# Vulnerabilities published in 2022


- [DRUPAL-CONTRIB-2022-023](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-023/): This module enables you to manage and delete files. (not scored)
- [DRUPAL-CONTRIB-2022-021](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-021/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-019](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-019/): This module provides a stream wrapper for files located in the vendor directory. (not scored)
- [DRUPAL-CONTRIB-2022-018](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-018/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-017](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-017/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-016](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-016/): **Update** Maintainers stepped forward, fixed the security issue, and Vocabulary Permissions Per Role is supported again. (not scored)
- [DRUPAL-CONTRIB-2022-015](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-015/): This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in taxonomy structures. (not scored)
- [DRUPAL-CONTRIB-2022-014](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-014/): This module enables users to create 'private' vocabularies. (not scored)
- [DRUPAL-CONTRIB-2022-013](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-013/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-012](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-012/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-009](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-009/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-008](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-008/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-006](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-006/): Update 2022-03-01. New maintainers have volunteered for the project and created a new release which includes fixes for the 3 security issues (not scored)
- [DRUPAL-CONTRIB-2022-005](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-005/): The security team is marking this project unsupported. (not scored)
- [DRUPAL-CONTRIB-2022-004](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-004/): jQuery UI is a third-party library used by Drupal. (not scored)
- [DRUPAL-CONTRIB-2022-002](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-002/): This module enables you to implement OAuth 2.0 authentication for Drupal. (not scored)
- [DRUPAL-CONTRIB-2022-001](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-001/): This module enables you to login with an email address. (not scored)
- [CVE-2022-51026](https://insights.sbomify.com/CVE-2022-51026/): Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login (critical 9.3)
- [CVE-2022-51025](https://insights.sbomify.com/CVE-2022-51025/): Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer (high 7.1)
- [CVE-2022-51024](https://insights.sbomify.com/CVE-2022-51024/): Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint (high 8.7)
- [CVE-2022-51023](https://insights.sbomify.com/CVE-2022-51023/): PHPOK < 5.4.081 SQL Injection via api.php sort Parameter (high 8.8)
- [CVE-2022-51022](https://insights.sbomify.com/CVE-2022-51022/): YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint (high 8.8)
- [CVE-2022-51021](https://insights.sbomify.com/CVE-2022-51021/): NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint (high 8.8)
- [CVE-2022-51020](https://insights.sbomify.com/CVE-2022-51020/): Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints (medium 6.0)
- [CVE-2022-51019](https://insights.sbomify.com/CVE-2022-51019/): Akaunting before 2.1.31 OS Command Injection via app alias (high 8.7)
- [CVE-2022-51018](https://insights.sbomify.com/CVE-2022-51018/): PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages (high 7.1)
- [CVE-2022-51017](https://insights.sbomify.com/CVE-2022-51017/): PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data (high 8.7)
- [CVE-2022-51016](https://insights.sbomify.com/CVE-2022-51016/): PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay (medium 5.3)
- [CVE-2022-51015](https://insights.sbomify.com/CVE-2022-51015/): PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket (high 7.1)
- [CVE-2022-51014](https://insights.sbomify.com/CVE-2022-51014/): PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding (high 7.1)
- [CVE-2022-51013](https://insights.sbomify.com/CVE-2022-51013/): PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata (high 7.1)
- [CVE-2022-51012](https://insights.sbomify.com/CVE-2022-51012/): PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization (high 7.1)
