# Vulnerabilities published in 2022


- [CVE-2022-20017](https://insights.sbomify.com/CVE-2022-20017/): Information disclosure in MT6765, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8167, MT8168, MT8173, MT8175, MT8185, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797 (medium 5.5)
- [CVE-2022-20016](https://insights.sbomify.com/CVE-2022-20016/): Race condition in MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8185, MT8789, MT8791, MT8797 (medium 6.7)
- [CVE-2022-20015](https://insights.sbomify.com/CVE-2022-20015/): Information disclosure in MT6739, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6893, MT8169 (medium 4.4)
- [CVE-2022-20014](https://insights.sbomify.com/CVE-2022-20014/): Memory corruption in MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8183, MT8185, MT8385, MT8788, MT8789 (medium 6.7)
- [CVE-2022-20013](https://insights.sbomify.com/CVE-2022-20013/): Race condition in MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8185, MT8789, MT8791, MT8797 (medium 6.4)
- [CVE-2022-20012](https://insights.sbomify.com/CVE-2022-20012/): Integer overflow in MT6580, MT6739, MT6750, MT6750S, MT6753, MT6755, MT6757, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8127, MT8163, MT8167, MT8168, MT8169, MT8173, MT8183, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8765, MT8788 (high 7.8)
- [CVE-2022-20011](https://insights.sbomify.com/CVE-2022-20011/): Missing authorization in Android (medium 5.5)
- [CVE-2022-20010](https://insights.sbomify.com/CVE-2022-20010/): Memory corruption in Android (medium 6.5)
- [CVE-2022-2001](https://insights.sbomify.com/CVE-2022-2001/): DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-20009](https://insights.sbomify.com/CVE-2022-20009/): Memory corruption in Android (medium 6.8)
- [CVE-2022-20008](https://insights.sbomify.com/CVE-2022-20008/): Information disclosure in Android (medium 4.6)
- [CVE-2022-20007](https://insights.sbomify.com/CVE-2022-20007/): Race condition in Android (high 7.0)
- [CVE-2022-20006](https://insights.sbomify.com/CVE-2022-20006/): Race condition in Android (high 7.0)
- [CVE-2022-20005](https://insights.sbomify.com/CVE-2022-20005/): Privilege escalation in Android (high 7.8)
- [CVE-2022-20004](https://insights.sbomify.com/CVE-2022-20004/): Missing authorization in Android (high 7.8)
- [CVE-2022-20002](https://insights.sbomify.com/CVE-2022-20002/): Missing authorization in Android (high 7.8)
- [CVE-2022-20001](https://insights.sbomify.com/CVE-2022-20001/): Injection in fish (high 7.8)
- [CVE-2022-2000](https://insights.sbomify.com/CVE-2022-2000/): Out-of-bounds Write in vim/vim (high 7.8)
- [CVE-2022-1999](https://insights.sbomify.com/CVE-2022-1999/): Missing authorization in GitLab (low 3.1)
- [CVE-2022-1998](https://insights.sbomify.com/CVE-2022-1998/): Use after free in Kernel (high 7.8)
- [CVE-2022-1997](https://insights.sbomify.com/CVE-2022-1997/): Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis (high 8.8)
- [CVE-2022-1996](https://insights.sbomify.com/CVE-2022-1996/): Authorization Bypass Through User-Controlled Key in emicklei/go-restful (critical 9.3)
- [CVE-2022-1995](https://insights.sbomify.com/CVE-2022-1995/): miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1994](https://insights.sbomify.com/CVE-2022-1994/): Google Authenticator < 1.0.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1993](https://insights.sbomify.com/CVE-2022-1993/): Path Traversal in gogs/gogs (high 8.1)
- [CVE-2022-1992](https://insights.sbomify.com/CVE-2022-1992/): Path Traversal in gogs/gogs (critical 10.0)
- [CVE-2022-1991](https://insights.sbomify.com/CVE-2022-1991/): Fast Food Ordering System Master List Master.php cross site scripting (low 3.5)
- [CVE-2022-1990](https://insights.sbomify.com/CVE-2022-1990/): Nested Pages < 3.1.21 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1989](https://insights.sbomify.com/CVE-2022-1989/): CODESYS Visualization vulnerable to user enumeration (medium 5.3)
- [CVE-2022-1988](https://insights.sbomify.com/CVE-2022-1988/): Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts (medium 6.5)
