# Vulnerabilities published in 2022


- [CVE-2022-48188](https://insights.sbomify.com/CVE-2022-48188/): Memory corruption in ThinkStation BIOS (medium 6.7)
- [CVE-2022-48186](https://insights.sbomify.com/CVE-2022-48186/): Security feature bypass in Baiying (medium 6.2)
- [CVE-2022-48183](https://insights.sbomify.com/CVE-2022-48183/): Security feature bypass in ThinkPad T14s Gen 3 BIOS - Linux (medium 6.1)
- [CVE-2022-48182](https://insights.sbomify.com/CVE-2022-48182/): Security feature bypass in ThinkPad T14s Gen 3 BIOS - Linux (medium 6.1)
- [CVE-2022-48181](https://insights.sbomify.com/CVE-2022-48181/): Memory corruption in ThinkStation BIOS (medium 6.7)
- [CVE-2022-4818](https://insights.sbomify.com/CVE-2022-4818/): Talend Open Studio for MDM SystemStorageWrapper.java xml external entity reference (medium 5.5)
- [CVE-2022-48178](https://insights.sbomify.com/CVE-2022-48178/): Cross-site scripting in x2engine:x2crm (medium 5.4)
- [CVE-2022-48177](https://insights.sbomify.com/CVE-2022-48177/): Cross-site scripting in x2engine:x2crm (medium 5.4)
- [CVE-2022-48176](https://insights.sbomify.com/CVE-2022-48176/): Memory corruption in netgear:mr60 firmware (high 7.8)
- [CVE-2022-48175](https://insights.sbomify.com/CVE-2022-48175/): Code injection in rukovoditel:rukovoditel (critical 9.8)
- [CVE-2022-48174](https://insights.sbomify.com/CVE-2022-48174/): Memory corruption in busybox:busybox (critical 9.8)
- [CVE-2022-4817](https://insights.sbomify.com/CVE-2022-4817/): centic9 jgit-cookbook temp file (low 3.1)
- [CVE-2022-48166](https://insights.sbomify.com/CVE-2022-48166/): Missing authorization in wavlink:wl-wn530hg4 firmware (high 7.5)
- [CVE-2022-48165](https://insights.sbomify.com/CVE-2022-48165/): Missing authorization in wavlink:wl-wn530h4 firmware (high 7.5)
- [CVE-2022-48164](https://insights.sbomify.com/CVE-2022-48164/): Missing authorization in wavlink:wl-wn533a8 firmware (high 7.5)
- [CVE-2022-48161](https://insights.sbomify.com/CVE-2022-48161/): Path traversal in easy images project:easy images (high 7.5)
- [CVE-2022-4816](https://insights.sbomify.com/CVE-2022-4816/): Denial of service in Safecenter (medium 6.2)
- [CVE-2022-48152](https://insights.sbomify.com/CVE-2022-48152/): SQL injection in remoteclinic:remote clinic (critical 9.8)
- [CVE-2022-48150](https://insights.sbomify.com/CVE-2022-48150/): Shopware vulnerable to cross-site scripting (XSS) (medium 6.1)
- [CVE-2022-4815](https://insights.sbomify.com/CVE-2022-4815/): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (high 8.0)
- [CVE-2022-48149](https://insights.sbomify.com/CVE-2022-48149/): SQL injection in online student admission system project:online student admission system (critical 9.8)
- [CVE-2022-48140](https://insights.sbomify.com/CVE-2022-48140/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2022-4814](https://insights.sbomify.com/CVE-2022-4814/): Improper Access Control in usememos/memos (high 8.6)
- [CVE-2022-48130](https://insights.sbomify.com/CVE-2022-48130/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2022-4813](https://insights.sbomify.com/CVE-2022-4813/): Insufficient Granularity of Access Control in usememos/memos (high 8.6)
- [CVE-2022-48126](https://insights.sbomify.com/CVE-2022-48126/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-48125](https://insights.sbomify.com/CVE-2022-48125/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-48124](https://insights.sbomify.com/CVE-2022-48124/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-48123](https://insights.sbomify.com/CVE-2022-48123/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-48122](https://insights.sbomify.com/CVE-2022-48122/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-48121](https://insights.sbomify.com/CVE-2022-48121/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-48120](https://insights.sbomify.com/CVE-2022-48120/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-4812](https://insights.sbomify.com/CVE-2022-4812/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.6)