- [CVE-2022-51011](https://insights.sbomify.com/CVE-2022-51011/): PocketMine-MP before 4.2.10 Denial of Service via Chat Messages (medium 5.3)
- [CVE-2022-51010](https://insights.sbomify.com/CVE-2022-51010/): PocketMine-MP before 4.4.2 Server Crash via Item ID (high 7.1)
- [CVE-2022-51009](https://insights.sbomify.com/CVE-2022-51009/): PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry (high 8.7)
- [CVE-2022-51008](https://insights.sbomify.com/CVE-2022-51008/): PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions (medium 6.9)
- [CVE-2022-50997](https://insights.sbomify.com/CVE-2022-50997/): Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp (high 8.7)
- [CVE-2022-50994](https://insights.sbomify.com/CVE-2022-50994/): DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi (critical 9.2)
- [CVE-2022-50993](https://insights.sbomify.com/CVE-2022-50993/): Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet (critical 9.3)
- [CVE-2022-50992](https://insights.sbomify.com/CVE-2022-50992/): Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet (high 8.7)
- [CVE-2022-50981](https://insights.sbomify.com/CVE-2022-50981/): Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements (critical 9.8)
- [CVE-2022-50980](https://insights.sbomify.com/CVE-2022-50980/): Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN (medium 6.5)
- [CVE-2022-50979](https://insights.sbomify.com/CVE-2022-50979/): Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (RS485) (medium 6.5)
- [CVE-2022-50978](https://insights.sbomify.com/CVE-2022-50978/): Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP) (high 7.5)
- [CVE-2022-50977](https://insights.sbomify.com/CVE-2022-50977/): Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP (high 7.5)
- [CVE-2022-50976](https://insights.sbomify.com/CVE-2022-50976/): Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB (high 7.7)
- [CVE-2022-50975](https://insights.sbomify.com/CVE-2022-50975/): Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration (high 8.8)
- [CVE-2022-50973](https://insights.sbomify.com/CVE-2022-50973/): Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet (critical 9.3)
- [CVE-2022-50972](https://insights.sbomify.com/CVE-2022-50972/): WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php (critical 9.3)
- [CVE-2022-50971](https://insights.sbomify.com/CVE-2022-50971/): Malwarebytes 4.5 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2022-50970](https://insights.sbomify.com/CVE-2022-50970/): WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter (medium 5.1)
- [CVE-2022-50969](https://insights.sbomify.com/CVE-2022-50969/): uBidAuction 2.0.1 mailingLog manage Reflected XSS (medium 5.1)
- [CVE-2022-50968](https://insights.sbomify.com/CVE-2022-50968/): uBidAuction 2.0.1 auctions manage Reflected XSS (medium 5.1)
- [CVE-2022-50967](https://insights.sbomify.com/CVE-2022-50967/): uBidAuction 2.0.1 tickets manage Reflected XSS (medium 5.1)
- [CVE-2022-50966](https://insights.sbomify.com/CVE-2022-50966/): uBidAuction 2.0.1 news manage Reflected XSS (medium 5.1)
- [CVE-2022-50965](https://insights.sbomify.com/CVE-2022-50965/): uBidAuction 2.0.1 posts manage Reflected XSS (medium 5.1)
- [CVE-2022-50964](https://insights.sbomify.com/CVE-2022-50964/): uBidAuction 2.0.1 myAuctions loose Reflected XSS (medium 5.1)
- [CVE-2022-50963](https://insights.sbomify.com/CVE-2022-50963/): uBidAuction 2.0.1 myAuctions active Reflected XSS (medium 5.1)
- [CVE-2022-50962](https://insights.sbomify.com/CVE-2022-50962/): uBidAuction 2.0.1 myOrders Reflected XSS (medium 5.1)
- [CVE-2022-50961](https://insights.sbomify.com/CVE-2022-50961/): WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS (medium 5.1)
- [CVE-2022-50960](https://insights.sbomify.com/CVE-2022-50960/): WordPress International Sms Contact Form 7 Integration 1.2 XSS (medium 5.1)
- [CVE-2022-50959](https://insights.sbomify.com/CVE-2022-50959/): WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php (medium 5.1)
- [CVE-2022-50958](https://insights.sbomify.com/CVE-2022-50958/): WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php (medium 5.1)
- [CVE-2022-50957](https://insights.sbomify.com/CVE-2022-50957/): Drupal avatar_uploader 7.x-1.0-beta8 Reflected XSS (medium 5.1)
- [CVE-2022-50956](https://insights.sbomify.com/CVE-2022-50956/): WordPress Plugin amministrazione-aperta 3.7.3 Local File Read (medium 6.9)
- [CVE-2022-50955](https://insights.sbomify.com/CVE-2022-50955/): WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery (medium 5.3)
