# Vulnerabilities published in 2022


- [CVE-2022-2316](https://insights.sbomify.com/CVE-2022-2316/): Cross-site scripting in Devolutions Server (medium 5.4)
- [CVE-2022-23159](https://insights.sbomify.com/CVE-2022-23159/): Denial of service in PowerScale OneFS (medium 4.8)
- [CVE-2022-23158](https://insights.sbomify.com/CVE-2022-23158/): Information disclosure in Dell Wyse Device Agent (medium 6.0)
- [CVE-2022-23157](https://insights.sbomify.com/CVE-2022-23157/): Information disclosure in Dell Wyse Device Agent (medium 4.4)
- [CVE-2022-23156](https://insights.sbomify.com/CVE-2022-23156/): Auth bypass in Dell Wyse Device Agent (medium 6.0)
- [CVE-2022-23155](https://insights.sbomify.com/CVE-2022-23155/): File upload in Wyse Management Suite (high 7.2)
- [CVE-2022-2315](https://insights.sbomify.com/CVE-2022-2315/): SQL Injection in Database Accreditation System (critical 9.4)
- [CVE-2022-23144](https://insights.sbomify.com/CVE-2022-23144/): Missing authorization in ZXvSTB (critical 9.1)
- [CVE-2022-23143](https://insights.sbomify.com/CVE-2022-23143/): Misconfiguration in OTCP (medium 6.5)
- [CVE-2022-23142](https://insights.sbomify.com/CVE-2022-23142/): Denial of service in ZXEN CG200 (medium 5.3)
- [CVE-2022-23141](https://insights.sbomify.com/CVE-2022-23141/): Auth bypass in ZXMP M721 (high 7.5)
- [CVE-2022-2314](https://insights.sbomify.com/CVE-2022-2314/): VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call (critical 9.8)
- [CVE-2022-23139](https://insights.sbomify.com/CVE-2022-23139/): Privilege escalation in ZXMP M721 (high 8.8)
- [CVE-2022-23138](https://insights.sbomify.com/CVE-2022-23138/): Weak cryptography in MF297D (high 7.5)
- [CVE-2022-23137](https://insights.sbomify.com/CVE-2022-23137/): Cross-site scripting in ZXCDN (medium 6.1)
- [CVE-2022-23136](https://insights.sbomify.com/CVE-2022-23136/): Cross-site scripting in ZXHN F680 (medium 5.4)
- [CVE-2022-23135](https://insights.sbomify.com/CVE-2022-23135/): Path traversal in ZXHN F677, ZXHN F477 (medium 6.5)
- [CVE-2022-23134](https://insights.sbomify.com/CVE-2022-23134/): Zabbix Frontend Improper Access Control (low 3.7, exploited in the wild)
- [CVE-2022-23133](https://insights.sbomify.com/CVE-2022-23133/): Stored XSS in host groups configuration window in Zabbix Frontend (medium 6.3)
- [CVE-2022-23132](https://insights.sbomify.com/CVE-2022-23132/): Incorrect permissions of [/var/run/zabbix] forces dac_override (low 3.3)
- [CVE-2022-23131](https://insights.sbomify.com/CVE-2022-23131/): Zabbix Frontend Authentication Bypass (critical 9.1, exploited in the wild)
- [CVE-2022-23130](https://insights.sbomify.com/CVE-2022-23130/): Memory corruption in GENESIS32 (medium 5.9)
- [CVE-2022-2313](https://insights.sbomify.com/CVE-2022-2313/): DLL high jacking in Trellix Agent (high 8.2)
- [CVE-2022-23129](https://insights.sbomify.com/CVE-2022-23129/): Information disclosure in Mitsubishi Electric MC Works64; ICONICS GENESIS64 (medium 5.5)
- [CVE-2022-23128](https://insights.sbomify.com/CVE-2022-23128/): Auth bypass in Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI (critical 9.8)
- [CVE-2022-23127](https://insights.sbomify.com/CVE-2022-23127/): Cross-site scripting in Mitsubishi Electric MC Works64; ICONICS MobileHMI (medium 6.1)
- [CVE-2022-23126](https://insights.sbomify.com/CVE-2022-23126/): Auth bypass in teslamate:teslamate (critical 9.8)
- [CVE-2022-23125](https://insights.sbomify.com/CVE-2022-23125/): Memory corruption in Netatalk (critical 9.8)
- [CVE-2022-23124](https://insights.sbomify.com/CVE-2022-23124/): Memory corruption in Netatalk (medium 5.3)
- [CVE-2022-23123](https://insights.sbomify.com/CVE-2022-23123/): Memory corruption in Netatalk (medium 5.3)
- [CVE-2022-23122](https://insights.sbomify.com/CVE-2022-23122/): Memory corruption in Netatalk (critical 9.8)
- [CVE-2022-23121](https://insights.sbomify.com/CVE-2022-23121/): Memory corruption in Netatalk (critical 9.8)
- [CVE-2022-23120](https://insights.sbomify.com/CVE-2022-23120/): Code injection in Trend Micro Deep Security Agent for Linux (high 7.8)
- [CVE-2022-2312](https://insights.sbomify.com/CVE-2022-2312/): Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF (medium 5.4)