- [CVE-2022-1987](https://insights.sbomify.com/CVE-2022-1987/): Buffer Over-read in bfabiszewski/libmobi (low 2.5)
- [CVE-2022-1986](https://insights.sbomify.com/CVE-2022-1986/): OS Command Injection in gogs/gogs (critical 10.0)
- [CVE-2022-1985](https://insights.sbomify.com/CVE-2022-1985/): Download Manager <= 3.2.42 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1984](https://insights.sbomify.com/CVE-2022-1984/): Deserialization in HYPR Windows WFA (medium 4.5)
- [CVE-2022-1983](https://insights.sbomify.com/CVE-2022-1983/): Missing authorization in GitLab (medium 6.5)
- [CVE-2022-1982](https://insights.sbomify.com/CVE-2022-1982/): A crafted SVG attachment can crash a Mattermost server (medium 4.3)
- [CVE-2022-1981](https://insights.sbomify.com/CVE-2022-1981/): Security feature bypass in GitLab (low 2.7)
- [CVE-2022-1980](https://insights.sbomify.com/CVE-2022-1980/): SourceCodester Product Show Room Site cross site scripting (low 2.4)
- [CVE-2022-1979](https://insights.sbomify.com/CVE-2022-1979/): SourceCodester Product Show Room Site p=contact cross site scripting (low 3.5)
- [CVE-2022-1977](https://insights.sbomify.com/CVE-2022-1977/): WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF (high 7.2)
- [CVE-2022-1976](https://insights.sbomify.com/CVE-2022-1976/): Use after free in kernel (high 7.8)
- [CVE-2022-1975](https://insights.sbomify.com/CVE-2022-1975/): Race condition in Linux kernel (medium 5.5)
- [CVE-2022-1974](https://insights.sbomify.com/CVE-2022-1974/): Use after free in Linux kernel (medium 4.1)
- [CVE-2022-1973](https://insights.sbomify.com/CVE-2022-1973/): Use after free in kernel (high 7.1)
- [CVE-2022-1971](https://insights.sbomify.com/CVE-2022-1971/): NextCellent Gallery <= 1.9.35 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-1969](https://insights.sbomify.com/CVE-2022-1969/): Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2022-1968](https://insights.sbomify.com/CVE-2022-1968/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-1967](https://insights.sbomify.com/CVE-2022-1967/): WP Championship < 9.3 - Multiple CSRF (medium 6.5)
- [CVE-2022-1965](https://insights.sbomify.com/CVE-2022-1965/): CODESYS runtime system prone to file deletion due to improper error handling (high 8.1)
- [CVE-2022-1964](https://insights.sbomify.com/CVE-2022-1964/): Easy SVG Support < 3.3.0 - Author+ Stored Cross Site Scripting via SVG (medium 5.4)
- [CVE-2022-1963](https://insights.sbomify.com/CVE-2022-1963/): Information disclosure in GitLab (medium 5.3)
- [CVE-2022-1962](https://insights.sbomify.com/CVE-2022-1962/): Stack exhaustion due to deeply nested types in go/parser (medium 5.5)
- [CVE-2022-1961](https://insights.sbomify.com/CVE-2022-1961/): Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element ID (medium 5.5)
- [CVE-2022-1960](https://insights.sbomify.com/CVE-2022-1960/): MyCSS <= 1.1 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1959](https://insights.sbomify.com/CVE-2022-1959/): Auth bypass in AppLock - Fingerprint (medium 6.6)
- [CVE-2022-1958](https://insights.sbomify.com/CVE-2022-1958/): FileCloud NTFS access control (medium 6.3)
- [CVE-2022-1957](https://insights.sbomify.com/CVE-2022-1957/): Comment License < 1.4.0 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1956](https://insights.sbomify.com/CVE-2022-1956/): Shortcut Macros <= 1.3 - Subscriber+ Arbitrary Settings Update (medium 4.3)
- [CVE-2022-1955](https://insights.sbomify.com/CVE-2022-1955/): Auth bypass in Session (medium 4.6)
- [CVE-2022-1954](https://insights.sbomify.com/CVE-2022-1954/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-1953](https://insights.sbomify.com/CVE-2022-1953/): Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File Deletion (critical 9.1)
- [CVE-2022-1952](https://insights.sbomify.com/CVE-2022-1952/): eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2022-1951](https://insights.sbomify.com/CVE-2022-1951/): Core Plugin for Kitestudio Themes < 2.3.1 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1950](https://insights.sbomify.com/CVE-2022-1950/): Youzify < 1.2.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-1949](https://insights.sbomify.com/CVE-2022-1949/): Missing authorization in 389-ds-base (high 7.5)
