# Vulnerabilities published in 2022


- [CVE-2022-46959](https://insights.sbomify.com/CVE-2022-46959/): Path Traversal in github.com/go-sonic/sonic (medium 4.3)
- [CVE-2022-46957](https://insights.sbomify.com/CVE-2022-46957/): Cross-site scripting in online graduate tracer system project:online graduate tracer system (medium 6.1)
- [CVE-2022-46956](https://insights.sbomify.com/CVE-2022-46956/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2022-46955](https://insights.sbomify.com/CVE-2022-46955/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (critical 9.8)
- [CVE-2022-46954](https://insights.sbomify.com/CVE-2022-46954/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (critical 9.8)
- [CVE-2022-46953](https://insights.sbomify.com/CVE-2022-46953/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2022-46952](https://insights.sbomify.com/CVE-2022-46952/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2022-46951](https://insights.sbomify.com/CVE-2022-46951/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2022-46950](https://insights.sbomify.com/CVE-2022-46950/): SQL injection in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2022-4695](https://insights.sbomify.com/CVE-2022-4695/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.6)
- [CVE-2022-46949](https://insights.sbomify.com/CVE-2022-46949/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46947](https://insights.sbomify.com/CVE-2022-46947/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46946](https://insights.sbomify.com/CVE-2022-46946/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46945](https://insights.sbomify.com/CVE-2022-46945/): Path traversal in nagvis:nagvis (critical 9.1)
- [CVE-2022-4694](https://insights.sbomify.com/CVE-2022-4694/): Cross-site Scripting (XSS) - Stored in usememos/memos (medium 5.7)
- [CVE-2022-46934](https://insights.sbomify.com/CVE-2022-46934/): Cross-site scripting in keking:kkfileview (medium 6.1)
- [CVE-2022-4693](https://insights.sbomify.com/CVE-2022-4693/): User Verification < 1.0.94 - Authentication Bypass (critical 9.8)
- [CVE-2022-4692](https://insights.sbomify.com/CVE-2022-4692/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.1)
- [CVE-2022-46914](https://insights.sbomify.com/CVE-2022-46914/): File upload in tp-link:tl-wa801n firmware (high 8.8)
- [CVE-2022-46912](https://insights.sbomify.com/CVE-2022-46912/): File upload in tp-link:tl-wr841n firmware (high 8.8)
- [CVE-2022-46910](https://insights.sbomify.com/CVE-2022-46910/): File upload in tp-link:tl-wa901n firmware (high 8.8)
- [CVE-2022-4691](https://insights.sbomify.com/CVE-2022-4691/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 8.3)
- [CVE-2022-46908](https://insights.sbomify.com/CVE-2022-46908/): Security feature bypass in sqlite:sqlite (high 7.3)
- [CVE-2022-46907](https://insights.sbomify.com/CVE-2022-46907/): Apache JSPWiki: XSS Injection points in several plugins (medium 6.1)
- [CVE-2022-46906](https://insights.sbomify.com/CVE-2022-46906/): Cross-site scripting in websoft:websoft hcm (medium 5.4)
- [CVE-2022-46905](https://insights.sbomify.com/CVE-2022-46905/): Cross-site scripting in websoft:websoft hcm (medium 6.1)
- [CVE-2022-46904](https://insights.sbomify.com/CVE-2022-46904/): Cross-site scripting in websoft:websoft hcm (medium 5.4)
- [CVE-2022-46903](https://insights.sbomify.com/CVE-2022-46903/): Cross-site scripting in websoft:websoft hcm (medium 5.4)
- [CVE-2022-46902](https://insights.sbomify.com/CVE-2022-46902/): Path traversal in vocera:report server (medium 6.3)
- [CVE-2022-46901](https://insights.sbomify.com/CVE-2022-46901/): Missing authorization in vocera:report server (high 7.5)
- [CVE-2022-46900](https://insights.sbomify.com/CVE-2022-46900/): Path traversal in vocera:report server (medium 6.5)
- [CVE-2022-4690](https://insights.sbomify.com/CVE-2022-4690/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.1)
- [CVE-2022-46899](https://insights.sbomify.com/CVE-2022-46899/): File upload in vocera:report server (high 7.5)
