# Vulnerabilities published in 2022


- [CVE-2022-21964](https://insights.sbomify.com/CVE-2022-21964/): Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-21963](https://insights.sbomify.com/CVE-2022-21963/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.4)
- [CVE-2022-21962](https://insights.sbomify.com/CVE-2022-21962/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2022-21961](https://insights.sbomify.com/CVE-2022-21961/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2022-21960](https://insights.sbomify.com/CVE-2022-21960/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2022-2196](https://insights.sbomify.com/CVE-2022-2196/): Speculative execution attacks in KVM VMX (medium 5.8)
- [CVE-2022-21959](https://insights.sbomify.com/CVE-2022-21959/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2022-21958](https://insights.sbomify.com/CVE-2022-21958/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2022-21957](https://insights.sbomify.com/CVE-2022-21957/): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (high 7.2)
- [CVE-2022-21954](https://insights.sbomify.com/CVE-2022-21954/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 6.1)
- [CVE-2022-21953](https://insights.sbomify.com/CVE-2022-21953/): Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster (high 7.4)
- [CVE-2022-21952](https://insights.sbomify.com/CVE-2022-21952/): SUMA unauthenticated remote DoS via resource exhaustion (high 7.5)
- [CVE-2022-21951](https://insights.sbomify.com/CVE-2022-21951/): Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden (medium 6.8)
- [CVE-2022-21950](https://insights.sbomify.com/CVE-2022-21950/): canna: unsafe handling of /tmp/.iroha_unix directory (medium 5.3)
- [CVE-2022-21949](https://insights.sbomify.com/CVE-2022-21949/): Multiple XXE vulnerabilities in OBS (high 8.8)
- [CVE-2022-21948](https://insights.sbomify.com/CVE-2022-21948/): paste: XSS on the image upload function (medium 4.3)
- [CVE-2022-21947](https://insights.sbomify.com/CVE-2022-21947/): rancher desktop: Dashboard API is network accessible (high 8.3)
- [CVE-2022-21946](https://insights.sbomify.com/CVE-2022-21946/): suddoers configuration for cscreen not restrictive enough (medium 5.3)
- [CVE-2022-21945](https://insights.sbomify.com/CVE-2022-21945/): cscreen: usage of fixed path /tmp/cscreen.debug (medium 5.1)
- [CVE-2022-21944](https://insights.sbomify.com/CVE-2022-21944/): watchman: chown in watchman@.socket unit allows symlink attack (high 7.8)
- [CVE-2022-21941](https://insights.sbomify.com/CVE-2022-21941/): iSTAR Ultra (critical 10.0)
- [CVE-2022-21940](https://insights.sbomify.com/CVE-2022-21940/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT) (high 7.5)
- [CVE-2022-2194](https://insights.sbomify.com/CVE-2022-2194/): Accept Stripe Payments < 2.0.64 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-21939](https://insights.sbomify.com/CVE-2022-21939/): Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT) (high 7.5)
- [CVE-2022-21938](https://insights.sbomify.com/CVE-2022-21938/): Metasys MUI Graphics XSS (high 8.1)
- [CVE-2022-21937](https://insights.sbomify.com/CVE-2022-21937/): Metasys CSS (high 8.7)
- [CVE-2022-21936](https://insights.sbomify.com/CVE-2022-21936/): Metasys MVE (high 8.1)
- [CVE-2022-21935](https://insights.sbomify.com/CVE-2022-21935/): Metasys password guessing (high 7.5)
- [CVE-2022-21934](https://insights.sbomify.com/CVE-2022-21934/): Metasys Unverified Password Change (high 8.0)
- [CVE-2022-21933](https://insights.sbomify.com/CVE-2022-21933/): ASUS VivoMini/Mini PC - improper input validation (medium 6.7)
- [CVE-2022-21932](https://insights.sbomify.com/CVE-2022-21932/): Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability (high 7.6)
- [CVE-2022-21931](https://insights.sbomify.com/CVE-2022-21931/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 4.2)
- [CVE-2022-21930](https://insights.sbomify.com/CVE-2022-21930/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 4.2)
- [CVE-2022-2193](https://insights.sbomify.com/CVE-2022-2193/): Missing authorization in HYPR Server (high 7.5)
- [CVE-2022-21929](https://insights.sbomify.com/CVE-2022-21929/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (low 2.5)
- [CVE-2022-21928](https://insights.sbomify.com/CVE-2022-21928/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.3)
- [CVE-2022-21927](https://insights.sbomify.com/CVE-2022-21927/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21926](https://insights.sbomify.com/CVE-2022-21926/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21925](https://insights.sbomify.com/CVE-2022-21925/): Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2022-21924](https://insights.sbomify.com/CVE-2022-21924/): Workstation Service Remote Protocol Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2022-21922](https://insights.sbomify.com/CVE-2022-21922/): Remote Procedure Call Runtime Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-21921](https://insights.sbomify.com/CVE-2022-21921/): Windows Defender Credential Guard Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2022-21920](https://insights.sbomify.com/CVE-2022-21920/): Windows Kerberos Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2022-2192](https://insights.sbomify.com/CVE-2022-2192/): Privilege escalation in HYPR Server (high 7.5)
- [CVE-2022-21919](https://insights.sbomify.com/CVE-2022-21919/): Microsoft Windows User Profile Service Privilege Escalation (high 7.0, exploited in the wild)
- [CVE-2022-21918](https://insights.sbomify.com/CVE-2022-21918/): DirectX Graphics Kernel File Denial of Service Vulnerability (medium 6.5)
- [CVE-2022-21917](https://insights.sbomify.com/CVE-2022-21917/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21916](https://insights.sbomify.com/CVE-2022-21916/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21915](https://insights.sbomify.com/CVE-2022-21915/): Windows GDI+ Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-21914](https://insights.sbomify.com/CVE-2022-21914/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21913](https://insights.sbomify.com/CVE-2022-21913/): Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass (medium 5.3)
