# Vulnerabilities published in 2022


- [CVE-2022-23054](https://insights.sbomify.com/CVE-2022-23054/): Openmct XSS via the “Summary Widget” (medium 6.1)
- [CVE-2022-23053](https://insights.sbomify.com/CVE-2022-23053/): Openmct XSS via the “Condition Widget” (medium 6.1)
- [CVE-2022-23052](https://insights.sbomify.com/CVE-2022-23052/): Cross-site request forgery in PeTeReport (medium 6.5)
- [CVE-2022-23051](https://insights.sbomify.com/CVE-2022-23051/): Cross-site scripting in PeTeReport (medium 5.4)
- [CVE-2022-23050](https://insights.sbomify.com/CVE-2022-23050/): File upload in ManageEngine AppManager15 (high 7.2)
- [CVE-2022-2305](https://insights.sbomify.com/CVE-2022-2305/): WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23049](https://insights.sbomify.com/CVE-2022-23049/): Cross-site scripting in Exponent CMS (medium 5.4)
- [CVE-2022-23048](https://insights.sbomify.com/CVE-2022-23048/): File upload in Exponent CMS (high 7.2)
- [CVE-2022-23047](https://insights.sbomify.com/CVE-2022-23047/): Cross-site scripting in Exponent CMS (medium 4.8)
- [CVE-2022-23046](https://insights.sbomify.com/CVE-2022-23046/): SQL injection in PhpIPAM (high 7.2)
- [CVE-2022-23045](https://insights.sbomify.com/CVE-2022-23045/): Cross-site scripting in PhpIPAM (medium 4.8)
- [CVE-2022-23044](https://insights.sbomify.com/CVE-2022-23044/): Cross-site request forgery in Tiny File Manager (high 8.8)
- [CVE-2022-23043](https://insights.sbomify.com/CVE-2022-23043/): File upload restriction bypass in Zenario CMS (high 7.2)
- [CVE-2022-23042](https://insights.sbomify.com/CVE-2022-23042/): Race condition in unspecified (high 7.0)
- [CVE-2022-23041](https://insights.sbomify.com/CVE-2022-23041/): Race condition in unspecified (high 7.0)
- [CVE-2022-23040](https://insights.sbomify.com/CVE-2022-23040/): Race condition in unspecified (high 7.0)
- [CVE-2022-2304](https://insights.sbomify.com/CVE-2022-2304/): Stack-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-23039](https://insights.sbomify.com/CVE-2022-23039/): Race condition in unspecified (high 7.0)
- [CVE-2022-23038](https://insights.sbomify.com/CVE-2022-23038/): Race condition in unspecified (high 7.0)
- [CVE-2022-23037](https://insights.sbomify.com/CVE-2022-23037/): Race condition in unspecified (high 7.0)
- [CVE-2022-23036](https://insights.sbomify.com/CVE-2022-23036/): Race condition in unspecified (high 7.0)
- [CVE-2022-23035](https://insights.sbomify.com/CVE-2022-23035/): Use after free in xen (medium 4.6)
- [CVE-2022-23034](https://insights.sbomify.com/CVE-2022-23034/): Integer overflow in xen (medium 5.5)
- [CVE-2022-23033](https://insights.sbomify.com/CVE-2022-23033/): Other in xen (high 7.8)
- [CVE-2022-23032](https://insights.sbomify.com/CVE-2022-23032/): Security feature bypass in BIG-IP Edge Client for Mac and Windows (medium 5.3)
- [CVE-2022-23031](https://insights.sbomify.com/CVE-2022-23031/): XML external entity in BIG-IP FPS, ASM, and Advanced WAF (medium 4.9)
- [CVE-2022-23030](https://insights.sbomify.com/CVE-2022-23030/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-2303](https://insights.sbomify.com/CVE-2022-2303/): Auth bypass in GitLab (medium 4.3)
- [CVE-2022-23029](https://insights.sbomify.com/CVE-2022-23029/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-23028](https://insights.sbomify.com/CVE-2022-23028/): Denial of service in BIG-IP AFM (medium 5.3)
- [CVE-2022-23027](https://insights.sbomify.com/CVE-2022-23027/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-23026](https://insights.sbomify.com/CVE-2022-23026/): Denial of service in BIG-IP ASM & Advanced WAF (medium 4.3)
- [CVE-2022-23025](https://insights.sbomify.com/CVE-2022-23025/): Null dereference in BIG-IP (high 7.5)
- [CVE-2022-23024](https://insights.sbomify.com/CVE-2022-23024/): Denial of service in BIG-IP AFM (high 7.5)
- [CVE-2022-23023](https://insights.sbomify.com/CVE-2022-23023/): Denial of service in BIG-IP & BIG-IQ (medium 6.5)
- [CVE-2022-23022](https://insights.sbomify.com/CVE-2022-23022/): Null dereference in BIG-IP (high 7.5)
