# Vulnerabilities published in 2022


- [CVE-2022-22605](https://insights.sbomify.com/CVE-2022-22605/): Memory corruption in Xcode (high 7.8)
- [CVE-2022-22604](https://insights.sbomify.com/CVE-2022-22604/): Memory corruption in Xcode (high 7.8)
- [CVE-2022-22603](https://insights.sbomify.com/CVE-2022-22603/): Memory corruption in Xcode (high 7.8)
- [CVE-2022-22602](https://insights.sbomify.com/CVE-2022-22602/): Memory corruption in Xcode (high 7.8)
- [CVE-2022-22601](https://insights.sbomify.com/CVE-2022-22601/): Memory corruption in Xcode (high 7.8)
- [CVE-2022-22600](https://insights.sbomify.com/CVE-2022-22600/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2022-2260](https://insights.sbomify.com/CVE-2022-2260/): GiveWP < 2.21.3 - DoS via CSRF (medium 6.5)
- [CVE-2022-22599](https://insights.sbomify.com/CVE-2022-22599/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2022-22598](https://insights.sbomify.com/CVE-2022-22598/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2022-22597](https://insights.sbomify.com/CVE-2022-22597/): Memory corruption in macOS (high 7.8)
- [CVE-2022-22596](https://insights.sbomify.com/CVE-2022-22596/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2022-22594](https://insights.sbomify.com/CVE-2022-22594/): Security feature bypass in iOS and iPadOS (medium 6.5)
- [CVE-2022-22593](https://insights.sbomify.com/CVE-2022-22593/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2022-22592](https://insights.sbomify.com/CVE-2022-22592/): Security feature bypass in iOS and iPadOS (medium 6.5)
- [CVE-2022-22591](https://insights.sbomify.com/CVE-2022-22591/): Memory corruption in macOS (high 7.8)
- [CVE-2022-22590](https://insights.sbomify.com/CVE-2022-22590/): Use after free in iOS and iPadOS (high 8.8)
- [CVE-2022-2259](https://insights.sbomify.com/CVE-2022-2259/): Missing authorization in Octopus Server (medium 4.3)
- [CVE-2022-22589](https://insights.sbomify.com/CVE-2022-22589/): Cross-site scripting in iOS and iPadOS (medium 6.1)
- [CVE-2022-22588](https://insights.sbomify.com/CVE-2022-22588/): Denial of service in iOS and iPadOS (medium 5.5)
- [CVE-2022-22587](https://insights.sbomify.com/CVE-2022-22587/): Apple Memory Corruption (critical 9.8, exploited in the wild)
- [CVE-2022-22586](https://insights.sbomify.com/CVE-2022-22586/): Memory corruption in macOS (critical 9.8)
- [CVE-2022-22585](https://insights.sbomify.com/CVE-2022-22585/): Path traversal in iOS and iPadOS (high 7.5)
- [CVE-2022-22584](https://insights.sbomify.com/CVE-2022-22584/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2022-22583](https://insights.sbomify.com/CVE-2022-22583/): Security feature bypass in macOS (medium 5.5)
- [CVE-2022-22582](https://insights.sbomify.com/CVE-2022-22582/): Path traversal in macOS (medium 5.5)
- [CVE-2022-2258](https://insights.sbomify.com/CVE-2022-2258/): Missing authorization in Octopus Server (medium 4.3)
- [CVE-2022-22579](https://insights.sbomify.com/CVE-2022-22579/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2022-22578](https://insights.sbomify.com/CVE-2022-22578/): Privilege escalation in iOS and iPadOS (high 7.8)
- [CVE-2022-22577](https://insights.sbomify.com/CVE-2022-22577/): Cross-site Scripting Vulnerability in Action Pack (medium 6.1)
- [CVE-2022-22576](https://insights.sbomify.com/CVE-2022-22576/): Auth bypass in https://github.com/curl/curl (high 8.1)
- [CVE-2022-22572](https://insights.sbomify.com/CVE-2022-22572/): Privilege escalation in Ivanti Incapptic Connect (high 8.8)
- [CVE-2022-22571](https://insights.sbomify.com/CVE-2022-22571/): Cross-site scripting in Ivanti Incapptic Connect (medium 4.8)
- [CVE-2022-22570](https://insights.sbomify.com/CVE-2022-22570/): Memory corruption in UniFi Door Access Reader Lite (critical 10.0)
- [CVE-2022-2257](https://insights.sbomify.com/CVE-2022-2257/): Out-of-bounds Read in vim/vim (high 7.8)
- [CVE-2022-22567](https://insights.sbomify.com/CVE-2022-22567/): Security feature bypass in CPG BIOS (medium 4.7)
- [CVE-2022-22566](https://insights.sbomify.com/CVE-2022-22566/): Security feature bypass in CPG BIOS (medium 6.9)
- [CVE-2022-22565](https://insights.sbomify.com/CVE-2022-22565/): Missing authorization in PowerScale OneFS (medium 4.7)
