# Vulnerabilities published in 2022


- [CVE-2022-22370](https://insights.sbomify.com/CVE-2022-22370/): Cross-site scripting in Security Verify Access (medium 5.4)
- [CVE-2022-2237](https://insights.sbomify.com/CVE-2022-2237/): keycloak-connect contains Open redirect vulnerability in the Node.js adapter (medium 6.1)
- [CVE-2022-22369](https://insights.sbomify.com/CVE-2022-22369/): Other in Workload Scheduler (medium 6.2)
- [CVE-2022-22368](https://insights.sbomify.com/CVE-2022-22368/): Weak cryptography in Spectrum Scale (medium 5.9)
- [CVE-2022-22367](https://insights.sbomify.com/CVE-2022-22367/): Information disclosure in UrbanCode Deploy (medium 4.0)
- [CVE-2022-22366](https://insights.sbomify.com/CVE-2022-22366/): Information disclosure in UrbanCode Deploy (medium 4.9)
- [CVE-2022-22365](https://insights.sbomify.com/CVE-2022-22365/): Security feature bypass in WebSphere Application Server (medium 5.6)
- [CVE-2022-22364](https://insights.sbomify.com/CVE-2022-22364/): IBM Cognos Controller security bypass (medium 5.3)
- [CVE-2022-22363](https://insights.sbomify.com/CVE-2022-22363/): IBM Cognos Controller information disclosure (medium 4.3)
- [CVE-2022-22361](https://insights.sbomify.com/CVE-2022-22361/): Cross-site request forgery in Business Automation Workflow (medium 4.3)
- [CVE-2022-22360](https://insights.sbomify.com/CVE-2022-22360/): Other in Sterling Partner Engagement Manager (high 7.5)
- [CVE-2022-22359](https://insights.sbomify.com/CVE-2022-22359/): Cross-site request forgery in Sterling Partner Engagement Manager (medium 4.3)
- [CVE-2022-22358](https://insights.sbomify.com/CVE-2022-22358/): XML external entity in Sterling Partner Engagement Manager (high 7.1)
- [CVE-2022-22356](https://insights.sbomify.com/CVE-2022-22356/): Information disclosure in MQ Appliance (medium 5.3)
- [CVE-2022-22355](https://insights.sbomify.com/CVE-2022-22355/): Denial of service in MQ Appliance (medium 5.3)
- [CVE-2022-22354](https://insights.sbomify.com/CVE-2022-22354/): Denial of service in Spectrum Copy Data Management (medium 6.2)
- [CVE-2022-22353](https://insights.sbomify.com/CVE-2022-22353/): Security feature bypass in Big SQL on Cloud Pak for Data (medium 5.3)
- [CVE-2022-22352](https://insights.sbomify.com/CVE-2022-22352/): IBM Sterling B2B Integrator Standard Edition cross-site scripting (medium 5.4)
- [CVE-2022-22351](https://insights.sbomify.com/CVE-2022-22351/): Denial of service in AIX (medium 6.1)
- [CVE-2022-22350](https://insights.sbomify.com/CVE-2022-22350/): Denial of service in AIX (medium 6.2)
- [CVE-2022-2235](https://insights.sbomify.com/CVE-2022-2235/): Cross-site scripting in GitLab (high 8.7)
- [CVE-2022-22349](https://insights.sbomify.com/CVE-2022-22349/): Path traversal in Sterling External Authentication Server (medium 4.3)
- [CVE-2022-22348](https://insights.sbomify.com/CVE-2022-22348/): Other in Spectrum Protect Operations Center (medium 4.0)
- [CVE-2022-22346](https://insights.sbomify.com/CVE-2022-22346/): Cross-site request forgery in Spectrum Protect Operations Center (medium 4.3)
- [CVE-2022-22345](https://insights.sbomify.com/CVE-2022-22345/): Cross-site scripting in QRadar SIEM (medium 4.8)
- [CVE-2022-22344](https://insights.sbomify.com/CVE-2022-22344/): Other in Spectrum Copy Data Management (medium 4.8)
- [CVE-2022-2234](https://insights.sbomify.com/CVE-2022-2234/): mySCADA myPRO Command Injection (critical 9.9)
- [CVE-2022-22339](https://insights.sbomify.com/CVE-2022-22339/): Server-side request forgery in Planning Analytics (medium 6.5)
- [CVE-2022-22338](https://insights.sbomify.com/CVE-2022-22338/): IBM Sterling B2B Integrator Standard Edition SQL injection (medium 6.3)
- [CVE-2022-22337](https://insights.sbomify.com/CVE-2022-22337/): IBM Sterling B2B Integrator Standard Edition information disclosure (medium 4.3)
- [CVE-2022-22336](https://insights.sbomify.com/CVE-2022-22336/): Denial of service in Sterling Secure Proxy (high 7.5)
- [CVE-2022-22334](https://insights.sbomify.com/CVE-2022-22334/): Missing authorization in Robotic Process Automation (medium 4.2)
- [CVE-2022-22333](https://insights.sbomify.com/CVE-2022-22333/): Memory corruption in Sterling Secure Proxy (medium 6.5)
