# Vulnerabilities published in 2022


- [CVE-2022-22270](https://insights.sbomify.com/CVE-2022-22270/): Information disclosure in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-2227](https://insights.sbomify.com/CVE-2022-2227/): Missing authorization in GitLab (low 3.1)
- [CVE-2022-22269](https://insights.sbomify.com/CVE-2022-22269/): Information disclosure in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-22268](https://insights.sbomify.com/CVE-2022-22268/): Security feature bypass in Samsung Mobile Devices (medium 6.1)
- [CVE-2022-22267](https://insights.sbomify.com/CVE-2022-22267/): Information disclosure in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-22266](https://insights.sbomify.com/CVE-2022-22266/): Missing authorization in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-22265](https://insights.sbomify.com/CVE-2022-22265/): Samsung Mobile Devices Use-After-Free (medium 5.0, exploited in the wild)
- [CVE-2022-22264](https://insights.sbomify.com/CVE-2022-22264/): Missing authorization in Samsung Mobile Devices (high 7.7)
- [CVE-2022-22263](https://insights.sbomify.com/CVE-2022-22263/): Missing authorization in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-22262](https://insights.sbomify.com/CVE-2022-22262/): ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access (high 7.7)
- [CVE-2022-22261](https://insights.sbomify.com/CVE-2022-22261/): Other in EMUI (high 7.5)
- [CVE-2022-22260](https://insights.sbomify.com/CVE-2022-22260/): Use after free in EMUI (critical 9.1)
- [CVE-2022-2226](https://insights.sbomify.com/CVE-2022-2226/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2022-22259](https://insights.sbomify.com/CVE-2022-22259/): Auth bypass in FLMG-10 (medium 6.8)
- [CVE-2022-22258](https://insights.sbomify.com/CVE-2022-22258/): Privilege escalation in HarmonyOS;EMUI;Magic UI (critical 9.8)
- [CVE-2022-22257](https://insights.sbomify.com/CVE-2022-22257/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-22256](https://insights.sbomify.com/CVE-2022-22256/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-22255](https://insights.sbomify.com/CVE-2022-22255/): Denial of service in EMUI (high 7.5)
- [CVE-2022-22254](https://insights.sbomify.com/CVE-2022-22254/): Security feature bypass in EMUI (high 7.5)
- [CVE-2022-22253](https://insights.sbomify.com/CVE-2022-22253/): Other in EMUI (high 7.5)
- [CVE-2022-22252](https://insights.sbomify.com/CVE-2022-22252/): Use after free in HarmonyOS;EMUI;Magic UI (high 7.5)
- [CVE-2022-22251](https://insights.sbomify.com/CVE-2022-22251/): Privilege escalation in Junos OS (high 7.8)
- [CVE-2022-22250](https://insights.sbomify.com/CVE-2022-22250/): Junos OS and Junos OS Evolved: An FPC crash might be seen due to an EVPN MAC entry moving from local to remote (medium 6.5)
- [CVE-2022-2225](https://insights.sbomify.com/CVE-2022-2225/): Zero Trust Secure Web Gateway policies bypass using WARP client subcommands (high 8.1)
- [CVE-2022-22249](https://insights.sbomify.com/CVE-2022-22249/): Junos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domain (medium 6.5)
- [CVE-2022-22248](https://insights.sbomify.com/CVE-2022-22248/): Misconfiguration in Junos OS Evolved (high 7.3)
- [CVE-2022-22247](https://insights.sbomify.com/CVE-2022-22247/): Junos OS Evolved: Kernel processing of unvalidated TCP segments could lead to a Denial of Service (DoS) (high 7.5)
- [CVE-2022-22246](https://insights.sbomify.com/CVE-2022-22246/): Junos OS: PHP file inclusion vulnerability in J-Web (high 7.5)
- [CVE-2022-22245](https://insights.sbomify.com/CVE-2022-22245/): Junos OS: Path traversal vulnerability in J-Web (medium 4.3)
- [CVE-2022-22244](https://insights.sbomify.com/CVE-2022-22244/): Junos OS: Unauthenticated XPath Injection vulnerability in J-Web (medium 5.3)
- [CVE-2022-22243](https://insights.sbomify.com/CVE-2022-22243/): Junos OS: XPath Injection vulnerability in J-Web (medium 4.3)
- [CVE-2022-22242](https://insights.sbomify.com/CVE-2022-22242/): Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web (medium 6.1)
- [CVE-2022-22241](https://insights.sbomify.com/CVE-2022-22241/): Junos OS: Vulnerability in J-Web may allow deserialization without authentication (high 8.1)
- [CVE-2022-22240](https://insights.sbomify.com/CVE-2022-22240/): Denial of service in Junos OS (medium 5.5)
- [CVE-2022-2224](https://insights.sbomify.com/CVE-2022-2224/): Gallery for Social Photo <= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication (medium 5.4)
