# Vulnerabilities published in 2022


- [CVE-2022-47714](https://insights.sbomify.com/CVE-2022-47714/): Misconfiguration in lastyard:last yard (critical 9.8)
- [CVE-2022-4771](https://insights.sbomify.com/CVE-2022-4771/): Cross-site scripting in Pentaho Business Analytics Server (medium 5.4)
- [CVE-2022-47703](https://insights.sbomify.com/CVE-2022-47703/): Information disclosure in tianjie:cpe906-3 (high 7.5)
- [CVE-2022-47701](https://insights.sbomify.com/CVE-2022-47701/): Cross-site scripting in comfast project:cf-wr623n firmware (medium 6.1)
- [CVE-2022-47700](https://insights.sbomify.com/CVE-2022-47700/): Auth bypass in comfast project:cf-wr623n firmware (high 7.5)
- [CVE-2022-4770](https://insights.sbomify.com/CVE-2022-4770/): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (medium 4.3)
- [CVE-2022-47699](https://insights.sbomify.com/CVE-2022-47699/): Missing authorization in comfast project:cf-wr623n firmware (critical 9.8)
- [CVE-2022-47698](https://insights.sbomify.com/CVE-2022-47698/): Cross-site scripting in comfast project:cf-wr623n firmware (medium 6.1)
- [CVE-2022-47697](https://insights.sbomify.com/CVE-2022-47697/): Auth bypass in comfast project:cf-wr623n firmware (critical 9.8)
- [CVE-2022-47696](https://insights.sbomify.com/CVE-2022-47696/): Denial of service in gnu:binutils (high 7.8)
- [CVE-2022-47695](https://insights.sbomify.com/CVE-2022-47695/): Denial of service in gnu:binutils (high 7.8)
- [CVE-2022-4769](https://insights.sbomify.com/CVE-2022-4769/): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (medium 4.3)
- [CVE-2022-4768](https://insights.sbomify.com/CVE-2022-4768/): Dropbox merou SSH Public Key public_key.py add_public_key injection (medium 6.3)
- [CVE-2022-47673](https://insights.sbomify.com/CVE-2022-47673/): Memory corruption in gnu:binutils (high 7.8)
- [CVE-2022-4767](https://insights.sbomify.com/CVE-2022-4767/): Denial of Service in usememos/memos (high 7.6)
- [CVE-2022-47665](https://insights.sbomify.com/CVE-2022-47665/): Memory corruption in struktur:libde265 (high 7.8)
- [CVE-2022-47664](https://insights.sbomify.com/CVE-2022-47664/): Memory corruption in struktur:libde265 (high 7.8)
- [CVE-2022-47663](https://insights.sbomify.com/CVE-2022-47663/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47662](https://insights.sbomify.com/CVE-2022-47662/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2022-47661](https://insights.sbomify.com/CVE-2022-47661/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47660](https://insights.sbomify.com/CVE-2022-47660/): Integer overflow in gpac:gpac (high 7.8)
- [CVE-2022-4766](https://insights.sbomify.com/CVE-2022-4766/): dolibarr_project_timesheet Form cross-site request forgery (medium 4.3)
- [CVE-2022-47659](https://insights.sbomify.com/CVE-2022-47659/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47658](https://insights.sbomify.com/CVE-2022-47658/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47657](https://insights.sbomify.com/CVE-2022-47657/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47656](https://insights.sbomify.com/CVE-2022-47656/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47655](https://insights.sbomify.com/CVE-2022-47655/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-47654](https://insights.sbomify.com/CVE-2022-47654/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47653](https://insights.sbomify.com/CVE-2022-47653/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-4765](https://insights.sbomify.com/CVE-2022-4765/): Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio < 2.3.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47648](https://insights.sbomify.com/CVE-2022-47648/): Auth bypass in B420 (high 7.6)
- [CVE-2022-4764](https://insights.sbomify.com/CVE-2022-4764/): Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2022-47637](https://insights.sbomify.com/CVE-2022-47637/): Privilege escalation in apachefriends:xampp (medium 6.7)
- [CVE-2022-47636](https://insights.sbomify.com/CVE-2022-47636/): Code injection in outsystems:service studio (high 7.8)
- [CVE-2022-47635](https://insights.sbomify.com/CVE-2022-47635/): Server-side request forgery in wildix:wms (critical 9.8)
- [CVE-2022-47634](https://insights.sbomify.com/CVE-2022-47634/): Missing authorization in isode:m-link (high 8.1)
