# Vulnerabilities published in 2022


- [CVE-2022-47338](https://insights.sbomify.com/CVE-2022-47338/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.1)
- [CVE-2022-47337](https://insights.sbomify.com/CVE-2022-47337/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-47336](https://insights.sbomify.com/CVE-2022-47336/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-47335](https://insights.sbomify.com/CVE-2022-47335/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-47334](https://insights.sbomify.com/CVE-2022-47334/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2022-47333](https://insights.sbomify.com/CVE-2022-47333/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-47332](https://insights.sbomify.com/CVE-2022-47332/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-47331](https://insights.sbomify.com/CVE-2022-47331/): Race condition in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 4.7)
- [CVE-2022-47330](https://insights.sbomify.com/CVE-2022-47330/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-4733](https://insights.sbomify.com/CVE-2022-4733/): Cross-site Scripting (XSS) - Stored in openemr/openemr (medium 6.7)
- [CVE-2022-47329](https://insights.sbomify.com/CVE-2022-47329/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47328](https://insights.sbomify.com/CVE-2022-47328/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47327](https://insights.sbomify.com/CVE-2022-47327/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-47326](https://insights.sbomify.com/CVE-2022-47326/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47325](https://insights.sbomify.com/CVE-2022-47325/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47324](https://insights.sbomify.com/CVE-2022-47324/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47323](https://insights.sbomify.com/CVE-2022-47323/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47322](https://insights.sbomify.com/CVE-2022-47322/): Integer overflow in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-47320](https://insights.sbomify.com/CVE-2022-47320/): CVE-2022-47320 (high 8.1)
- [CVE-2022-4732](https://insights.sbomify.com/CVE-2022-4732/): Unrestricted Upload of File with Dangerous Type in microweber/microweber (medium 4.7)
- [CVE-2022-47318](https://insights.sbomify.com/CVE-2022-47318/): Code injection in ruby git (high 8.8)
- [CVE-2022-47317](https://insights.sbomify.com/CVE-2022-47317/): Memory corruption in V-Server (high 7.8)
- [CVE-2022-47311](https://insights.sbomify.com/CVE-2022-47311/): CVE-2022-47311 (high 8.5)
- [CVE-2022-4731](https://insights.sbomify.com/CVE-2022-4731/): myapnea Title cross site scripting (low 2.4)
- [CVE-2022-4730](https://insights.sbomify.com/CVE-2022-4730/): Graphite Web Absolute Time Range cross site scripting (low 3.5)
- [CVE-2022-4729](https://insights.sbomify.com/CVE-2022-4729/): Graphite Web Template Name cross site scripting (low 3.5)
- [CVE-2022-4728](https://insights.sbomify.com/CVE-2022-4728/): Graphite Web Cookie cross site scripting (low 3.5)
- [CVE-2022-4727](https://insights.sbomify.com/CVE-2022-4727/): OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting (low 3.5)
- [CVE-2022-4726](https://insights.sbomify.com/CVE-2022-4726/): SourceCodester Sanitization Management System Admin Login sql injection (medium 6.3)
- [CVE-2022-4725](https://insights.sbomify.com/CVE-2022-4725/): AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery (medium 5.5)
- [CVE-2022-4724](https://insights.sbomify.com/CVE-2022-4724/): Improper Access Control in ikus060/rdiffweb (high 8.4)
- [CVE-2022-4723](https://insights.sbomify.com/CVE-2022-4723/): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb (medium 6.3)
- [CVE-2022-4722](https://insights.sbomify.com/CVE-2022-4722/): Authentication Bypass by Primary Weakness in ikus060/rdiffweb (high 7.2)
- [CVE-2022-47213](https://insights.sbomify.com/CVE-2022-47213/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-47212](https://insights.sbomify.com/CVE-2022-47212/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-47211](https://insights.sbomify.com/CVE-2022-47211/): Microsoft Office Graphics Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-47210](https://insights.sbomify.com/CVE-2022-47210/): Command injection in NETGEAR Nighthawk WiFi6 Router (high 7.8)