- [CVE-2022-22239](https://insights.sbomify.com/CVE-2022-22239/): Junos OS Evolved: The ssh CLI command always runs as root which can lead to privilege escalation (high 8.2)
- [CVE-2022-22238](https://insights.sbomify.com/CVE-2022-22238/): Junos OS and Junos OS Evolved: The rpd process will crash when a malformed incoming RESV message is processed (medium 5.3)
- [CVE-2022-22237](https://insights.sbomify.com/CVE-2022-22237/): Auth bypass in Junos OS (medium 6.5)
- [CVE-2022-22236](https://insights.sbomify.com/CVE-2022-22236/): Junos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crash (high 7.5)
- [CVE-2022-22235](https://insights.sbomify.com/CVE-2022-22235/): Junos OS: SRX Series: A flowd core will be observed when malformed GPRS traffic is processed (medium 5.9)
- [CVE-2022-22234](https://insights.sbomify.com/CVE-2022-22234/): Junos OS: EX2300 and EX3400 Series: One of more SFPs might become unavailable when the system is very busy (medium 5.5)
- [CVE-2022-22233](https://insights.sbomify.com/CVE-2022-22233/): Null dereference in Junos OS (medium 5.5)
- [CVE-2022-22232](https://insights.sbomify.com/CVE-2022-22232/): Null dereference in Junos OS (high 7.5)
- [CVE-2022-22231](https://insights.sbomify.com/CVE-2022-22231/): Null dereference in Junos OS (high 7.5)
- [CVE-2022-22230](https://insights.sbomify.com/CVE-2022-22230/): Junos OS and Junos OS Evolved: RPD crash upon receipt of specific OSPFv3 LSAs (medium 6.5)
- [CVE-2022-2223](https://insights.sbomify.com/CVE-2022-2223/): Image Slider <= 1.1.121 - Cross-Site Request Forgery to Post Duplication (medium 5.4)
- [CVE-2022-22229](https://insights.sbomify.com/CVE-2022-22229/): Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration (high 8.4)
- [CVE-2022-22228](https://insights.sbomify.com/CVE-2022-22228/): Denial of service in Junos OS (high 7.5)
- [CVE-2022-22227](https://insights.sbomify.com/CVE-2022-22227/): Denial of service in Junos OS Evolved (medium 5.3)
- [CVE-2022-22226](https://insights.sbomify.com/CVE-2022-22226/): Denial of service in Junos OS (medium 6.5)
- [CVE-2022-22225](https://insights.sbomify.com/CVE-2022-22225/): Race condition in Junos OS (medium 5.9)
- [CVE-2022-22224](https://insights.sbomify.com/CVE-2022-22224/): Junos OS and Junos OS Evolved: PPMD goes into infinite loop upon receipt of malformed OSPF TLV (medium 6.5)
- [CVE-2022-22223](https://insights.sbomify.com/CVE-2022-22223/): Denial of service in Junos OS (medium 6.5)
- [CVE-2022-22221](https://insights.sbomify.com/CVE-2022-22221/): Junos OS: SRX and EX Series: Local privilege escalation flaw in "download" functionality (high 7.8)
- [CVE-2022-22220](https://insights.sbomify.com/CVE-2022-22220/): Race condition in Junos OS (medium 5.9)
- [CVE-2022-2222](https://insights.sbomify.com/CVE-2022-2222/): Download Monitor < 4.5.91 - Admin+ Arbitrary File Download (medium 4.9)
- [CVE-2022-22219](https://insights.sbomify.com/CVE-2022-22219/): Denial of service in Junos OS (medium 5.9)
- [CVE-2022-22218](https://insights.sbomify.com/CVE-2022-22218/): Junos OS: SRX Series: Upon processing of a genuine packet the pkid process will crash during CMPv2 auto-re-enrollment (high 7.5)
- [CVE-2022-22217](https://insights.sbomify.com/CVE-2022-22217/): Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of crafted MLD packets on multi-homing ESI in VXLAN (medium 6.1)
- [CVE-2022-22216](https://insights.sbomify.com/CVE-2022-22216/): Junos OS: PTX Series and QFX10000 Series: 'Etherleak' memory disclosure in Ethernet padding data (medium 4.3)
- [CVE-2022-22215](https://insights.sbomify.com/CVE-2022-22215/): Denial of service in Junos OS (medium 6.5)
- [CVE-2022-22214](https://insights.sbomify.com/CVE-2022-22214/): Junos OS and Junos OS Evolved: In an MPLS scenario upon receipt of a specific IPv6 packet an FPC will crash (medium 6.5)
- [CVE-2022-22213](https://insights.sbomify.com/CVE-2022-22213/): Junos OS and Junos OS Evolved: Denial of Service (DoS) vulnerability in RPD upon receipt of specific BGP update (medium 5.9)
- [CVE-2022-22212](https://insights.sbomify.com/CVE-2022-22212/): Junos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or drops (high 7.5)
- [CVE-2022-22211](https://insights.sbomify.com/CVE-2022-22211/): Junos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OID (high 7.5)
- [CVE-2022-22210](https://insights.sbomify.com/CVE-2022-22210/): Junos OS: QFX5000 Series and MX Series: An l2alm crash leading to an FPC crash can be observed in VxLAN scenario (medium 6.5)
- [CVE-2022-2221](https://insights.sbomify.com/CVE-2022-2221/): Information disclosure in Remote Desktop Manager (medium 6.5)