- [CVE-2022-48118](https://insights.sbomify.com/CVE-2022-48118/): Cross-site scripting in jorani:jorani (medium 6.1)
- [CVE-2022-48116](https://insights.sbomify.com/CVE-2022-48116/): Code injection in ayacms project:ayacms (high 7.2)
- [CVE-2022-48115](https://insights.sbomify.com/CVE-2022-48115/): Cross-site Scripting in jspreadsheet (medium 6.1)
- [CVE-2022-48114](https://insights.sbomify.com/CVE-2022-48114/): SQL injection in ruoyi:ruoyi (critical 9.8)
- [CVE-2022-48113](https://insights.sbomify.com/CVE-2022-48113/): Hardcoded credentials in totolink:n200re-v5 firmware (critical 9.8)
- [CVE-2022-48111](https://insights.sbomify.com/CVE-2022-48111/): Cross-site scripting in siri-informatica:wi400 (medium 6.1)
- [CVE-2022-48110](https://insights.sbomify.com/CVE-2022-48110/): Cross-site scripting in ckeditor:ckeditor (medium 6.1)
- [CVE-2022-4811](https://insights.sbomify.com/CVE-2022-4811/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.3)
- [CVE-2022-48108](https://insights.sbomify.com/CVE-2022-48108/): Command injection in dlink:dir 878 firmware (critical 9.8)
- [CVE-2022-48107](https://insights.sbomify.com/CVE-2022-48107/): Command injection in dlink:dir 878 firmware (critical 9.8)
- [CVE-2022-4810](https://insights.sbomify.com/CVE-2022-4810/): Improper Access Control in usememos/memos (medium 6.3)
- [CVE-2022-48094](https://insights.sbomify.com/CVE-2022-48094/): Path traversal in lmxcms:lmxcms (medium 4.9)
- [CVE-2022-48093](https://insights.sbomify.com/CVE-2022-48093/): Code injection in seacms:seacms (high 7.2)
- [CVE-2022-48091](https://insights.sbomify.com/CVE-2022-48091/): Cross-site scripting in hotel management system project:hotel management system (medium 5.4)
- [CVE-2022-48090](https://insights.sbomify.com/CVE-2022-48090/): SQL injection in hotel management system project:hotel management system (medium 6.5)
- [CVE-2022-4809](https://insights.sbomify.com/CVE-2022-4809/): Improper Access Control in usememos/memos (high 8.3)
- [CVE-2022-48085](https://insights.sbomify.com/CVE-2022-48085/): Cross-site scripting in softr:softr (medium 5.4)
- [CVE-2022-48082](https://insights.sbomify.com/CVE-2022-48082/): SQL injection in easyone:easyone crm (critical 9.8)
- [CVE-2022-4808](https://insights.sbomify.com/CVE-2022-4808/): Improper Privilege Management in usememos/memos (medium 4.2)
- [CVE-2022-48079](https://insights.sbomify.com/CVE-2022-48079/): File upload in mengnai:aapanel host system (critical 9.8)
- [CVE-2022-48078](https://insights.sbomify.com/CVE-2022-48078/): Memory corruption in pycdc project:pycdc (critical 9.8)
- [CVE-2022-48077](https://insights.sbomify.com/CVE-2022-48077/): Privilege escalation in genymotion:genymotion desktop (high 7.8)
- [CVE-2022-48074](https://insights.sbomify.com/CVE-2022-48074/): Command injection in nomachine:nomachine (medium 5.3)
- [CVE-2022-48073](https://insights.sbomify.com/CVE-2022-48073/): Information disclosure in phicomm:k2 firmware (high 7.5)
- [CVE-2022-48072](https://insights.sbomify.com/CVE-2022-48072/): Command injection in phicomm:k2 firmware (high 7.8)
- [CVE-2022-48071](https://insights.sbomify.com/CVE-2022-48071/): Information disclosure in phicomm:k2 firmware (high 7.5)
- [CVE-2022-48070](https://insights.sbomify.com/CVE-2022-48070/): Command injection in phicomm:k2 firmware (high 7.8)
- [CVE-2022-4807](https://insights.sbomify.com/CVE-2022-4807/): Improper Access Control in usememos/memos (high 8.2)
- [CVE-2022-48069](https://insights.sbomify.com/CVE-2022-48069/): Command injection in totolink:a830r firmware (high 7.5)
- [CVE-2022-48067](https://insights.sbomify.com/CVE-2022-48067/): Hardcoded credentials in totolink:a830r firmware (medium 5.5)
- [CVE-2022-48066](https://insights.sbomify.com/CVE-2022-48066/): Auth bypass in totolink:a830r firmware (critical 9.8)
- [CVE-2022-48065](https://insights.sbomify.com/CVE-2022-48065/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2022-48064](https://insights.sbomify.com/CVE-2022-48064/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2022-48063](https://insights.sbomify.com/CVE-2022-48063/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2022-4806](https://insights.sbomify.com/CVE-2022-4806/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.2)