- [CVE-2022-22564](https://insights.sbomify.com/CVE-2022-22564/): Weak cryptography in Unity (medium 5.9)
- [CVE-2022-22563](https://insights.sbomify.com/CVE-2022-22563/): Information disclosure in PowerScale OneFS (medium 4.4)
- [CVE-2022-22562](https://insights.sbomify.com/CVE-2022-22562/): Denial of service in PowerScale OneFS (high 7.5)
- [CVE-2022-22561](https://insights.sbomify.com/CVE-2022-22561/): Auth bypass in PowerScale OneFS (high 8.1)
- [CVE-2022-22560](https://insights.sbomify.com/CVE-2022-22560/): Hardcoded credentials in PowerScale OneFS (high 7.1)
- [CVE-2022-2256](https://insights.sbomify.com/CVE-2022-2256/): Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles (low 3.8)
- [CVE-2022-22559](https://insights.sbomify.com/CVE-2022-22559/): Weak cryptography in PowerScale OneFS (high 7.5)
- [CVE-2022-22558](https://insights.sbomify.com/CVE-2022-22558/): Memory corruption in PowerEdge Platform (medium 5.7)
- [CVE-2022-22557](https://insights.sbomify.com/CVE-2022-22557/): Information disclosure in PowerStore (high 7.5)
- [CVE-2022-22556](https://insights.sbomify.com/CVE-2022-22556/): Denial of service in PowerStore (low 3.7)
- [CVE-2022-22555](https://insights.sbomify.com/CVE-2022-22555/): Command injection in PowerStore (medium 6.0)
- [CVE-2022-22554](https://insights.sbomify.com/CVE-2022-22554/): Information disclosure in DellEMC System Update - DSU (high 8.2)
- [CVE-2022-22553](https://insights.sbomify.com/CVE-2022-22553/): Auth bypass in AppSync (high 8.1)
- [CVE-2022-22552](https://insights.sbomify.com/CVE-2022-22552/): Other in AppSync (medium 6.9)
- [CVE-2022-22551](https://insights.sbomify.com/CVE-2022-22551/): Information disclosure in AppSync (high 8.3)
- [CVE-2022-22550](https://insights.sbomify.com/CVE-2022-22550/): Information disclosure in PowerScale OneFS (medium 6.7)
- [CVE-2022-2255](https://insights.sbomify.com/CVE-2022-2255/): Incorrect header handling in mod-wsgi (high 7.5)
- [CVE-2022-22549](https://insights.sbomify.com/CVE-2022-22549/): Security feature bypass in PowerScale OneFS (high 7.5)
- [CVE-2022-22547](https://insights.sbomify.com/CVE-2022-22547/): Information disclosure in Simple Diagnostics Agent (high 7.5)
- [CVE-2022-22546](https://insights.sbomify.com/CVE-2022-22546/): Cross-site scripting in SAP Business Objects Web Intelligence (BI Launchpad) (medium 5.4)
- [CVE-2022-22545](https://insights.sbomify.com/CVE-2022-22545/): Information disclosure in SAP NetWeaver Application Server ABAP and ABAP Platform (medium 4.9)
- [CVE-2022-22544](https://insights.sbomify.com/CVE-2022-22544/): Missing authorization in SAP Solution Manager (Diagnostics Root Cause Analysis Tools) (critical 9.1)
- [CVE-2022-22543](https://insights.sbomify.com/CVE-2022-22543/): Denial of service in SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) (high 7.5)
- [CVE-2022-22542](https://insights.sbomify.com/CVE-2022-22542/): Information disclosure in SAP S/4HANA (Supplier Factsheet and Enterprise Search for Business Partner, Supplier and Customer) (medium 6.5)
- [CVE-2022-22541](https://insights.sbomify.com/CVE-2022-22541/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (medium 6.5)
- [CVE-2022-22540](https://insights.sbomify.com/CVE-2022-22540/): SQL injection in SAP NetWeaver AS ABAP (Workplace Server) (high 7.5)
- [CVE-2022-2254](https://insights.sbomify.com/CVE-2022-2254/): Distributed Data Systems WebHMI Cross-site Scripting (medium 6.2)
- [CVE-2022-22539](https://insights.sbomify.com/CVE-2022-22539/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-22538](https://insights.sbomify.com/CVE-2022-22538/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-22537](https://insights.sbomify.com/CVE-2022-22537/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-22536](https://insights.sbomify.com/CVE-2022-22536/): SAP Multiple Products HTTP Request Smuggling (critical 9.8, exploited in the wild)
- [CVE-2022-22535](https://insights.sbomify.com/CVE-2022-22535/): Missing authorization in SAP ERP HCM (Portugal) (medium 6.5)
- [CVE-2022-22534](https://insights.sbomify.com/CVE-2022-22534/): Cross-site scripting in SAP NetWeaver (ABAP and Java application Servers) (medium 6.1)