- [CVE-2022-1948](https://insights.sbomify.com/CVE-2022-1948/): Cross-site scripting in GitLab (high 8.7)
- [CVE-2022-1947](https://insights.sbomify.com/CVE-2022-1947/): Use of Incorrect Operator in polonel/trudesk (critical 9.1)
- [CVE-2022-1946](https://insights.sbomify.com/CVE-2022-1946/): Gallery < 2.0.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1945](https://insights.sbomify.com/CVE-2022-1945/): Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1944](https://insights.sbomify.com/CVE-2022-1944/): Missing authorization in GitLab (medium 5.4)
- [CVE-2022-1943](https://insights.sbomify.com/CVE-2022-1943/): Memory corruption in Kernel (high 7.8)
- [CVE-2022-1942](https://insights.sbomify.com/CVE-2022-1942/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-1941](https://insights.sbomify.com/CVE-2022-1941/): Out of Memory issue in ProtocolBuffers for cpp and python (high 7.5)
- [CVE-2022-1940](https://insights.sbomify.com/CVE-2022-1940/): Cross-site scripting in GitLab (high 7.7)
- [CVE-2022-1939](https://insights.sbomify.com/CVE-2022-1939/): Allow SVG Files < 1.1 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2022-1938](https://insights.sbomify.com/CVE-2022-1938/): Awin Data Feed < 1.8 - Unauthenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1937](https://insights.sbomify.com/CVE-2022-1937/): Awin Data Feed < 1.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1936](https://insights.sbomify.com/CVE-2022-1936/): Missing authorization in GitLab (medium 6.5)
- [CVE-2022-1935](https://insights.sbomify.com/CVE-2022-1935/): Missing authorization in GitLab (medium 6.5)
- [CVE-2022-1934](https://insights.sbomify.com/CVE-2022-1934/): Use After Free in mruby/mruby (medium 5.1)
- [CVE-2022-1933](https://insights.sbomify.com/CVE-2022-1933/): CDI < 5.1.9 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1932](https://insights.sbomify.com/CVE-2022-1932/): Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1931](https://insights.sbomify.com/CVE-2022-1931/): Incorrect Synchronization in polonel/trudesk (critical 9.1)
- [CVE-2022-1930](https://insights.sbomify.com/CVE-2022-1930/): ReDoS in eth-account encode_structured_data function (medium 5.9)
- [CVE-2022-1929](https://insights.sbomify.com/CVE-2022-1929/): Exponential ReDoS in devcert (medium 5.9)
- [CVE-2022-1928](https://insights.sbomify.com/CVE-2022-1928/): Cross-site Scripting (XSS) - Stored in go-gitea/gitea (medium 4.4)
- [CVE-2022-1927](https://insights.sbomify.com/CVE-2022-1927/): Buffer Over-read in vim/vim (high 7.8)
- [CVE-2022-1926](https://insights.sbomify.com/CVE-2022-1926/): Integer Overflow or Wraparound in polonel/trudesk (high 7.6)
- [CVE-2022-1925](https://insights.sbomify.com/CVE-2022-1925/): Integer overflow in GStreamer (high 7.8)
- [CVE-2022-1924](https://insights.sbomify.com/CVE-2022-1924/): Integer overflow in GStreamer (high 7.8)
- [CVE-2022-1923](https://insights.sbomify.com/CVE-2022-1923/): Integer overflow in GStreamer (high 7.8)
- [CVE-2022-1922](https://insights.sbomify.com/CVE-2022-1922/): Integer overflow in GStreamer (high 7.8)
- [CVE-2022-1921](https://insights.sbomify.com/CVE-2022-1921/): Integer overflow in GStreamer (high 7.8)
- [CVE-2022-1920](https://insights.sbomify.com/CVE-2022-1920/): Integer overflow in GStreamer (high 7.8)
- [CVE-2022-1919](https://insights.sbomify.com/CVE-2022-1919/): Use after free in Chrome (high 8.8)
- [CVE-2022-1918](https://insights.sbomify.com/CVE-2022-1918/): ToolBar to Share <= 2.0 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-1916](https://insights.sbomify.com/CVE-2022-1916/): Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1915](https://insights.sbomify.com/CVE-2022-1915/): WP Zillow Review Slider < 2.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1914](https://insights.sbomify.com/CVE-2022-1914/): Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF (medium 4.3)
- [CVE-2022-1913](https://insights.sbomify.com/CVE-2022-1913/): Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/415/