- [CVE-2022-23021](https://insights.sbomify.com/CVE-2022-23021/): Null dereference in BIG-IP (high 7.5)
- [CVE-2022-23020](https://insights.sbomify.com/CVE-2022-23020/): Null dereference in BIG-IP (high 7.5)
- [CVE-2022-2302](https://insights.sbomify.com/CVE-2022-2302/): LENZE: Missing password verification in authorisation procedure (critical 9.8)
- [CVE-2022-23019](https://insights.sbomify.com/CVE-2022-23019/): Denial of service in BIG-IP (high 7.5)
- [CVE-2022-23018](https://insights.sbomify.com/CVE-2022-23018/): Denial of service in BIG-IP AFM (high 7.5)
- [CVE-2022-23017](https://insights.sbomify.com/CVE-2022-23017/): Null dereference in BIG-IP (high 7.5)
- [CVE-2022-23016](https://insights.sbomify.com/CVE-2022-23016/): Null dereference in BIG-IP (high 7.5)
- [CVE-2022-23015](https://insights.sbomify.com/CVE-2022-23015/): Denial of service in BIG-IP (high 7.5)
- [CVE-2022-23014](https://insights.sbomify.com/CVE-2022-23014/): Denial of service in BIG-IP APM (medium 6.5)
- [CVE-2022-23013](https://insights.sbomify.com/CVE-2022-23013/): Cross-site scripting in BIG-IP DNS & GTM (high 8.8)
- [CVE-2022-23012](https://insights.sbomify.com/CVE-2022-23012/): Memory corruption in BIG-IP (high 7.5)
- [CVE-2022-23011](https://insights.sbomify.com/CVE-2022-23011/): Denial of service in BIG-IP (high 7.5)
- [CVE-2022-23010](https://insights.sbomify.com/CVE-2022-23010/): Denial of service in BIG-IP (high 7.5)
- [CVE-2022-2301](https://insights.sbomify.com/CVE-2022-2301/): Buffer Over-read in hpjansson/chafa (medium 5.5)
- [CVE-2022-23009](https://insights.sbomify.com/CVE-2022-23009/): Missing authorization in BIG-IQ Centralized Management (high 7.2)
- [CVE-2022-23008](https://insights.sbomify.com/CVE-2022-23008/): Cross-site scripting in NGINX Controller API Management (medium 5.4)
- [CVE-2022-23006](https://insights.sbomify.com/CVE-2022-23006/): Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi (low 1.8)
- [CVE-2022-23005](https://insights.sbomify.com/CVE-2022-23005/): Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature (high 8.7)
- [CVE-2022-23004](https://insights.sbomify.com/CVE-2022-23004/): Algorithm incorrectly returning error and Invalid unreduced value written to output buffer (medium 5.3)
- [CVE-2022-23003](https://insights.sbomify.com/CVE-2022-23003/): Shared secret or Point multiplication of NIST P-256 points with X coordinate of zero (medium 5.3)
- [CVE-2022-23002](https://insights.sbomify.com/CVE-2022-23002/): Point Compression/Decompression of NIST P-256 points with X coordinate of zero (medium 5.3)
- [CVE-2022-23001](https://insights.sbomify.com/CVE-2022-23001/): Sweet-B Library: Point compress/decompress using the wrong bit for sign (medium 5.3)
- [CVE-2022-23000](https://insights.sbomify.com/CVE-2022-23000/): Weak Default SSL use in Port Forwarding Service (high 7.3)
- [CVE-2022-2300](https://insights.sbomify.com/CVE-2022-2300/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 6.3)
- [CVE-2022-22999](https://insights.sbomify.com/CVE-2022-22999/): Cross-site Scripting Vulnerability in USB Backups App (high 8.2)
- [CVE-2022-22998](https://insights.sbomify.com/CVE-2022-22998/): Protecting AWS credentials stored in plaintext on My Cloud Home (high 8.0)
- [CVE-2022-22997](https://insights.sbomify.com/CVE-2022-22997/): Command Injection Vulnerability on My Cloud Home (medium 6.8)
- [CVE-2022-22996](https://insights.sbomify.com/CVE-2022-22996/): SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation (high 7.8)
- [CVE-2022-22995](https://insights.sbomify.com/CVE-2022-22995/): Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk (critical 10.0)
- [CVE-2022-22994](https://insights.sbomify.com/CVE-2022-22994/): Insufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices. (high 8.8)
- [CVE-2022-22993](https://insights.sbomify.com/CVE-2022-22993/): Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices. (high 7.8)
- [CVE-2022-22992](https://insights.sbomify.com/CVE-2022-22992/): Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices. (high 7.8)
- [CVE-2022-22991](https://insights.sbomify.com/CVE-2022-22991/): Command injection through unsecured HTTP calls on Western Digital My Cloud devices (high 7.8)