- [CVE-2022-22533](https://insights.sbomify.com/CVE-2022-22533/): Denial of service in SAP NetWeaver Application Server Java (high 7.5)
- [CVE-2022-22532](https://insights.sbomify.com/CVE-2022-22532/): Other in SAP NetWeaver Application Server Java (critical 9.8)
- [CVE-2022-22531](https://insights.sbomify.com/CVE-2022-22531/): File upload in SAP S/4HANA (high 8.1)
- [CVE-2022-22530](https://insights.sbomify.com/CVE-2022-22530/): File upload in SAP S/4HANA (high 8.1)
- [CVE-2022-2253](https://insights.sbomify.com/CVE-2022-2253/): Distributed Data Systems WebHMI OS Command Injection (critical 9.1)
- [CVE-2022-22529](https://insights.sbomify.com/CVE-2022-22529/): Cross-site scripting in SAP Enterprise Threat Detection (medium 6.1)
- [CVE-2022-22528](https://insights.sbomify.com/CVE-2022-22528/): Privilege escalation in SAP Adaptive Server Enterprise (high 7.8)
- [CVE-2022-22526](https://insights.sbomify.com/CVE-2022-22526/): Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server (critical 9.8)
- [CVE-2022-22525](https://insights.sbomify.com/CVE-2022-22525/): Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection (high 7.2)
- [CVE-2022-22524](https://insights.sbomify.com/CVE-2022-22524/): SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access (critical 9.4)
- [CVE-2022-22523](https://insights.sbomify.com/CVE-2022-22523/): Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass (high 7.5)
- [CVE-2022-22522](https://insights.sbomify.com/CVE-2022-22522/): Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device (critical 9.8)
- [CVE-2022-22521](https://insights.sbomify.com/CVE-2022-22521/): Privilege Escalation in Miele Benchmark Programming Tool (high 7.3)
- [CVE-2022-22520](https://insights.sbomify.com/CVE-2022-22520/): User enumeration vulnerability in MB connect line and Helmholz products (medium 5.3)
- [CVE-2022-2252](https://insights.sbomify.com/CVE-2022-2252/): Open Redirect in microweber/microweber (medium 4.3)
- [CVE-2022-22519](https://insights.sbomify.com/CVE-2022-22519/): Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system. (high 7.5)
- [CVE-2022-22518](https://insights.sbomify.com/CVE-2022-22518/): A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy. (medium 6.5)
- [CVE-2022-22517](https://insights.sbomify.com/CVE-2022-22517/): Communication Components in multiple CODESYS products vulnerable to communication channel disruption (high 7.5)
- [CVE-2022-22516](https://insights.sbomify.com/CVE-2022-22516/): CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space. (high 7.8)
- [CVE-2022-22515](https://insights.sbomify.com/CVE-2022-22515/): A component of the CODESYS Control runtime system allows read and write access to configuration files (high 8.1)
- [CVE-2022-22514](https://insights.sbomify.com/CVE-2022-22514/): Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS. (high 7.1)
- [CVE-2022-22513](https://insights.sbomify.com/CVE-2022-22513/): Null Pointer Dereference in multiple CODESYS products can lead to a DoS. (medium 6.5)
- [CVE-2022-22512](https://insights.sbomify.com/CVE-2022-22512/): VARTA: Multiple devices prone to hard-coded credentials (critical 9.8)
- [CVE-2022-22511](https://insights.sbomify.com/CVE-2022-22511/): WAGO PLCs WBM vulnerable to reflected XSS (medium 5.4)
- [CVE-2022-22510](https://insights.sbomify.com/CVE-2022-22510/): CODESYS: Null Pointer Dereference in CODESYS PROFINET stack (high 7.5)
- [CVE-2022-2251](https://insights.sbomify.com/CVE-2022-2251/): Command injection in GitLab Runner (medium 4.8)
- [CVE-2022-22509](https://insights.sbomify.com/CVE-2022-22509/): PHOENIX CONTACT: FL SWITCH 2xxx series incorrect privilege assignment (high 8.8)
- [CVE-2022-22508](https://insights.sbomify.com/CVE-2022-22508/): CODESYS V3: Improper Input Validation (medium 4.3)
- [CVE-2022-22506](https://insights.sbomify.com/CVE-2022-22506/): IBM Robotic Process Automation information disclosure (medium 4.6)
- [CVE-2022-22505](https://insights.sbomify.com/CVE-2022-22505/): Information disclosure in Robotic Process Automation (medium 4.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/390/