- [CVE-2022-22332](https://insights.sbomify.com/CVE-2022-22332/): Auth bypass in Sterling Partner Engagement Manager (medium 5.6)
- [CVE-2022-22331](https://insights.sbomify.com/CVE-2022-22331/): Missing authorization in SterlingPartner Engagement Manager (medium 5.4)
- [CVE-2022-22330](https://insights.sbomify.com/CVE-2022-22330/): Misconfiguration in Control Desk (low 3.7)
- [CVE-2022-2233](https://insights.sbomify.com/CVE-2022-2233/): Banner Cycler <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-22329](https://insights.sbomify.com/CVE-2022-22329/): Information disclosure in Control Desk (medium 4.3)
- [CVE-2022-22328](https://insights.sbomify.com/CVE-2022-22328/): Privilege escalation in SterlingPartner Engagement Manager (medium 6.2)
- [CVE-2022-22327](https://insights.sbomify.com/CVE-2022-22327/): Weak cryptography in UrbanCode Deploy (medium 5.9)
- [CVE-2022-22326](https://insights.sbomify.com/CVE-2022-22326/): Missing authorization in DataPower Gateway (medium 4.0)
- [CVE-2022-22325](https://insights.sbomify.com/CVE-2022-22325/): Information disclosure in MQ for HPE NonStop (medium 5.1)
- [CVE-2022-22323](https://insights.sbomify.com/CVE-2022-22323/): Memory corruption in Security Verify Password Synchronization Plug-in for Windows AD (medium 5.7)
- [CVE-2022-22322](https://insights.sbomify.com/CVE-2022-22322/): Cross-site scripting in InfoSphere Information Server (medium 5.4)
- [CVE-2022-22321](https://insights.sbomify.com/CVE-2022-22321/): Weak cryptography in MQ Appliance (medium 5.1)
- [CVE-2022-22320](https://insights.sbomify.com/CVE-2022-22320/): Cross-site scripting in QRadar SIEM (medium 4.8)
- [CVE-2022-2232](https://insights.sbomify.com/CVE-2022-2232/): Keycloak: ldap injection on username input (high 7.5)
- [CVE-2022-22319](https://insights.sbomify.com/CVE-2022-22319/): Missing authorization in Robotic Process Automation (medium 4.6)
- [CVE-2022-22318](https://insights.sbomify.com/CVE-2022-22318/): Auth bypass in Curam Social Program Management (medium 5.9)
- [CVE-2022-22317](https://insights.sbomify.com/CVE-2022-22317/): Auth bypass in Curam Social Program Management (medium 5.9)
- [CVE-2022-22316](https://insights.sbomify.com/CVE-2022-22316/): Missing authorization in MQ Appliance (medium 5.3)
- [CVE-2022-22315](https://insights.sbomify.com/CVE-2022-22315/): Privilege escalation in UrbanCode Deploy (medium 5.0)
- [CVE-2022-22314](https://insights.sbomify.com/CVE-2022-22314/): Information disclosure in Planning Analytics Workspace (medium 4.0)
- [CVE-2022-22313](https://insights.sbomify.com/CVE-2022-22313/): IBM QRadar Data Synchronization App information disclosure (medium 4.4)
- [CVE-2022-22312](https://insights.sbomify.com/CVE-2022-22312/): Memory corruption in Security Verify Password Synchronization Plug-in for Windows AD (medium 5.7)
- [CVE-2022-22311](https://insights.sbomify.com/CVE-2022-22311/): Auth bypass in Security Verify Access (medium 4.8)
- [CVE-2022-22310](https://insights.sbomify.com/CVE-2022-22310/): Security feature bypass in WebSphere Application Server Liberty (medium 4.8)
- [CVE-2022-2231](https://insights.sbomify.com/CVE-2022-2231/): NULL Pointer Dereference in vim/vim (high 7.8)
- [CVE-2022-22309](https://insights.sbomify.com/CVE-2022-22309/): Auth bypass in Power System S922 Server (medium 6.8)
- [CVE-2022-22308](https://insights.sbomify.com/CVE-2022-22308/): Code injection in Planning Analytics (high 7.1)
- [CVE-2022-22307](https://insights.sbomify.com/CVE-2022-22307/): IBM Security Guardium privilege escalation (medium 4.4)
- [CVE-2022-22306](https://insights.sbomify.com/CVE-2022-22306/): Security feature bypass in Fortinet FortiOS (medium 5.4)
- [CVE-2022-22305](https://insights.sbomify.com/CVE-2022-22305/): Security feature bypass in FortiAnalyzer (medium 5.4)
- [CVE-2022-22304](https://insights.sbomify.com/CVE-2022-22304/): Cross-site scripting in Fortinet FortiAuthenticator OutlookAgent (medium 6.1)
- [CVE-2022-22303](https://insights.sbomify.com/CVE-2022-22303/): Information disclosure in Fortinet FortiManager (low 2.8)
- [CVE-2022-22302](https://insights.sbomify.com/CVE-2022-22302/): Information disclosure in FortiAuthenticator (medium 5.3)