- [CVE-2022-22209](https://insights.sbomify.com/CVE-2022-22209/): Junos OS: RIB and PFEs can get out of sync due to a memory leak caused by interface flaps or route churn (high 7.5)
- [CVE-2022-22208](https://insights.sbomify.com/CVE-2022-22208/): Junos OS and Junos OS Evolved: An rpd crash can occur due to memory corruption caused by flapping BGP sessions (medium 5.9)
- [CVE-2022-22207](https://insights.sbomify.com/CVE-2022-22207/): Use after free in Junos OS (high 7.5)
- [CVE-2022-22206](https://insights.sbomify.com/CVE-2022-22206/): Junos OS: SRX series: The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search (high 7.5)
- [CVE-2022-22205](https://insights.sbomify.com/CVE-2022-22205/): Junos OS: SRX Series: An FPC memory leak can occur in an APBR scenario (high 7.5)
- [CVE-2022-22204](https://insights.sbomify.com/CVE-2022-22204/): Denial of service in Junos OS (medium 5.3)
- [CVE-2022-22203](https://insights.sbomify.com/CVE-2022-22203/): Denial of service in Junos OS (medium 6.5)
- [CVE-2022-22202](https://insights.sbomify.com/CVE-2022-22202/): Denial of service in Junos OS (medium 6.5)
- [CVE-2022-22201](https://insights.sbomify.com/CVE-2022-22201/): Denial of service in Junos OS (high 7.5)
- [CVE-2022-22198](https://insights.sbomify.com/CVE-2022-22198/): Junos OS: MX MS-MPC or MS-MIC, or SRX SPC crashes if it receives a SIP message with a specific contact header format (high 7.5)
- [CVE-2022-22197](https://insights.sbomify.com/CVE-2022-22197/): Denial of service in Junos OS (high 7.5)
- [CVE-2022-22196](https://insights.sbomify.com/CVE-2022-22196/): Junos OS and Junos OS Evolved: The rpd CPU spikes to 100% after a malformed ISIS TLV has been received (medium 6.5)
- [CVE-2022-22195](https://insights.sbomify.com/CVE-2022-22195/): Junos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crash (high 7.5)
- [CVE-2022-22194](https://insights.sbomify.com/CVE-2022-22194/): Junos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restart (high 7.5)
- [CVE-2022-22193](https://insights.sbomify.com/CVE-2022-22193/): Denial of service in Junos OS (medium 5.5)
- [CVE-2022-22192](https://insights.sbomify.com/CVE-2022-22192/): Junos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the device (high 7.5)
- [CVE-2022-22191](https://insights.sbomify.com/CVE-2022-22191/): Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP traffic (medium 6.5)
- [CVE-2022-22190](https://insights.sbomify.com/CVE-2022-22190/): Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL (high 7.4)
- [CVE-2022-2219](https://insights.sbomify.com/CVE-2022-2219/): Unyson < 2.7.27 - Reflected Cross-Site Scripting (high 7.2)
- [CVE-2022-22189](https://insights.sbomify.com/CVE-2022-22189/): Privilege escalation in Contrail Service Orchestration (high 7.3)
- [CVE-2022-22188](https://insights.sbomify.com/CVE-2022-22188/): Memory corruption in Junos OS (high 7.5)
- [CVE-2022-22187](https://insights.sbomify.com/CVE-2022-22187/): JIMS: Local Privilege Escalation vulnerability via repair functionality (high 7.8)
- [CVE-2022-22186](https://insights.sbomify.com/CVE-2022-22186/): Other in Junos OS (high 7.2)
- [CVE-2022-22185](https://insights.sbomify.com/CVE-2022-22185/): Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet (high 7.5)
- [CVE-2022-22184](https://insights.sbomify.com/CVE-2022-22184/): Denial of service in Junos OS (high 7.5)
- [CVE-2022-22183](https://insights.sbomify.com/CVE-2022-22183/): Denial of service in Junos OS (high 7.5)
- [CVE-2022-22182](https://insights.sbomify.com/CVE-2022-22182/): Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web session (high 8.8)
- [CVE-2022-22181](https://insights.sbomify.com/CVE-2022-22181/): Junos OS: J-Web can be compromised through reflected XSS attacks (high 8.0)
- [CVE-2022-22180](https://insights.sbomify.com/CVE-2022-22180/): Junos OS: EX2300 Series, EX2300-MP Series, EX3400 Series: A slow memory leak due to processing of specific IPv6 packets (high 7.5)
- [CVE-2022-2218](https://insights.sbomify.com/CVE-2022-2218/): Cross-site Scripting (XSS) - Stored in ionicabizau/parse-url (critical 9.1)
- [CVE-2022-22179](https://insights.sbomify.com/CVE-2022-22179/): Junos OS: jdhcpd crashes upon receiving a specific DHCP packet (medium 6.5)
- [CVE-2022-22178](https://insights.sbomify.com/CVE-2022-22178/): Memory corruption in Junos OS (high 7.5)
- [CVE-2022-22177](https://insights.sbomify.com/CVE-2022-22177/): Denial of service in Junos OS (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/393/