# Vulnerabilities published in 2022


- [CVE-2022-47965](https://insights.sbomify.com/CVE-2022-47965/): Memory corruption in macOS (high 7.8)
- [CVE-2022-4796](https://insights.sbomify.com/CVE-2022-4796/): Incorrect Use of Privileged APIs in usememos/memos (high 8.1)
- [CVE-2022-47952](https://insights.sbomify.com/CVE-2022-47952/): Information disclosure in linuxcontainers:lxc (low 3.3)
- [CVE-2022-47951](https://insights.sbomify.com/CVE-2022-47951/): OpenStack Cinder, glance, and Nova vulnerable to Path Traversal (medium 5.7)
- [CVE-2022-47950](https://insights.sbomify.com/CVE-2022-47950/): OpenStack Swift XML external entities (XXE) Injection (medium 6.5)
- [CVE-2022-4795](https://insights.sbomify.com/CVE-2022-4795/): Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47949](https://insights.sbomify.com/CVE-2022-47949/): Memory corruption in nintendo:animal crossing\ (critical 9.8)
- [CVE-2022-47946](https://insights.sbomify.com/CVE-2022-47946/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2022-47945](https://insights.sbomify.com/CVE-2022-47945/): ThinkPHP Framework vulnerable to remote code execution (critical 9.8)
- [CVE-2022-47943](https://insights.sbomify.com/CVE-2022-47943/): Memory corruption in linux:linux kernel (high 8.1)
- [CVE-2022-47942](https://insights.sbomify.com/CVE-2022-47942/): Memory corruption in linux:linux kernel (high 8.8)
- [CVE-2022-47941](https://insights.sbomify.com/CVE-2022-47941/): Denial of service in linux:linux kernel (high 7.5)
- [CVE-2022-47940](https://insights.sbomify.com/CVE-2022-47940/): Memory corruption in linux:linux kernel (high 8.1)
- [CVE-2022-4794](https://insights.sbomify.com/CVE-2022-4794/): AAWP < 3.12.3 - Unsafe URL Handling (high 7.5)
- [CVE-2022-47939](https://insights.sbomify.com/CVE-2022-47939/): Use after free in linux:linux kernel (critical 9.8)
- [CVE-2022-47938](https://insights.sbomify.com/CVE-2022-47938/): Memory corruption in linux:linux kernel (medium 6.5)
- [CVE-2022-47937](https://insights.sbomify.com/CVE-2022-47937/): Multiple parsing problems in the Apache Sling Commons JSON module (critical 9.8)
- [CVE-2022-47936](https://insights.sbomify.com/CVE-2022-47936/): Memory corruption in JT Open (high 7.8)
- [CVE-2022-47935](https://insights.sbomify.com/CVE-2022-47935/): Memory corruption in JT Open (high 7.8)
- [CVE-2022-47934](https://insights.sbomify.com/CVE-2022-47934/): Denial of service in brave:brave (medium 6.5)
- [CVE-2022-47933](https://insights.sbomify.com/CVE-2022-47933/): Denial of service in brave:brave (medium 6.5)
- [CVE-2022-47932](https://insights.sbomify.com/CVE-2022-47932/): Denial of service in brave:brave (medium 6.5)
- [CVE-2022-47931](https://insights.sbomify.com/CVE-2022-47931/): Collision of hash values in github.com/bnb-chain/tss-lib (medium 6.5)
- [CVE-2022-47930](https://insights.sbomify.com/CVE-2022-47930/): IO FinNet tss-lib vulnerable to replay attacks involving proofs (medium 6.8)
- [CVE-2022-4793](https://insights.sbomify.com/CVE-2022-4793/): Blog Designer – Post and Widget < 2.4.1 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2022-47929](https://insights.sbomify.com/CVE-2022-47929/): Null dereference in debian:debian linux (medium 5.5)
- [CVE-2022-47928](https://insights.sbomify.com/CVE-2022-47928/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2022-47927](https://insights.sbomify.com/CVE-2022-47927/): Information disclosure in fedoraproject:fedora (medium 5.5)
- [CVE-2022-47926](https://insights.sbomify.com/CVE-2022-47926/): Path traversal in ayacms project:ayacms (critical 9.8)
- [CVE-2022-47925](https://insights.sbomify.com/CVE-2022-47925/): Insufficient Input Validation in the Endpoint of the csaf-validator-service (high 7.5)
- [CVE-2022-47924](https://insights.sbomify.com/CVE-2022-47924/): Arbitrary Code Execution using the validate function of csaf-validator-lib (medium 6.5)
- [CVE-2022-4792](https://insights.sbomify.com/CVE-2022-4792/): News & Blog Designer Pack < 3.3 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47917](https://insights.sbomify.com/CVE-2022-47917/): CVE-2022-47917 (medium 6.8)