- [CVE-2022-4805](https://insights.sbomify.com/CVE-2022-4805/): Incorrect Use of Privileged APIs in usememos/memos (high 7.3)
- [CVE-2022-4804](https://insights.sbomify.com/CVE-2022-4804/): Improper Authorization in usememos/memos (high 8.2)
- [CVE-2022-4803](https://insights.sbomify.com/CVE-2022-4803/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.1)
- [CVE-2022-48023](https://insights.sbomify.com/CVE-2022-48023/): Missing authorization in zammad:zammad (medium 4.3)
- [CVE-2022-48022](https://insights.sbomify.com/CVE-2022-48022/): Missing authorization in zammad:zammad (medium 4.3)
- [CVE-2022-48021](https://insights.sbomify.com/CVE-2022-48021/): Other in zammad:zammad (critical 9.8)
- [CVE-2022-48020](https://insights.sbomify.com/CVE-2022-48020/): Cross-site scripting in vinteo:video core (medium 6.1)
- [CVE-2022-4802](https://insights.sbomify.com/CVE-2022-4802/): Authorization Bypass Through User-Controlled Key in usememos/memos (critical 9.1)
- [CVE-2022-48019](https://insights.sbomify.com/CVE-2022-48019/): Privilege escalation in wfs:another eden (high 7.8)
- [CVE-2022-48013](https://insights.sbomify.com/CVE-2022-48013/): Cross-site scripting in opencats:opencats (medium 5.4)
- [CVE-2022-48012](https://insights.sbomify.com/CVE-2022-48012/): Cross-site scripting in opencats:opencats (medium 6.1)
- [CVE-2022-48011](https://insights.sbomify.com/CVE-2022-48011/): SQL injection in opencats:opencats (critical 9.8)
- [CVE-2022-48010](https://insights.sbomify.com/CVE-2022-48010/): Cross-site scripting in limesurvey:limesurvey (medium 5.4)
- [CVE-2022-4801](https://insights.sbomify.com/CVE-2022-4801/): Insufficient Granularity of Access Control in usememos/memos (high 8.2)
- [CVE-2022-48008](https://insights.sbomify.com/CVE-2022-48008/): File upload in limesurvey:limesurvey (critical 9.8)
- [CVE-2022-48007](https://insights.sbomify.com/CVE-2022-48007/): Cross-site scripting in piwigo:piwigo (medium 5.4)
- [CVE-2022-48006](https://insights.sbomify.com/CVE-2022-48006/): File upload in taogogo:taocms (critical 9.8)
- [CVE-2022-4800](https://insights.sbomify.com/CVE-2022-4800/): Improper Verification of Source of a Communication Channel in usememos/memos (high 8.6)
- [CVE-2022-47990](https://insights.sbomify.com/CVE-2022-47990/): IBM AIX denial of service (medium 6.2)
- [CVE-2022-4799](https://insights.sbomify.com/CVE-2022-4799/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.6)
- [CVE-2022-47986](https://insights.sbomify.com/CVE-2022-47986/): IBM Aspera Faspex Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-47984](https://insights.sbomify.com/CVE-2022-47984/): IBM InfoSphere Information Server SQL injection (medium 6.3)
- [CVE-2022-47983](https://insights.sbomify.com/CVE-2022-47983/): IBM InfoSphere Information Server cross-site scripting (medium 5.4)
- [CVE-2022-4798](https://insights.sbomify.com/CVE-2022-4798/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.6)
- [CVE-2022-47977](https://insights.sbomify.com/CVE-2022-47977/): Memory corruption in JT Open (high 7.8)
- [CVE-2022-47976](https://insights.sbomify.com/CVE-2022-47976/): Auth bypass in EMUI (high 7.5)
- [CVE-2022-47975](https://insights.sbomify.com/CVE-2022-47975/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-47974](https://insights.sbomify.com/CVE-2022-47974/): Denial of service in EMUI (medium 6.5)
- [CVE-2022-4797](https://insights.sbomify.com/CVE-2022-4797/): Improper Restriction of Excessive Authentication Attempts in usememos/memos (critical 9.8)
- [CVE-2022-47968](https://insights.sbomify.com/CVE-2022-47968/): Cross-site scripting in linuxserver:heimdall application dashboard (medium 5.4)
- [CVE-2022-47967](https://insights.sbomify.com/CVE-2022-47967/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2022-47966](https://insights.sbomify.com/CVE-2022-47966/): Zoho ManageEngine Multiple Products Remote Code Execution (critical 9.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/197/