# Vulnerabilities published in 2022


- [CVE-2022-22960](https://insights.sbomify.com/CVE-2022-22960/): VMware Multiple Products Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2022-2296](https://insights.sbomify.com/CVE-2022-2296/): Use after free in Chrome (high 8.8)
- [CVE-2022-22959](https://insights.sbomify.com/CVE-2022-22959/): Cross-site request forgery in VMware Workspace ONE Access, Identity Manager and vRealize Automation (medium 4.3)
- [CVE-2022-22958](https://insights.sbomify.com/CVE-2022-22958/): Deserialization in VMware Workspace ONE Access, Identity Manager and vRealize Automation. (high 7.2)
- [CVE-2022-22957](https://insights.sbomify.com/CVE-2022-22957/): Deserialization in VMware Workspace ONE Access, Identity Manager and vRealize Automation. (high 7.2)
- [CVE-2022-22956](https://insights.sbomify.com/CVE-2022-22956/): Auth bypass in VMware Workspace ONE Access (critical 9.8)
- [CVE-2022-22955](https://insights.sbomify.com/CVE-2022-22955/): Auth bypass in VMware Workspace ONE Access (critical 9.8)
- [CVE-2022-22954](https://insights.sbomify.com/CVE-2022-22954/): VMware Workspace ONE Access and Identity Manager Server-Side Template Injection (critical 9.8, exploited in the wild)
- [CVE-2022-22953](https://insights.sbomify.com/CVE-2022-22953/): Information disclosure in VMware HCX (medium 6.5)
- [CVE-2022-22952](https://insights.sbomify.com/CVE-2022-22952/): File upload in VMware Carbon Black App Control (AppC) (critical 9.1)
- [CVE-2022-22951](https://insights.sbomify.com/CVE-2022-22951/): Command injection in VMware Carbon Black App Control (AppC) (critical 9.1)
- [CVE-2022-22950](https://insights.sbomify.com/CVE-2022-22950/): Allocation of Resources Without Limits or Throttling in Spring Framework (medium 6.5)
- [CVE-2022-2295](https://insights.sbomify.com/CVE-2022-2295/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-22948](https://insights.sbomify.com/CVE-2022-22948/): VMware vCenter Server Incorrect Default File Permissions Vulnerability (medium 6.5, exploited in the wild)
- [CVE-2022-22947](https://insights.sbomify.com/CVE-2022-22947/): VMware Spring Cloud Gateway Code Injection (critical 10.0, exploited in the wild)
- [CVE-2022-22946](https://insights.sbomify.com/CVE-2022-22946/): Security feature bypass in Spring Cloud Gateway (medium 5.5)
- [CVE-2022-22945](https://insights.sbomify.com/CVE-2022-22945/): Command injection in VMware NSX Edge (high 7.8)
- [CVE-2022-22944](https://insights.sbomify.com/CVE-2022-22944/): Cross-site scripting in VMware Workspace ONE Boxer (medium 5.4)
- [CVE-2022-22943](https://insights.sbomify.com/CVE-2022-22943/): Privilege escalation in VMware Tools for Windows (medium 6.7)
- [CVE-2022-22942](https://insights.sbomify.com/CVE-2022-22942/): Use after free in Photon OS (high 7.8)
- [CVE-2022-22941](https://insights.sbomify.com/CVE-2022-22941/): SaltStack Salt Permissions Bypass (high 8.8)
- [CVE-2022-2294](https://insights.sbomify.com/CVE-2022-2294/): WebRTC Heap Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2022-22939](https://insights.sbomify.com/CVE-2022-22939/): Information disclosure in VMware Cloud Foundation (medium 4.9)
- [CVE-2022-22938](https://insights.sbomify.com/CVE-2022-22938/): Denial of service in vmware:horizon (medium 6.5)
- [CVE-2022-22936](https://insights.sbomify.com/CVE-2022-22936/): SaltStack Salt Authentication Bypass by Capture-replay (high 8.8)
- [CVE-2022-22935](https://insights.sbomify.com/CVE-2022-22935/): SaltStack Salt Improper Authentication via Man in the Middle Attack (low 3.7)
- [CVE-2022-22934](https://insights.sbomify.com/CVE-2022-22934/): SaltStack Improper Verification of Cryptographic Signature (high 8.8)
- [CVE-2022-22932](https://insights.sbomify.com/CVE-2022-22932/): Path traversal flaws (medium 5.3)
- [CVE-2022-22931](https://insights.sbomify.com/CVE-2022-22931/): Path traversal in Apache James 3.6.1 (medium 4.3)
- [CVE-2022-22930](https://insights.sbomify.com/CVE-2022-22930/): RCE in Mingsoft MCMS (critical 9.8)
- [CVE-2022-2293](https://insights.sbomify.com/CVE-2022-2293/): SourceCodester Simple Sales Management System create cross site scripting (low 3.5)
- [CVE-2022-22929](https://insights.sbomify.com/CVE-2022-22929/): Arbitrary File Upload in Mingsoft MCMS (critical 9.8)
