23236/): Information disclosure in E-Series SANtricity OS Controller Software 11.x (medium 4.4)
- [CVE-2022-23235](https://insights.sbomify.com/CVE-2022-23235/): Information disclosure in Active IQ Unified Manager (medium 5.3)
- [CVE-2022-23234](https://insights.sbomify.com/CVE-2022-23234/): Information disclosure in SnapCenter (medium 5.5)
- [CVE-2022-23233](https://insights.sbomify.com/CVE-2022-23233/): Denial of service in StorageGRID (formerly StorageGRID Webscale) (high 7.5)
- [CVE-2022-23232](https://insights.sbomify.com/CVE-2022-23232/): Auth bypass in StorageGRID (formerly StorageGRID Webscale) (medium 4.9)
- [CVE-2022-2323](https://insights.sbomify.com/CVE-2022-2323/): Command injection in SonicWall Switch (high 8.8)
- [CVE-2022-23228](https://insights.sbomify.com/CVE-2022-23228/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-23227](https://insights.sbomify.com/CVE-2022-23227/): NUUO NVRmini2 Devices Missing Authentication Vulnerability (critical 9.8, exploited in the wild)
- [CVE-2022-23223](https://insights.sbomify.com/CVE-2022-23223/): Apache ShenYu Password leakage (high 7.5)
- [CVE-2022-23222](https://insights.sbomify.com/CVE-2022-23222/): Privilege escalation in debian:debian linux (high 7.8)
- [CVE-2022-23221](https://insights.sbomify.com/CVE-2022-23221/): Arbitrary code execution in H2 Console (critical 9.8)
- [CVE-2022-23220](https://insights.sbomify.com/CVE-2022-23220/): Privilege escalation in usbview project:usbview (high 7.8)
- [CVE-2022-23219](https://insights.sbomify.com/CVE-2022-23219/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2022-23218](https://insights.sbomify.com/CVE-2022-23218/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2022-2321](https://insights.sbomify.com/CVE-2022-2321/): Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama (high 7.5)
- [CVE-2022-23206](https://insights.sbomify.com/CVE-2022-23206/): Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth (high 7.5)
- [CVE-2022-23205](https://insights.sbomify.com/CVE-2022-23205/): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-23204](https://insights.sbomify.com/CVE-2022-23204/): Adobe Premiere Rush JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-23203](https://insights.sbomify.com/CVE-2022-23203/): Adobe Photoshop Buffer Overflow could lead to Arbitrary code execution (high 7.8)
- [CVE-2022-23202](https://insights.sbomify.com/CVE-2022-23202/): Adobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code execution (high 7.0)
- [CVE-2022-23201](https://insights.sbomify.com/CVE-2022-23201/): Adobe RoboHelp Reflected XSS could lead to Arbitrary code execution (medium 6.1)
- [CVE-2022-23200](https://insights.sbomify.com/CVE-2022-23200/): Adobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-2320](https://insights.sbomify.com/CVE-2022-2320/): Memory corruption in xorg-x11-server (high 7.8)
- [CVE-2022-23199](https://insights.sbomify.com/CVE-2022-23199/): Adobe Illustrator NULL Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2022-23198](https://insights.sbomify.com/CVE-2022-23198/): Adobe Illustrator NULL Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2022-23197](https://insights.sbomify.com/CVE-2022-23197/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23196](https://insights.sbomify.com/CVE-2022-23196/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23195](https://insights.sbomify.com/CVE-2022-23195/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23194](https://insights.sbomify.com/CVE-2022-23194/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23193](https://insights.sbomify.com/CVE-2022-23193/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23192](https://insights.sbomify.com/CVE-2022-23192/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23191](https://insights.sbomify.com/CVE-2022-23191/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-23190](https://insights.sbomify.com/CVE-2022-23190/): Adobe Illustrator Out-of-bounds Read could lead to Memory leak (medium 5.5)