- [CVE-2022-50954](https://insights.sbomify.com/CVE-2022-50954/): WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion (medium 6.9)
- [CVE-2022-50953](https://insights.sbomify.com/CVE-2022-50953/): WordPress Plugin admin-word-count-column 2.2 Local File Read (medium 6.9)
- [CVE-2022-50952](https://insights.sbomify.com/CVE-2022-50952/): Banco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name Input (medium 5.1)
- [CVE-2022-50951](https://insights.sbomify.com/CVE-2022-50951/): WiFi File Transfer 1.0.8 Persistent XSS via Web Server Input Validation (medium 5.1)
- [CVE-2022-50950](https://insights.sbomify.com/CVE-2022-50950/): Webile 1.0.1 Directory Traversal Vulnerability via Web Application (high 7.1)
- [CVE-2022-50949](https://insights.sbomify.com/CVE-2022-50949/): WordPress Plugin Videos sync PDF 1.7.4 Stored XSS (medium 5.1)
- [CVE-2022-50948](https://insights.sbomify.com/CVE-2022-50948/): Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting (medium 5.1)
- [CVE-2022-50947](https://insights.sbomify.com/CVE-2022-50947/): WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS (medium 5.1)
- [CVE-2022-50946](https://insights.sbomify.com/CVE-2022-50946/): WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSS (medium 5.1)
- [CVE-2022-50945](https://insights.sbomify.com/CVE-2022-50945/): WordPress 3dady Real-Time Web Stats 1.0 Stored XSS (medium 5.1)
- [CVE-2022-50944](https://insights.sbomify.com/CVE-2022-50944/): Aero CMS 0.0.1 PHP Code Injection via posts.php (high 8.7)
- [CVE-2022-50943](https://insights.sbomify.com/CVE-2022-50943/): Moodle LMS 4.0 Cross-Site Scripting via course search.php (medium 5.1)
- [CVE-2022-50942](https://insights.sbomify.com/CVE-2022-50942/): Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener (medium 4.8)
- [CVE-2022-50941](https://insights.sbomify.com/CVE-2022-50941/): BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkout (medium 5.1)
- [CVE-2022-50940](https://insights.sbomify.com/CVE-2022-50940/): Knap Advanced PHP Login 3.1.3 Persistent Cross-Site Scripting via Name Parameter (medium 5.1)
- [CVE-2022-50939](https://insights.sbomify.com/CVE-2022-50939/): e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override (high 8.6)
- [CVE-2022-50938](https://insights.sbomify.com/CVE-2022-50938/): CONTPAQi® AdminPAQ 14.0.0 - Unquoted Service Path (high 8.5)
- [CVE-2022-50937](https://insights.sbomify.com/CVE-2022-50937/): Ametys CMS v4.4.1 - Cross Site Scripting (XSS) (medium 5.1)
- [CVE-2022-50936](https://insights.sbomify.com/CVE-2022-50936/): WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated) (high 8.7)
- [CVE-2022-50935](https://insights.sbomify.com/CVE-2022-50935/): FLAME II MODEM USB - Unquoted Service Path (high 8.5)
- [CVE-2022-50933](https://insights.sbomify.com/CVE-2022-50933/): Cain & Abel 4.9.56 - Unquoted Service Path (high 8.5)
- [CVE-2022-50932](https://insights.sbomify.com/CVE-2022-50932/): Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated) (high 8.7)
- [CVE-2022-50931](https://insights.sbomify.com/CVE-2022-50931/): TeamSpeak 3.5.6 - Insecure File Permissions (high 8.5)
- [CVE-2022-50930](https://insights.sbomify.com/CVE-2022-50930/): Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path (high 8.5)
- [CVE-2022-50929](https://insights.sbomify.com/CVE-2022-50929/): Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path (high 8.5)
- [CVE-2022-50928](https://insights.sbomify.com/CVE-2022-50928/): Bluetooth Application 5.4.277 - 'BlueSoleilCS' Unquoted Service Path (high 8.5)
- [CVE-2022-50927](https://insights.sbomify.com/CVE-2022-50927/): Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation (high 8.5)
- [CVE-2022-50926](https://insights.sbomify.com/CVE-2022-50926/): WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation (high 8.7)
- [CVE-2022-50925](https://insights.sbomify.com/CVE-2022-50925/): Prowise Reflect v1.0.9 - Remote Keystroke Injection (high 8.6)
- [CVE-2022-50924](https://insights.sbomify.com/CVE-2022-50924/): Private Internet Access 3.3 - 'pia-service' Unquoted Service Path (high 8.5)
- [CVE-2022-50923](https://insights.sbomify.com/CVE-2022-50923/): Cobian Backup 0.9 - Unquoted Service Path (high 8.5)
- [CVE-2022-50922](https://insights.sbomify.com/CVE-2022-50922/): Audio Conversion Wizard v2.01 - Buffer Overflow (high 8.6)
- [CVE-2022-50921](https://insights.sbomify.com/CVE-2022-50921/): WOW21 5.0.1.9 - 'Service WOW21_Service' Unquoted Service Path (high 8.5)
- [CVE-2022-50920](https://insights.sbomify.com/CVE-2022-50920/): Sandboxie-Plus 5.50.2 - 'Service SbieSvc' Unquoted Service Path (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/169/