- [CVE-2022-22928](https://insights.sbomify.com/CVE-2022-22928/): Hardcoded credentials in mingsoft:mcms (critical 9.8)
- [CVE-2022-22922](https://insights.sbomify.com/CVE-2022-22922/): Weak cryptography in tp-link:tl-wa850re firmware (critical 9.8)
- [CVE-2022-2292](https://insights.sbomify.com/CVE-2022-2292/): SourceCodester Hotel Management System Room Edit Page 1 cross site scripting (low 3.5)
- [CVE-2022-22919](https://insights.sbomify.com/CVE-2022-22919/): Open redirect in adenza:axiomsl controllerview (medium 6.1)
- [CVE-2022-22916](https://insights.sbomify.com/CVE-2022-22916/): Code injection in zoneland:o2oa (critical 9.8)
- [CVE-2022-22914](https://insights.sbomify.com/CVE-2022-22914/): Path traversal in ovidentia:ovidentia (high 7.5)
- [CVE-2022-22912](https://insights.sbomify.com/CVE-2022-22912/): Prototype pollution in Plist before 3.0.5 can cause denial of service (critical 9.8)
- [CVE-2022-2291](https://insights.sbomify.com/CVE-2022-2291/): SourceCodester Hotel Management System Search search cross site scripting (medium 4.3)
- [CVE-2022-22909](https://insights.sbomify.com/CVE-2022-22909/): Code injection in digitaldruid:hoteldruid (high 8.8)
- [CVE-2022-22908](https://insights.sbomify.com/CVE-2022-22908/): Information disclosure in sangfor:vdi client (medium 5.5)
- [CVE-2022-22901](https://insights.sbomify.com/CVE-2022-22901/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2022-2290](https://insights.sbomify.com/CVE-2022-2290/): Cross-site Scripting (XSS) - Reflected in zadam/trilium (medium 6.4)
- [CVE-2022-22899](https://insights.sbomify.com/CVE-2022-22899/): Memory corruption in coreftp:core ftp (medium 5.5)
- [CVE-2022-22897](https://insights.sbomify.com/CVE-2022-22897/): SQL injection in apollotheme:ap pagebuilder (critical 9.8)
- [CVE-2022-22895](https://insights.sbomify.com/CVE-2022-22895/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2022-22894](https://insights.sbomify.com/CVE-2022-22894/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2022-22893](https://insights.sbomify.com/CVE-2022-22893/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2022-22892](https://insights.sbomify.com/CVE-2022-22892/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2022-22891](https://insights.sbomify.com/CVE-2022-22891/): Null dereference in jerryscript:jerryscript (medium 5.5)
- [CVE-2022-22890](https://insights.sbomify.com/CVE-2022-22890/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2022-2289](https://insights.sbomify.com/CVE-2022-2289/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-22888](https://insights.sbomify.com/CVE-2022-22888/): Memory corruption in jerryscript:jerryscript (high 7.8)
- [CVE-2022-22885](https://insights.sbomify.com/CVE-2022-22885/): Improper Certificate Validation in Hutool (critical 9.8)
- [CVE-2022-22881](https://insights.sbomify.com/CVE-2022-22881/): SQL Injection in Jeecg-boot (critical 9.8)
- [CVE-2022-22880](https://insights.sbomify.com/CVE-2022-22880/): SQL Injection in Jeecg-boot (critical 9.8)
- [CVE-2022-2288](https://insights.sbomify.com/CVE-2022-2288/): Out-of-bounds Write in vim/vim (high 7.8)
- [CVE-2022-2287](https://insights.sbomify.com/CVE-2022-2287/): Out-of-bounds Read in vim/vim (high 8.0)
- [CVE-2022-22868](https://insights.sbomify.com/CVE-2022-22868/): Cross-site scripting in gibbonedu:gibbon (medium 4.8)
- [CVE-2022-2286](https://insights.sbomify.com/CVE-2022-2286/): Out-of-bounds Read in vim/vim (high 7.8)
- [CVE-2022-22854](https://insights.sbomify.com/CVE-2022-22854/): Missing authorization in hospital\'s patient records management system project:hospital\'s patient records management system (high 8.8)
- [CVE-2022-22853](https://insights.sbomify.com/CVE-2022-22853/): Cross-site scripting in hospital\'s patient records management system project:hospital\'s patient records management system (medium 5.4)
- [CVE-2022-22852](https://insights.sbomify.com/CVE-2022-22852/): Cross-site scripting in hospital\'s patient records management system project:hospital\'s patient records management system (medium 5.4)
- [CVE-2022-22851](https://insights.sbomify.com/CVE-2022-22851/): Cross-site scripting in hospital\'s patient records management system project:hospital\'s patient records management system (medium 5.4)