- [CVE-2022-22990](https://insights.sbomify.com/CVE-2022-22990/): Limited authentication bypass vulnerability on Western Digital My Cloud devices (high 7.8)
- [CVE-2022-2299](https://insights.sbomify.com/CVE-2022-2299/): Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVG (medium 5.4)
- [CVE-2022-22989](https://insights.sbomify.com/CVE-2022-22989/): Pre-authenticated stack overflow vulnerability on FTP Service (critical 9.8)
- [CVE-2022-22988](https://insights.sbomify.com/CVE-2022-22988/): Insecure file and directory permissions on EdgeRover (high 7.7)
- [CVE-2022-22987](https://insights.sbomify.com/CVE-2022-22987/): Advantech ADAM-3600 (critical 9.8)
- [CVE-2022-22986](https://insights.sbomify.com/CVE-2022-22986/): Command injection in Netcommunity OG410X and OG810X series (high 8.8)
- [CVE-2022-22985](https://insights.sbomify.com/CVE-2022-22985/): ICSA-22-062-01 IPCOMM ipDIO (high 8.8)
- [CVE-2022-22984](https://insights.sbomify.com/CVE-2022-22984/): Command Injection (medium 5.0)
- [CVE-2022-22983](https://insights.sbomify.com/CVE-2022-22983/): Information disclosure in VMware Workstation (medium 5.9)
- [CVE-2022-22982](https://insights.sbomify.com/CVE-2022-22982/): Server-side request forgery in VMware vCenter Server (high 7.5)
- [CVE-2022-22980](https://insights.sbomify.com/CVE-2022-22980/): SpEL Injection in Spring Data MongoDB (critical 9.8)
- [CVE-2022-2298](https://insights.sbomify.com/CVE-2022-2298/): SourceCodester Clinics Patient Management System Login Page index.php sql injection (high 7.3)
- [CVE-2022-22979](https://insights.sbomify.com/CVE-2022-22979/): Denial of Service in Spring Cloud Function (high 7.5)
- [CVE-2022-22978](https://insights.sbomify.com/CVE-2022-22978/): Authorization bypass in Spring Security (critical 9.8)
- [CVE-2022-22977](https://insights.sbomify.com/CVE-2022-22977/): XML external entity in VMware Tools for Windows (high 7.1)
- [CVE-2022-22976](https://insights.sbomify.com/CVE-2022-22976/): Integer overflow in BCrypt class in Spring Security (medium 5.3)
- [CVE-2022-22975](https://insights.sbomify.com/CVE-2022-22975/): Other in Pinniped (medium 6.6)
- [CVE-2022-22973](https://insights.sbomify.com/CVE-2022-22973/): Privilege escalation in VMware Workspace ONE Access and Identity Manager. (high 7.8)
- [CVE-2022-22972](https://insights.sbomify.com/CVE-2022-22972/): Auth bypass in VMware Workspace ONE Access, Identity Manager and vRealize Automation (critical 9.8)
- [CVE-2022-22971](https://insights.sbomify.com/CVE-2022-22971/): Allocation of Resources Without Limits or Throttling in Spring Framework (medium 6.5)
- [CVE-2022-22970](https://insights.sbomify.com/CVE-2022-22970/): Denial of service in Spring Framework (medium 5.3)
- [CVE-2022-2297](https://insights.sbomify.com/CVE-2022-2297/): SourceCodester Clinics Patient Management System unrestricted upload (medium 6.3)
- [CVE-2022-22969](https://insights.sbomify.com/CVE-2022-22969/): Denial of service in Spring Security OAuth2 (medium 6.5)
- [CVE-2022-22968](https://insights.sbomify.com/CVE-2022-22968/): Improper handling of case sensitivity in Spring Framework (medium 5.3)
- [CVE-2022-22967](https://insights.sbomify.com/CVE-2022-22967/): Salt's PAM auth fails to reject locked accounts (high 8.8)
- [CVE-2022-22966](https://insights.sbomify.com/CVE-2022-22966/): Other in VMware Cloud Director (high 7.2)
- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-22964](https://insights.sbomify.com/CVE-2022-22964/): Privilege escalation in VMware Horizon Agent for Linux (high 7.8)
- [CVE-2022-22963](https://insights.sbomify.com/CVE-2022-22963/): VMware Tanzu Spring Cloud Function Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-22962](https://insights.sbomify.com/CVE-2022-22962/): Privilege escalation in VMware Horizon Agent for Linux (high 7.8)
- [CVE-2022-22961](https://insights.sbomify.com/CVE-2022-22961/): Information disclosure in VMware Workspace ONE Access, Identity Manager and vRealize Automation (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/386/