- [CVE-2022-23119](https://insights.sbomify.com/CVE-2022-23119/): Path traversal in Trend Micro Deep Security Agent for Linux (high 7.5)
- [CVE-2022-23118](https://insights.sbomify.com/CVE-2022-23118/): Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin (high 8.8)
- [CVE-2022-23117](https://insights.sbomify.com/CVE-2022-23117/): Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials (high 7.5)
- [CVE-2022-23116](https://insights.sbomify.com/CVE-2022-23116/): Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets (high 7.5)
- [CVE-2022-23115](https://insights.sbomify.com/CVE-2022-23115/): CSRF vulnerability in Jenkins batch task Plugin (medium 5.4)
- [CVE-2022-23114](https://insights.sbomify.com/CVE-2022-23114/): Password stored in plain text by Jenkins Publish Over SSH Plugin (low 3.3)
- [CVE-2022-23113](https://insights.sbomify.com/CVE-2022-23113/): Path traversal vulnerability in Jenkins Publish Over SSH Plugin (medium 4.3)
- [CVE-2022-23112](https://insights.sbomify.com/CVE-2022-23112/): Missing permission check in Jenkins Publish Over SSH Plugin (medium 6.5)
- [CVE-2022-23111](https://insights.sbomify.com/CVE-2022-23111/): CSRF vulnerability and missing permission checks in Jenkins Publish Over SSH Plugin (medium 4.3)
- [CVE-2022-23110](https://insights.sbomify.com/CVE-2022-23110/): Stored XSS vulnerability in Jenkins Publish Over SSH Plugin (medium 4.8)
- [CVE-2022-2311](https://insights.sbomify.com/CVE-2022-2311/): Find and Replace All < 1.3 - Reflected Cross Site Scripting (medium 6.1)
- [CVE-2022-23109](https://insights.sbomify.com/CVE-2022-23109/): Improper credentials masking in Jenkins HashiCorp Vault Plugin (medium 6.5)
- [CVE-2022-23108](https://insights.sbomify.com/CVE-2022-23108/): Stored XSS vulnerability in Jenkins Badge Plugin (medium 5.4)
- [CVE-2022-23107](https://insights.sbomify.com/CVE-2022-23107/): Path Traversal in Jenkins Warnings Next Generation Plugin (high 8.1)
- [CVE-2022-23106](https://insights.sbomify.com/CVE-2022-23106/): Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin (medium 5.3)
- [CVE-2022-23105](https://insights.sbomify.com/CVE-2022-23105/): User passwords transmitted in plain text by Jenkins Active Directory Plugin (medium 6.5)
- [CVE-2022-23104](https://insights.sbomify.com/CVE-2022-23104/): WIN-911 2021 Incorrect Default Permissions (medium 5.6)
- [CVE-2022-23103](https://insights.sbomify.com/CVE-2022-23103/): Memory corruption in LinkHub Mesh Wifi (high 8.8)
- [CVE-2022-23102](https://insights.sbomify.com/CVE-2022-23102/): Open redirect in SINEMA Remote Connect Server (medium 6.1)
- [CVE-2022-23101](https://insights.sbomify.com/CVE-2022-23101/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2022-23100](https://insights.sbomify.com/CVE-2022-23100/): Command injection in open-xchange:ox app suite (critical 9.8)
- [CVE-2022-2310](https://insights.sbomify.com/CVE-2022-2310/): Skyhigh SWG Authentication bypass vulnerability (critical 10.0)
- [CVE-2022-23099](https://insights.sbomify.com/CVE-2022-23099/): Cross-site scripting in open-xchange:app suite (medium 5.4)
- [CVE-2022-23098](https://insights.sbomify.com/CVE-2022-23098/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2022-23097](https://insights.sbomify.com/CVE-2022-23097/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2022-23096](https://insights.sbomify.com/CVE-2022-23096/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2022-23095](https://insights.sbomify.com/CVE-2022-23095/): Memory corruption in opendesign:drawings software development kit (high 7.8)
- [CVE-2022-23094](https://insights.sbomify.com/CVE-2022-23094/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2022-23093](https://insights.sbomify.com/CVE-2022-23093/): Stack overflow in ping(8) (medium 6.5)
- [CVE-2022-23092](https://insights.sbomify.com/CVE-2022-23092/): Missing bounds check in 9p message handling (high 8.8)
- [CVE-2022-23091](https://insights.sbomify.com/CVE-2022-23091/): Memory disclosure by stale virtual memory mapping (medium 4.0)
- [CVE-2022-23090](https://insights.sbomify.com/CVE-2022-23090/): AIO credential reference count leak (high 7.7)