- [CVE-2022-22850](https://insights.sbomify.com/CVE-2022-22850/): Cross-site scripting in hospital\'s patient records management system project:hospital\'s patient records management system (medium 5.4)
- [CVE-2022-2285](https://insights.sbomify.com/CVE-2022-2285/): Integer Overflow or Wraparound in vim/vim (high 7.8)
- [CVE-2022-22847](https://insights.sbomify.com/CVE-2022-22847/): Path traversal in formpipe:lasernet (critical 9.8)
- [CVE-2022-22846](https://insights.sbomify.com/CVE-2022-22846/): dnslib has DNS reply verification issue (high 7.5)
- [CVE-2022-22845](https://insights.sbomify.com/CVE-2022-22845/): Hardcoded credentials in qxip:homer webapp (critical 9.8)
- [CVE-2022-22844](https://insights.sbomify.com/CVE-2022-22844/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-2284](https://insights.sbomify.com/CVE-2022-2284/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-22836](https://insights.sbomify.com/CVE-2022-22836/): Path traversal in coreftp:core ftp (medium 6.5)
- [CVE-2022-22835](https://insights.sbomify.com/CVE-2022-22835/): XML external entity in overit:geocall (medium 6.5)
- [CVE-2022-22834](https://insights.sbomify.com/CVE-2022-22834/): Code injection in overit:geocall (high 8.8)
- [CVE-2022-22833](https://insights.sbomify.com/CVE-2022-22833/): Information disclosure in servisnet:tessa (high 7.5)
- [CVE-2022-22832](https://insights.sbomify.com/CVE-2022-22832/): Missing authorization in servisnet:tessa (critical 9.8)
- [CVE-2022-22831](https://insights.sbomify.com/CVE-2022-22831/): Auth bypass in servisnet:tessa (critical 9.8)
- [CVE-2022-22828](https://insights.sbomify.com/CVE-2022-22828/): Missing authorization in synametrics:synaman (high 7.5)
- [CVE-2022-22827](https://insights.sbomify.com/CVE-2022-22827/): Integer overflow in debian:debian linux (high 8.8)
- [CVE-2022-22826](https://insights.sbomify.com/CVE-2022-22826/): Integer overflow in debian:debian linux (high 8.8)
- [CVE-2022-22825](https://insights.sbomify.com/CVE-2022-22825/): Integer overflow in debian:debian linux (high 8.8)
- [CVE-2022-22824](https://insights.sbomify.com/CVE-2022-22824/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-22823](https://insights.sbomify.com/CVE-2022-22823/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-22822](https://insights.sbomify.com/CVE-2022-22822/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-22821](https://insights.sbomify.com/CVE-2022-22821/): Path Traversal in nemo-toolkit (low 2.0)
- [CVE-2022-22820](https://insights.sbomify.com/CVE-2022-22820/): Denial of service in LINE for Windows (medium 5.5)
- [CVE-2022-22819](https://insights.sbomify.com/CVE-2022-22819/): Memory corruption in nxp:lpc55s66jbd100 firmware (high 7.8)
- [CVE-2022-22818](https://insights.sbomify.com/CVE-2022-22818/): Cross-site Scripting in Django (medium 6.1)
- [CVE-2022-22817](https://insights.sbomify.com/CVE-2022-22817/): Arbitrary expression injection in Pillow (critical 9.8)
- [CVE-2022-22816](https://insights.sbomify.com/CVE-2022-22816/): Out-of-bounds Read in Pillow (medium 6.5)
- [CVE-2022-22815](https://insights.sbomify.com/CVE-2022-22815/): Improper Initialization in Pillow (medium 6.5)
- [CVE-2022-22814](https://insights.sbomify.com/CVE-2022-22814/): Privilege escalation in asus:myasus (critical 9.8)
- [CVE-2022-22813](https://insights.sbomify.com/CVE-2022-22813/): Hardcoded credentials in Easergy P40 Series model numbers with Ethernet option bit as Q, R, S (All PX4X firmware Versions) (critical 9.8)
- [CVE-2022-22812](https://insights.sbomify.com/CVE-2022-22812/): Cross-site scripting in spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) (medium 6.1)
- [CVE-2022-22811](https://insights.sbomify.com/CVE-2022-22811/): Cross-site request forgery in spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) (high 8.1)
- [CVE-2022-22810](https://insights.sbomify.com/CVE-2022-22810/): Auth bypass in spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) (critical 9.8)
- [CVE-2022-2281](https://insights.sbomify.com/CVE-2022-2281/): Information disclosure in GitLab (low 2.6)
- [CVE-2022-22809](https://insights.sbomify.com/CVE-2022-22809/): Missing authorization in spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) (medium 5.3)
- [CVE-2022-22808](https://insights.sbomify.com/CVE-2022-22808/): Cross-site request forgery in EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/387/