- [CVE-2022-47633](https://insights.sbomify.com/CVE-2022-47633/): kyverno verifyImages rule bypass possible with malicious proxy/registry (high 8.1)
- [CVE-2022-47632](https://insights.sbomify.com/CVE-2022-47632/): Privilege escalation in razer:synapse (medium 6.8)
- [CVE-2022-47631](https://insights.sbomify.com/CVE-2022-47631/): Race condition in razer:synapse (high 7.8)
- [CVE-2022-47630](https://insights.sbomify.com/CVE-2022-47630/): Memory corruption in trustedfirmware:trusted firmware-a (high 7.4)
- [CVE-2022-4763](https://insights.sbomify.com/CVE-2022-4763/): Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47629](https://insights.sbomify.com/CVE-2022-47629/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-4762](https://insights.sbomify.com/CVE-2022-4762/): Materialis Companion < 1.3.40 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47618](https://insights.sbomify.com/CVE-2022-47618/): Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials (critical 9.8)
- [CVE-2022-47617](https://insights.sbomify.com/CVE-2022-47617/): Hitron Technologies Inc. CODA-5310 - Hard-coded Cryptographic Key (high 7.2)
- [CVE-2022-47616](https://insights.sbomify.com/CVE-2022-47616/): Hitron Technologies Inc. CODA-5310 - Remote Command Execution (high 7.2)
- [CVE-2022-47615](https://insights.sbomify.com/CVE-2022-47615/): WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion (critical 9.3)
- [CVE-2022-47614](https://insights.sbomify.com/CVE-2022-47614/): WordPress MStore API Plugin <= 3.9.7 is vulnerable to SQL Injection (high 7.5)
- [CVE-2022-47613](https://insights.sbomify.com/CVE-2022-47613/): WordPress AI ChatBot Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47612](https://insights.sbomify.com/CVE-2022-47612/): WordPress Participants Database Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47611](https://insights.sbomify.com/CVE-2022-47611/): WordPress Hover Image Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47610](https://insights.sbomify.com/CVE-2022-47610/): WordPress Simple Image Popup Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-4761](https://insights.sbomify.com/CVE-2022-4761/): Post Views Count <= 3.0.2 - Contributor+ Stored XSS in Shortcode (medium 6.8)
- [CVE-2022-47609](https://insights.sbomify.com/CVE-2022-47609/): WordPress DNUI Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3)
- [CVE-2022-47608](https://insights.sbomify.com/CVE-2022-47608/): WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47607](https://insights.sbomify.com/CVE-2022-47607/): WordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47606](https://insights.sbomify.com/CVE-2022-47606/): WordPress WP-CORS Plugin <= 0.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47605](https://insights.sbomify.com/CVE-2022-47605/): WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection (SQLi) (high 8.3)
- [CVE-2022-47604](https://insights.sbomify.com/CVE-2022-47604/): WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-47603](https://insights.sbomify.com/CVE-2022-47603/): WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-47602](https://insights.sbomify.com/CVE-2022-47602/): WordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-47601](https://insights.sbomify.com/CVE-2022-47601/): WordPress WP Table Manager plugin <= 3.5.2 - Broken Access Control (medium 5.3)
- [CVE-2022-47600](https://insights.sbomify.com/CVE-2022-47600/): WordPress Mass Email To users Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-4760](https://insights.sbomify.com/CVE-2022-4760/): OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47599](https://insights.sbomify.com/CVE-2022-47599/): WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object Injection (medium 5.5)
- [CVE-2022-47598](https://insights.sbomify.com/CVE-2022-47598/): WordPress WP Super Popup Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47597](https://insights.sbomify.com/CVE-2022-47597/): WordPress Popup Maker Plugin <= 1.17.1 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2022-47596](https://insights.sbomify.com/CVE-2022-47596/): WordPress Media Library Categories Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47595](https://insights.sbomify.com/CVE-2022-47595/): WordPress WP Google Maps Plugin <= 9.0.15 is vulnerable to Path Traversal (medium 4.9)