- [CVE-2022-22301](https://insights.sbomify.com/CVE-2022-22301/): Command injection in Fortinet FortiAP-C (high 7.8)
- [CVE-2022-22300](https://insights.sbomify.com/CVE-2022-22300/): Security feature bypass in Fortinet FortiManager, FortiAnalyzer (medium 4.3)
- [CVE-2022-2230](https://insights.sbomify.com/CVE-2022-2230/): Cross-site scripting in GitLab (high 8.1)
- [CVE-2022-22299](https://insights.sbomify.com/CVE-2022-22299/): Memory corruption in Fortinet FortiADC, FortiProxy, FortiMail, FortiOS (high 7.8)
- [CVE-2022-22298](https://insights.sbomify.com/CVE-2022-22298/): Command injection in FortiIsolator (medium 6.7)
- [CVE-2022-22297](https://insights.sbomify.com/CVE-2022-22297/): Path traversal in FortiRecorder (medium 5.2)
- [CVE-2022-22296](https://insights.sbomify.com/CVE-2022-22296/): Missing authorization in hospital\'s patient records management system project:hospital\'s patient records management system (medium 5.3)
- [CVE-2022-22295](https://insights.sbomify.com/CVE-2022-22295/): SQL injection in metinfo:metinfo (critical 9.8)
- [CVE-2022-22294](https://insights.sbomify.com/CVE-2022-22294/): SQL injection in zfaka project:zfaka (critical 9.8)
- [CVE-2022-22293](https://insights.sbomify.com/CVE-2022-22293/): Cross site scripting in dolibarr (medium 5.4)
- [CVE-2022-22292](https://insights.sbomify.com/CVE-2022-22292/): Missing authorization in Samsung Mobile Devices (high 7.1)
- [CVE-2022-22291](https://insights.sbomify.com/CVE-2022-22291/): Information disclosure in Samsung Mobile Devices (medium 5.5)
- [CVE-2022-22290](https://insights.sbomify.com/CVE-2022-22290/): Other in Samsung Internet (medium 6.5)
- [CVE-2022-2229](https://insights.sbomify.com/CVE-2022-2229/): Missing authorization in GitLab (high 7.5)
- [CVE-2022-22289](https://insights.sbomify.com/CVE-2022-22289/): Auth bypass in S Assistant (medium 5.3)
- [CVE-2022-22288](https://insights.sbomify.com/CVE-2022-22288/): Missing authorization in Galaxy Store (high 7.5)
- [CVE-2022-22287](https://insights.sbomify.com/CVE-2022-22287/): Information disclosure in Samsung Email (low 3.9)
- [CVE-2022-22286](https://insights.sbomify.com/CVE-2022-22286/): Privilege escalation in Bixby Routines (medium 4.4)
- [CVE-2022-22285](https://insights.sbomify.com/CVE-2022-22285/): Privilege escalation in Reminder (medium 4.4)
- [CVE-2022-22284](https://insights.sbomify.com/CVE-2022-22284/): Auth bypass in Samsung Internet (medium 5.7)
- [CVE-2022-22283](https://insights.sbomify.com/CVE-2022-22283/): Auth bypass in Samsung Health (low 2.8)
- [CVE-2022-22282](https://insights.sbomify.com/CVE-2022-22282/): Missing authorization in SonicWall SMA1000 (critical 9.8)
- [CVE-2022-22281](https://insights.sbomify.com/CVE-2022-22281/): Memory corruption in SonicWall NetExtender Windows (32 and 64 bit) Client (high 7.8)
- [CVE-2022-22280](https://insights.sbomify.com/CVE-2022-22280/): SQL injection in SonicWall Analytics On-Prem (critical 9.8)
- [CVE-2022-2228](https://insights.sbomify.com/CVE-2022-2228/): Information disclosure in GitLab (medium 5.3)
- [CVE-2022-22279](https://insights.sbomify.com/CVE-2022-22279/): Path traversal in SonicWall SRA/SMA100 (medium 4.9)
- [CVE-2022-22278](https://insights.sbomify.com/CVE-2022-22278/): Denial of service in SonicOS (high 7.5)
- [CVE-2022-22277](https://insights.sbomify.com/CVE-2022-22277/): Information disclosure in SonicOS (medium 5.3)
- [CVE-2022-22276](https://insights.sbomify.com/CVE-2022-22276/): Information disclosure in SonicOS (medium 5.3)
- [CVE-2022-22275](https://insights.sbomify.com/CVE-2022-22275/): Security feature bypass in SonicOS (high 7.5)
- [CVE-2022-22274](https://insights.sbomify.com/CVE-2022-22274/): Memory corruption in SonicOS (critical 9.8)
- [CVE-2022-22273](https://insights.sbomify.com/CVE-2022-22273/): Command injection in SonicWall SRA/SMA100 (critical 9.8)
- [CVE-2022-22272](https://insights.sbomify.com/CVE-2022-22272/): Missing authorization in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-22271](https://insights.sbomify.com/CVE-2022-22271/): Memory corruption in Samsung Mobile Devices (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/392/