- [CVE-2022-47915](https://insights.sbomify.com/CVE-2022-47915/): Memory corruption in macOS (high 7.8)
- [CVE-2022-47911](https://insights.sbomify.com/CVE-2022-47911/): CVE-2022-47911 (critical 9.1)
- [CVE-2022-4791](https://insights.sbomify.com/CVE-2022-4791/): Product Slider and Carousel with Category for WooCommerce < 2.8 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47909](https://insights.sbomify.com/CVE-2022-47909/): LQL Injection in Livestatus HTTP headers (medium 6.8)
- [CVE-2022-47908](https://insights.sbomify.com/CVE-2022-47908/): Memory corruption in V-Server (high 7.8)
- [CVE-2022-4790](https://insights.sbomify.com/CVE-2022-4790/): WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47896](https://insights.sbomify.com/CVE-2022-47896/): Code injection in IntelliJ IDEA (medium 5.0)
- [CVE-2022-47895](https://insights.sbomify.com/CVE-2022-47895/): Weak cryptography in IntelliJ IDEA (medium 4.7)
- [CVE-2022-47894](https://insights.sbomify.com/CVE-2022-47894/): Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE (medium 5.3)
- [CVE-2022-47893](https://insights.sbomify.com/CVE-2022-47893/): NetMan 204 Remote Code Execution (critical 10.0)
- [CVE-2022-47892](https://insights.sbomify.com/CVE-2022-47892/): Information disclosure in NetMan 204 (medium 5.3)
- [CVE-2022-47891](https://insights.sbomify.com/CVE-2022-47891/): Admin password reset in NetMan 204 (high 8.1)
- [CVE-2022-4789](https://insights.sbomify.com/CVE-2022-4789/): WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47881](https://insights.sbomify.com/CVE-2022-47881/): Memory corruption in foxit:pdf editor (medium 6.5)
- [CVE-2022-47880](https://insights.sbomify.com/CVE-2022-47880/): Information disclosure in jedox:jedox (medium 6.8)
- [CVE-2022-4788](https://insights.sbomify.com/CVE-2022-4788/): Embed PDF <= 1.0.6 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47879](https://insights.sbomify.com/CVE-2022-47879/): Code injection in jedox:jedox (high 7.5)
- [CVE-2022-47878](https://insights.sbomify.com/CVE-2022-47878/): File upload in jedox:jedox (critical 9.1)
- [CVE-2022-47877](https://insights.sbomify.com/CVE-2022-47877/): Cross-site scripting in jedox:jedox (critical 9.6)
- [CVE-2022-47876](https://insights.sbomify.com/CVE-2022-47876/): Code injection in jedox:jedox (critical 9.1)
- [CVE-2022-47875](https://insights.sbomify.com/CVE-2022-47875/): Path traversal in jedox:cloud (high 8.8)
- [CVE-2022-47874](https://insights.sbomify.com/CVE-2022-47874/): Missing authorization in jedox:cloud (medium 6.5)
- [CVE-2022-47873](https://insights.sbomify.com/CVE-2022-47873/): XML external entity in netcad:keos (critical 9.8)
- [CVE-2022-47872](https://insights.sbomify.com/CVE-2022-47872/): Server-side request forgery in maccms:maccms (high 8.8)
- [CVE-2022-47870](https://insights.sbomify.com/CVE-2022-47870/): Cross-site scripting in red-gate:sql monitor (medium 6.1)
- [CVE-2022-4787](https://insights.sbomify.com/CVE-2022-4787/): Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47866](https://insights.sbomify.com/CVE-2022-47866/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-47865](https://insights.sbomify.com/CVE-2022-47865/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-47864](https://insights.sbomify.com/CVE-2022-47864/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-47862](https://insights.sbomify.com/CVE-2022-47862/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-47861](https://insights.sbomify.com/CVE-2022-47861/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-47860](https://insights.sbomify.com/CVE-2022-47860/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-4786](https://insights.sbomify.com/CVE-2022-4786/): Video.js - HTML5 Video Player for WordPress <= 4.5.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47859](https://insights.sbomify.com/CVE-2022-47859/): SQL injection in lead management system project:lead management system (critical 9.8)
- [CVE-2022-47854](https://insights.sbomify.com/CVE-2022-47854/): File upload in i-librarian:i-librarian (critical 9.8)