- [CVE-2022-47594](https://insights.sbomify.com/CVE-2022-47594/): WordPress Essential Blocks for Gutenberg plugin <= 3.8.5 - Broken Access Control (medium 6.5)
- [CVE-2022-47593](https://insights.sbomify.com/CVE-2022-47593/): WordPress RapidLoad Power-Up for Autoptimize Plugin <= 1.6.35 is vulnerable to SQL Injection (high 8.5)
- [CVE-2022-47592](https://insights.sbomify.com/CVE-2022-47592/): WordPress MagicForm Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-47591](https://insights.sbomify.com/CVE-2022-47591/): WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-47590](https://insights.sbomify.com/CVE-2022-47590/): WordPress Maintenance Switch Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-4759](https://insights.sbomify.com/CVE-2022-4759/): GigPress < 2.3.28 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2022-47589](https://insights.sbomify.com/CVE-2022-47589/): WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47588](https://insights.sbomify.com/CVE-2022-47588/): WordPress Simple Photo Gallery Plugin <= v1.8.1 is vulnerable to SQL Injection (medium 6.7)
- [CVE-2022-47587](https://insights.sbomify.com/CVE-2022-47587/): WordPress WP Search Analytics Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47586](https://insights.sbomify.com/CVE-2022-47586/): WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection (high 8.2)
- [CVE-2022-47583](https://insights.sbomify.com/CVE-2022-47583/): Command injection in mintty project:mintty (critical 9.8)
- [CVE-2022-47581](https://insights.sbomify.com/CVE-2022-47581/): Denial of service in isode:m-vault (high 7.5)
- [CVE-2022-4758](https://insights.sbomify.com/CVE-2022-4758/): 10WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47578](https://insights.sbomify.com/CVE-2022-47578/): Security feature bypass in zohocorp:manageengine device control plus (high 7.1)
- [CVE-2022-47577](https://insights.sbomify.com/CVE-2022-47577/): Security feature bypass in zohocorp:manageengine device control plus (high 7.1)
- [CVE-2022-4757](https://insights.sbomify.com/CVE-2022-4757/): List Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47562](https://insights.sbomify.com/CVE-2022-47562/): Allocation of Resources Without Limits or Throttling in Ormazabal products (high 7.5)
- [CVE-2022-47561](https://insights.sbomify.com/CVE-2022-47561/): Unprotected Storage of Credentials in Ormazabal products (high 7.3)
- [CVE-2022-47560](https://insights.sbomify.com/CVE-2022-47560/): Cleartext Transmission of Sensitive Information in Ormazabal products (medium 5.7)
- [CVE-2022-4756](https://insights.sbomify.com/CVE-2022-4756/): YouTube Channel < 3.23.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47559](https://insights.sbomify.com/CVE-2022-47559/): Cross-Site Request Forgery in Ormazabal products (high 8.6)
- [CVE-2022-47558](https://insights.sbomify.com/CVE-2022-47558/): Improper Access Control in Ormazabal products (critical 9.4)
- [CVE-2022-47557](https://insights.sbomify.com/CVE-2022-47557/): Use of Password Hash With Insufficient Computational Effort in Ormazabal products (medium 6.1)
- [CVE-2022-47556](https://insights.sbomify.com/CVE-2022-47556/): Uncontrolled Resource Consumption in Ormazabal products (medium 6.5)
- [CVE-2022-47555](https://insights.sbomify.com/CVE-2022-47555/): Improper Neutralization of Special Elements in Ormazabal products (critical 9.3)
- [CVE-2022-47554](https://insights.sbomify.com/CVE-2022-47554/): Exposure of Sensitive Information in Ormazabal products (high 8.2)
- [CVE-2022-47553](https://insights.sbomify.com/CVE-2022-47553/): Improper Authorization in Ormazabal products (high 8.6)
- [CVE-2022-47551](https://insights.sbomify.com/CVE-2022-47551/): Apiman has potential permissions bypass (medium 6.5)
- [CVE-2022-4755](https://insights.sbomify.com/CVE-2022-4755/): FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scripting (low 3.5)
- [CVE-2022-47549](https://insights.sbomify.com/CVE-2022-47549/): Security feature bypass in trustedfirmware:op-tee (medium 6.4)
- [CVE-2022-47547](https://insights.sbomify.com/CVE-2022-47547/): Business logic in protocol:gossipsub (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/199/