- [CVE-2022-2319](https://insights.sbomify.com/CVE-2022-2319/): Memory corruption in xorg-x11-server (high 7.8)
- [CVE-2022-23189](https://insights.sbomify.com/CVE-2022-23189/): Adobe Illustrator NULL Pointer Dereference Application denial-of-service (medium 5.5)
- [CVE-2022-23188](https://insights.sbomify.com/CVE-2022-23188/): Adobe Illustrator Buffer Overflow could lead to Arbitrary code execution (high 7.8)
- [CVE-2022-23187](https://insights.sbomify.com/CVE-2022-23187/): Adobe Illustrator 2022 Buffer Overflow could lead to Arbitrary code execution (high 7.8)
- [CVE-2022-23186](https://insights.sbomify.com/CVE-2022-23186/): Adobe Illustrator Out-of-bounds Write could lead to Arbitrary code execution (high 7.8)
- [CVE-2022-23184](https://insights.sbomify.com/CVE-2022-23184/): Open redirect in Octopus Server (medium 6.1)
- [CVE-2022-23183](https://insights.sbomify.com/CVE-2022-23183/): Missing authorization in Advanced Custom Fields (medium 6.5)
- [CVE-2022-23182](https://insights.sbomify.com/CVE-2022-23182/): Missing authorization in Intel(R) Data Center Manager software (high 8.8)
- [CVE-2022-23181](https://insights.sbomify.com/CVE-2022-23181/): Local privilege escalation with FileStore (high 7.0)
- [CVE-2022-23180](https://insights.sbomify.com/CVE-2022-23180/): Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update (medium 4.3)
- [CVE-2022-2318](https://insights.sbomify.com/CVE-2022-2318/): Use after free in Kernel (medium 5.5)
- [CVE-2022-23179](https://insights.sbomify.com/CVE-2022-23179/): Contact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23178](https://insights.sbomify.com/CVE-2022-23178/): Information disclosure in crestron:hd-md4x2-4k-e firmware (critical 9.8)
- [CVE-2022-23176](https://insights.sbomify.com/CVE-2022-23176/): WatchGuard Firebox and XTM Privilege Escalation (high 8.8, exploited in the wild)
- [CVE-2022-23173](https://insights.sbomify.com/CVE-2022-23173/): Priority - Priority web Insecure direct object references (IDOR) (medium 5.5)
- [CVE-2022-23172](https://insights.sbomify.com/CVE-2022-23172/): Priority - Priority User Enumeration (medium 5.5)
- [CVE-2022-23171](https://insights.sbomify.com/CVE-2022-23171/): AtlasVPN - Privilege Escalation (medium 5.9)
- [CVE-2022-23170](https://insights.sbomify.com/CVE-2022-23170/): SysAid - Okta SSO integration (medium 5.9)
- [CVE-2022-2317](https://insights.sbomify.com/CVE-2022-2317/): Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation (critical 9.8)
- [CVE-2022-23169](https://insights.sbomify.com/CVE-2022-23169/): Amodat - Mobile Application Gateway SQL Injection (SQLi) (medium 5.9)
- [CVE-2022-23168](https://insights.sbomify.com/CVE-2022-23168/): Amodat - Mobile Application Gateway SQL Injection (SQLi) (medium 5.9)
- [CVE-2022-23167](https://insights.sbomify.com/CVE-2022-23167/): Amodat - Mobile Application Gateway Local File Inclusion (LFI) (medium 5.3)
- [CVE-2022-23166](https://insights.sbomify.com/CVE-2022-23166/): Sysaid – Sysaid Local File Inclusion (LFI) (medium 6.1)
- [CVE-2022-23165](https://insights.sbomify.com/CVE-2022-23165/): Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) (medium 5.5)
- [CVE-2022-23163](https://insights.sbomify.com/CVE-2022-23163/): Denial of service in PowerScale OneFS (medium 4.7)
- [CVE-2022-23161](https://insights.sbomify.com/CVE-2022-23161/): Denial of service in PowerScale OneFS (high 7.5)
- [CVE-2022-23160](https://insights.sbomify.com/CVE-2022-23160/): Privilege escalation in PowerScale OneFS (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/384/