- [CVE-2022-47853](https://insights.sbomify.com/CVE-2022-47853/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-4785](https://insights.sbomify.com/CVE-2022-4785/): Download Video Sidebar Widgets <= 6.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47848](https://insights.sbomify.com/CVE-2022-47848/): Information disclosure in bezeq:vtech iad604-il firmware (high 7.5)
- [CVE-2022-4784](https://insights.sbomify.com/CVE-2022-4784/): Hueman Addons <= 2.3.3 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-4783](https://insights.sbomify.com/CVE-2022-4783/): Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-4782](https://insights.sbomify.com/CVE-2022-4782/): ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-4781](https://insights.sbomify.com/CVE-2022-4781/): Accordion Shortcodes <= 2.4.2 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-4780](https://insights.sbomify.com/CVE-2022-4780/): hard coded credentials in elvexys ISOS firmwares (medium 4.5)
- [CVE-2022-47790](https://insights.sbomify.com/CVE-2022-47790/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (critical 9.8)
- [CVE-2022-4779](https://insights.sbomify.com/CVE-2022-4779/): authentication bypass in elvexys StreamX using StreamView HTML component with public web server feature (high 7.5)
- [CVE-2022-47780](https://insights.sbomify.com/CVE-2022-47780/): SQL injection in bangresto project:bangresto (critical 9.8)
- [CVE-2022-4778](https://insights.sbomify.com/CVE-2022-4778/): path traversal in elvexys StreamX using StreamView HTML component with public web server feature (medium 6.5)
- [CVE-2022-47770](https://insights.sbomify.com/CVE-2022-47770/): SQL injection in serinf:fast checkin (critical 9.8)
- [CVE-2022-4777](https://insights.sbomify.com/CVE-2022-4777/): Bootstrap Shortcodes <= 3.4.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47769](https://insights.sbomify.com/CVE-2022-47769/): File upload in serinf:fast checkin (critical 9.8)
- [CVE-2022-47768](https://insights.sbomify.com/CVE-2022-47768/): Path traversal in serinf:fast checkin (high 7.5)
- [CVE-2022-47767](https://insights.sbomify.com/CVE-2022-47767/): Hardcoded credentials in solar-log:solar-log 1000 firmware (critical 9.8)
- [CVE-2022-47766](https://insights.sbomify.com/CVE-2022-47766/): File upload in popojicms:popojicms (high 8.8)
- [CVE-2022-47762](https://insights.sbomify.com/CVE-2022-47762/): Path Traversal in gin-vue-admin (high 7.5)
- [CVE-2022-4776](https://insights.sbomify.com/CVE-2022-4776/): CC Child Pages < 1.43 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47758](https://insights.sbomify.com/CVE-2022-47758/): Security feature bypass in nanoleaf:nanoleaf firmware (critical 9.8)
- [CVE-2022-47757](https://insights.sbomify.com/CVE-2022-47757/): Path traversal in imo:imo (critical 9.8)
- [CVE-2022-4775](https://insights.sbomify.com/CVE-2022-4775/): GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47747](https://insights.sbomify.com/CVE-2022-47747/): Kraken has arbitrary file read vulnerability via component testfs (high 7.5)
- [CVE-2022-47745](https://insights.sbomify.com/CVE-2022-47745/): SQL injection in easycorp:zentao (high 8.8)
- [CVE-2022-47740](https://insights.sbomify.com/CVE-2022-47740/): SQL injection in seltmann-webdesign:content management system (critical 9.8)
- [CVE-2022-4774](https://insights.sbomify.com/CVE-2022-4774/): Bit Form < 1.9 - RCE via Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2022-47732](https://insights.sbomify.com/CVE-2022-47732/): Auth bypass in yeastar:n412 firmware (high 7.5)
- [CVE-2022-4773](https://insights.sbomify.com/CVE-2022-4773/): cloudsync LocalFilesystemConnector.java getItem path traversal (low 2.5)
- [CVE-2022-4772](https://insights.sbomify.com/CVE-2022-4772/): Widoco WidocoUtils.java unZipIt path traversal (medium 4.5)
- [CVE-2022-47717](https://insights.sbomify.com/CVE-2022-47717/): Misconfiguration in lastyard:last yard (high 7.5)
- [CVE-2022-47715](https://insights.sbomify.com/CVE-2022-47715/): Information disclosure in lastyard:last yard (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/198/