- [CVE-2022-21912](https://insights.sbomify.com/CVE-2022-21912/): DirectX Graphics Kernel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21911](https://insights.sbomify.com/CVE-2022-21911/): .NET Framework Denial of Service Vulnerability (high 7.5)
- [CVE-2022-21910](https://insights.sbomify.com/CVE-2022-21910/): Microsoft Cluster Port Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-2191](https://insights.sbomify.com/CVE-2022-2191/): Jetty SslConnection does not release pooled ByteBuffers in case of errors (high 7.5)
- [CVE-2022-21908](https://insights.sbomify.com/CVE-2022-21908/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21907](https://insights.sbomify.com/CVE-2022-21907/): HTTP Protocol Stack Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-21906](https://insights.sbomify.com/CVE-2022-21906/): Windows Defender Application Control Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2022-21905](https://insights.sbomify.com/CVE-2022-21905/): Windows Hyper-V Security Feature Bypass Vulnerability (medium 4.6)
- [CVE-2022-21904](https://insights.sbomify.com/CVE-2022-21904/): Windows GDI Information Disclosure Vulnerability (high 7.5)
- [CVE-2022-21903](https://insights.sbomify.com/CVE-2022-21903/): Windows GDI Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21902](https://insights.sbomify.com/CVE-2022-21902/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21901](https://insights.sbomify.com/CVE-2022-21901/): Windows Hyper-V Elevation of Privilege Vulnerability (critical 9.0)
- [CVE-2022-21900](https://insights.sbomify.com/CVE-2022-21900/): Windows Hyper-V Security Feature Bypass Vulnerability (medium 4.6)
- [CVE-2022-2190](https://insights.sbomify.com/CVE-2022-2190/): Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-21899](https://insights.sbomify.com/CVE-2022-21899/): Windows Extensible Firmware Interface Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2022-21898](https://insights.sbomify.com/CVE-2022-21898/): DirectX Graphics Kernel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21897](https://insights.sbomify.com/CVE-2022-21897/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21896](https://insights.sbomify.com/CVE-2022-21896/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21895](https://insights.sbomify.com/CVE-2022-21895/): Windows User Profile Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21894](https://insights.sbomify.com/CVE-2022-21894/): Secure Boot Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2022-21893](https://insights.sbomify.com/CVE-2022-21893/): Remote Desktop Protocol Remote Code Execution Vulnerability (high 8.0)
- [CVE-2022-21892](https://insights.sbomify.com/CVE-2022-21892/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2022-21891](https://insights.sbomify.com/CVE-2022-21891/): Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability (high 7.6)
- [CVE-2022-21890](https://insights.sbomify.com/CVE-2022-21890/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (high 7.5)
- [CVE-2022-2189](https://insights.sbomify.com/CVE-2022-2189/): WP Video Lightbox < 1.9.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-21889](https://insights.sbomify.com/CVE-2022-21889/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (high 7.5)
- [CVE-2022-21888](https://insights.sbomify.com/CVE-2022-21888/): Windows Modern Execution Server Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21887](https://insights.sbomify.com/CVE-2022-21887/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21885](https://insights.sbomify.com/CVE-2022-21885/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21884](https://insights.sbomify.com/CVE-2022-21884/): Local Security Authority Subsystem Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-21883](https://insights.sbomify.com/CVE-2022-21883/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (high 7.5)
- [CVE-2022-21882](https://insights.sbomify.com/CVE-2022-21882/): Microsoft Win32k Privilege Escalation (high 7.0, exploited in the wild)
- [CVE-2022-21881](https://insights.sbomify.com/CVE-2022-21881/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21880](https://insights.sbomify.com/CVE-2022-21880/): Windows GDI+ Information Disclosure Vulnerability (high 7.5)
- [CVE-2022-2188](https://insights.sbomify.com/CVE-2022-2188/): DXL Broker privilege escalation vulnerability (medium 6.5)
- [CVE-2022-21879](https://insights.sbomify.com/CVE-2022-21879/): Windows Kernel Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2022-21878](https://insights.sbomify.com/CVE-2022-21878/): Windows Geolocation Service Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21877](https://insights.sbomify.com/CVE-2022-21877/): Storage Spaces Controller Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-21876](https://insights.sbomify.com/CVE-2022-21876/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-21875](https://insights.sbomify.com/CVE-2022-21875/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21874](https://insights.sbomify.com/CVE-2022-21874/): Windows Security Center API Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-21873](https://insights.sbomify.com/CVE-2022-21873/): Tile Data Repository Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21872](https://insights.sbomify.com/CVE-2022-21872/): Windows Event Tracing Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21871](https://insights.sbomify.com/CVE-2022-21871/): Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21870](https://insights.sbomify.com/CVE-2022-21870/): Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-2187](https://insights.sbomify.com/CVE-2022-2187/): Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-21869](https://insights.sbomify.com/CVE-2022-21869/): Clipboard User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21868](https://insights.sbomify.com/CVE-2022-21868/): Windows Devices Human Interface Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-21867](https://insights.sbomify.com/CVE-2022-21867/): Windows Push Notifications Apps Elevation of Privilege Vulnerability (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/396/