- [CVE-2022-4721](https://insights.sbomify.com/CVE-2022-4721/): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffweb (medium 6.6)
- [CVE-2022-47209](https://insights.sbomify.com/CVE-2022-47209/): Hardcoded credentials in NETGEAR Nighthawk WiFi6 Router (high 8.8)
- [CVE-2022-47208](https://insights.sbomify.com/CVE-2022-47208/): Command injection in NETGEAR Nighthawk WiFi6 Router (high 8.8)
- [CVE-2022-4720](https://insights.sbomify.com/CVE-2022-4720/): Open Redirect in ikus060/rdiffweb (medium 6.1)
- [CVE-2022-47197](https://insights.sbomify.com/CVE-2022-47197/): Cross-site scripting in Ghost (critical 9.0)
- [CVE-2022-47196](https://insights.sbomify.com/CVE-2022-47196/): Cross-site scripting in Ghost (critical 9.0)
- [CVE-2022-47195](https://insights.sbomify.com/CVE-2022-47195/): Cross-site scripting in Ghost (critical 9.0)
- [CVE-2022-47194](https://insights.sbomify.com/CVE-2022-47194/): Cross-site scripting in Ghost (critical 9.0)
- [CVE-2022-47192](https://insights.sbomify.com/CVE-2022-47192/): Admin password reset via file upload vulnerability in Generex CS141 (high 8.8)
- [CVE-2022-47191](https://insights.sbomify.com/CVE-2022-47191/): Privilege Escalation via file upload vulnerability at Generex CS141 (medium 4.3)
- [CVE-2022-47190](https://insights.sbomify.com/CVE-2022-47190/): RCE via file upload vulnerability in Generex CS141 (critical 10.0)
- [CVE-2022-4719](https://insights.sbomify.com/CVE-2022-4719/): Business Logic Errors in ikus060/rdiffweb (medium 5.7)
- [CVE-2022-47189](https://insights.sbomify.com/CVE-2022-47189/): DoS via file upload vulnerability at Generex CS141 (high 7.5)
- [CVE-2022-47188](https://insights.sbomify.com/CVE-2022-47188/): Improper Input Validation in Generex CS141 (high 7.5)
- [CVE-2022-47187](https://insights.sbomify.com/CVE-2022-47187/): File upload XSS vulnerability in Generex CS141 (medium 5.3)
- [CVE-2022-47186](https://insights.sbomify.com/CVE-2022-47186/): Unrestricted Upload of File vulnerability in Generex CS141 (high 7.5)
- [CVE-2022-47185](https://insights.sbomify.com/CVE-2022-47185/): Apache Traffic Server: Invalid Range header causes a crash (high 7.5)
- [CVE-2022-47184](https://insights.sbomify.com/CVE-2022-47184/): Apache Traffic Server: The TRACE method can be use to disclose network information (high 7.5)
- [CVE-2022-47183](https://insights.sbomify.com/CVE-2022-47183/): Cross-site request forgery in Extra Block Design, Style, CSS for ANY Gutenberg Blocks (medium 5.4)
- [CVE-2022-47182](https://insights.sbomify.com/CVE-2022-47182/): WordPress APIExperts Square for WooCommerce plugin <= 4.4.1 - Broken Access Control (medium 5.3)
- [CVE-2022-47181](https://insights.sbomify.com/CVE-2022-47181/): WordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47180](https://insights.sbomify.com/CVE-2022-47180/): WordPress Kopa Framework Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-4718](https://insights.sbomify.com/CVE-2022-4718/): Landing Page Builder < 1.4.9.9 - Contributor+ Cross-Site Scripting via Shortcode (medium 5.4)
- [CVE-2022-47179](https://insights.sbomify.com/CVE-2022-47179/): WordPress OWM Weather Plugin <= 5.6.11 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47178](https://insights.sbomify.com/CVE-2022-47178/): WordPress Simple Share Buttons Adder Plugin <= 8.4.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47177](https://insights.sbomify.com/CVE-2022-47177/): WordPress WP EasyPay Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47176](https://insights.sbomify.com/CVE-2022-47176/): WordPress Depicter Slider plugin <= 1.9.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-47175](https://insights.sbomify.com/CVE-2022-47175/): WordPress Royal Elementor Addons Plugin <= 1.3.75 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47174](https://insights.sbomify.com/CVE-2022-47174/): WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47173](https://insights.sbomify.com/CVE-2022-47173/): Cross-site scripting in Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration (medium 5.9)
- [CVE-2022-47172](https://insights.sbomify.com/CVE-2022-47172/): WordPress WooLentor Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47171](https://insights.sbomify.com/CVE-2022-47171/): WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47170](https://insights.sbomify.com/CVE-2022-47170/): Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (medium 5.9)