- [CVE-2022-2309](https://insights.sbomify.com/CVE-2022-2309/): NULL Pointer Dereference in lxml/lxml (medium 5.3)
- [CVE-2022-23089](https://insights.sbomify.com/CVE-2022-23089/): Out of bound read in elf_note_prpsinfo() (medium 4.7)
- [CVE-2022-23088](https://insights.sbomify.com/CVE-2022-23088/): 802.11 heap buffer overflow (critical 9.8)
- [CVE-2022-23087](https://insights.sbomify.com/CVE-2022-23087/): Bhyve e82545 device emulation out-of-bounds write (high 8.8)
- [CVE-2022-23086](https://insights.sbomify.com/CVE-2022-23086/): mpr/mps/mpt driver ioctl heap out-of-bounds write (critical 9.8)
- [CVE-2022-23085](https://insights.sbomify.com/CVE-2022-23085/): Potential jail escape vulnerabilities in netmap (critical 9.8)
- [CVE-2022-23084](https://insights.sbomify.com/CVE-2022-23084/): Potential jail escape vulnerabilities in netmap (high 7.8)
- [CVE-2022-23083](https://insights.sbomify.com/CVE-2022-23083/): Cross-site scripting in NetMaster Network Management for TCP/IP and NetMaster File Transfer Management (medium 6.1)
- [CVE-2022-23082](https://insights.sbomify.com/CVE-2022-23082/): CureKit - Path Traversal in isFileOutsideDir (high 7.5)
- [CVE-2022-23081](https://insights.sbomify.com/CVE-2022-23081/): Openlibrary - Reflected XSS (medium 4.3)
- [CVE-2022-23080](https://insights.sbomify.com/CVE-2022-23080/): directus - SSRF which leads to internal port scan (medium 5.0)
- [CVE-2022-2308](https://insights.sbomify.com/CVE-2022-2308/): Information disclosure in Linux kernel (medium 6.5)
- [CVE-2022-23079](https://insights.sbomify.com/CVE-2022-23079/): motoradmin - host header Injection in the reset password functionality (medium 6.8)
- [CVE-2022-23078](https://insights.sbomify.com/CVE-2022-23078/): Habitica - Open redirect in login page (medium 5.8)
- [CVE-2022-23077](https://insights.sbomify.com/CVE-2022-23077/): Habitica - DOM XSS in login page (medium 6.1)
- [CVE-2022-23074](https://insights.sbomify.com/CVE-2022-23074/): Recipes - Stored XSS in Name Parameter (low 3.5)
- [CVE-2022-23073](https://insights.sbomify.com/CVE-2022-23073/): Recipes - Stored XSS in Clipboard (low 3.5)
- [CVE-2022-23072](https://insights.sbomify.com/CVE-2022-23072/): Recipes - Stored XSS in Add to Cart (low 3.5)
- [CVE-2022-23071](https://insights.sbomify.com/CVE-2022-23071/): Recipes - SSRF on Import (medium 6.5)
- [CVE-2022-2307](https://insights.sbomify.com/CVE-2022-2307/): Business logic in GitLab (low 3.5)
- [CVE-2022-23068](https://insights.sbomify.com/CVE-2022-23068/): ToolJet - HTML Injection in Invite New User (medium 5.4)
- [CVE-2022-23067](https://insights.sbomify.com/CVE-2022-23067/): ToolJet - Token Leakage via Referer Header (high 8.8)
- [CVE-2022-23066](https://insights.sbomify.com/CVE-2022-23066/): Solana rBPF - Incorrect Calculation in sdiv instruction (critical 9.1)
- [CVE-2022-23065](https://insights.sbomify.com/CVE-2022-23065/): Vendure - XSS via SVG File Upload (medium 5.4)
- [CVE-2022-23064](https://insights.sbomify.com/CVE-2022-23064/): Snipe-IT - Host Header Injection (high 8.8)
- [CVE-2022-23063](https://insights.sbomify.com/CVE-2022-23063/): Shopizer - Insufficient Session Expiration (high 8.8)
- [CVE-2022-23061](https://insights.sbomify.com/CVE-2022-23061/): Shopizer - IDOR delete superadmin (medium 6.5)
- [CVE-2022-23060](https://insights.sbomify.com/CVE-2022-23060/): Shopizer - Stored XSS in Manage Files (medium 4.8)
- [CVE-2022-2306](https://insights.sbomify.com/CVE-2022-2306/): Insufficient Session Expiration in heroiclabs/nakama (high 8.2)
- [CVE-2022-23059](https://insights.sbomify.com/CVE-2022-23059/): Shopizer - Stored XSS in Manage Images (medium 4.8)
- [CVE-2022-23058](https://insights.sbomify.com/CVE-2022-23058/): ERPNext - Stored XSS in My Settings (low 3.5)
- [CVE-2022-23057](https://insights.sbomify.com/CVE-2022-23057/): ERPNext - Stored XSS in My Profile (medium 5.4)
- [CVE-2022-23056](https://insights.sbomify.com/CVE-2022-23056/): ERPNext - Stored XSS leads to account takover (low 3.5)
- [CVE-2022-23055](https://insights.sbomify.com/CVE-2022-23055/): ERPNext - Improper user access conrol (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/385/