- [CVE-2022-4717](https://insights.sbomify.com/CVE-2022-4717/): Strong Testimonials < 3.0.3 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47169](https://insights.sbomify.com/CVE-2022-47169/): WordPress Visibility Logic for Elementor Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47168](https://insights.sbomify.com/CVE-2022-47168/): WordPress Printful Integration for WooCommerce plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47167](https://insights.sbomify.com/CVE-2022-47167/): WordPress Crayon Syntax Highlighter Plugin <= 2.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-47166](https://insights.sbomify.com/CVE-2022-47166/): Cross-site request forgery in Void Contact Form 7 Widget For Elementor Page Builder (medium 4.3)
- [CVE-2022-47165](https://insights.sbomify.com/CVE-2022-47165/): WordPress CoSchedule Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47164](https://insights.sbomify.com/CVE-2022-47164/): WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47163](https://insights.sbomify.com/CVE-2022-47163/): WordPress WP CSV to Database Plugin <= 2.6 is vulnerable to Cross Site Request Forgery (CSRF) (low 3.1)
- [CVE-2022-47162](https://insights.sbomify.com/CVE-2022-47162/): WordPress DH – Anti AdBlocker Plugin <= 36 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47161](https://insights.sbomify.com/CVE-2022-47161/): WordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47160](https://insights.sbomify.com/CVE-2022-47160/): WordPress Wp Social Plugin <= 1.9.0 is vulnerable to Sensitive Data Exposure (medium 6.5)
- [CVE-2022-4716](https://insights.sbomify.com/CVE-2022-4716/): WP Popups < 2.1.4.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-47159](https://insights.sbomify.com/CVE-2022-47159/): WordPress Logaster Logo Generator Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47158](https://insights.sbomify.com/CVE-2022-47158/): WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47157](https://insights.sbomify.com/CVE-2022-47157/): WordPress WP Custom Fields Search Plugin <= 1.2.34 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47155](https://insights.sbomify.com/CVE-2022-47155/): WordPress Slider by Supsystic Plugin <= 1.8.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47154](https://insights.sbomify.com/CVE-2022-47154/): WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47153](https://insights.sbomify.com/CVE-2022-47153/): WordPress Jobeleon theme <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2022-47152](https://insights.sbomify.com/CVE-2022-47152/): WordPress clickfunnels Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-47151](https://insights.sbomify.com/CVE-2022-47151/): WordPress JS Help Desk plugin <= 2.7.1 - Unauth. SQL Injection Vulnerability (high 8.6)
- [CVE-2022-47150](https://insights.sbomify.com/CVE-2022-47150/): WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-4715](https://insights.sbomify.com/CVE-2022-4715/): Structured Content < 1.5.1 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-47149](https://insights.sbomify.com/CVE-2022-47149/): WordPress Shortlinks by Pretty Links Plugin <= 3.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47148](https://insights.sbomify.com/CVE-2022-47148/): WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47147](https://insights.sbomify.com/CVE-2022-47147/): WordPress ipBlockList Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-47146](https://insights.sbomify.com/CVE-2022-47146/): WordPress Real Estate 7 Theme <= 3.3.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-47145](https://insights.sbomify.com/CVE-2022-47145/): WordPress Blockonomics Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-47144](https://insights.sbomify.com/CVE-2022-47144/): WordPress Mediamatic – Media Library Folders Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47143](https://insights.sbomify.com/CVE-2022-47143/): WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47142](https://insights.sbomify.com/CVE-2022-47142/): WordPress Mediamatic – Media Library Folders Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/202/