- [CVE-2022-46898](https://insights.sbomify.com/CVE-2022-46898/): Path traversal in vocera:report server (critical 9.8)
- [CVE-2022-46897](https://insights.sbomify.com/CVE-2022-46897/): Other in insyde:kernel (medium 5.3)
- [CVE-2022-46892](https://insights.sbomify.com/CVE-2022-46892/): Missing authorization in amperecomputing:ampere altra firmware (critical 9.8)
- [CVE-2022-46891](https://insights.sbomify.com/CVE-2022-46891/): Use after free in arm:bifrost gpu kernel driver (high 8.8)
- [CVE-2022-46890](https://insights.sbomify.com/CVE-2022-46890/): Missing authorization in nexusphp:nexusphp (medium 4.3)
- [CVE-2022-4689](https://insights.sbomify.com/CVE-2022-4689/): Improper Access Control in usememos/memos (high 8.3)
- [CVE-2022-46889](https://insights.sbomify.com/CVE-2022-46889/): Cross-site scripting in nexusphp:nexusphp (medium 5.4)
- [CVE-2022-46888](https://insights.sbomify.com/CVE-2022-46888/): Cross-site scripting in nexusphp:nexusphp (medium 6.1)
- [CVE-2022-46887](https://insights.sbomify.com/CVE-2022-46887/): SQL injection in nexusphp:nexusphp (critical 9.8)
- [CVE-2022-46886](https://insights.sbomify.com/CVE-2022-46886/): Open redirect in ServiceNow (medium 5.5)
- [CVE-2022-46885](https://insights.sbomify.com/CVE-2022-46885/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-46884](https://insights.sbomify.com/CVE-2022-46884/): Use after free in Firefox (high 8.8)
- [CVE-2022-46883](https://insights.sbomify.com/CVE-2022-46883/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-46882](https://insights.sbomify.com/CVE-2022-46882/): Use after free in Firefox (critical 9.8)
- [CVE-2022-46881](https://insights.sbomify.com/CVE-2022-46881/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-46880](https://insights.sbomify.com/CVE-2022-46880/): Use after free in Firefox (medium 6.5)
- [CVE-2022-4688](https://insights.sbomify.com/CVE-2022-4688/): Improper Authorization in usememos/memos (high 8.8)
- [CVE-2022-46879](https://insights.sbomify.com/CVE-2022-46879/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-46878](https://insights.sbomify.com/CVE-2022-46878/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-46877](https://insights.sbomify.com/CVE-2022-46877/): Other in Firefox (medium 4.3)
- [CVE-2022-46875](https://insights.sbomify.com/CVE-2022-46875/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-46874](https://insights.sbomify.com/CVE-2022-46874/): Code injection in Firefox (high 8.8)
- [CVE-2022-46873](https://insights.sbomify.com/CVE-2022-46873/): Security feature bypass in Firefox (high 8.8)
- [CVE-2022-46872](https://insights.sbomify.com/CVE-2022-46872/): Security feature bypass in Firefox (high 8.6)
- [CVE-2022-46871](https://insights.sbomify.com/CVE-2022-46871/): Supply chain in Firefox (high 8.8)
- [CVE-2022-46870](https://insights.sbomify.com/CVE-2022-46870/): Apache Zeppelin: Stored XSS in note permissions (medium 5.4)
- [CVE-2022-4687](https://insights.sbomify.com/CVE-2022-4687/): Incorrect Use of Privileged APIs in usememos/memos (high 8.1)
- [CVE-2022-46869](https://insights.sbomify.com/CVE-2022-46869/): Privilege escalation in Acronis Cyber Protect Home Office (high 7.3)
- [CVE-2022-46868](https://insights.sbomify.com/CVE-2022-46868/): Privilege escalation in Acronis Cyber Protect Home Office (medium 6.7)
- [CVE-2022-46867](https://insights.sbomify.com/CVE-2022-46867/): WordPress Universal Star Rating Plugin <= 2.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46866](https://insights.sbomify.com/CVE-2022-46866/): WordPress Import External Images Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46865](https://insights.sbomify.com/CVE-2022-46865/): WordPress Bulk Resize Media Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46864](https://insights.sbomify.com/CVE-2022-46864/): Cross-site scripting in Woocommerce Custom Checkout Fields Editor With Drag & Drop (high 7.1)
- [CVE-2022-46863](https://insights.sbomify.com/CVE-2022-46863/): WordPress Quick Event Manager Plugin <= 9.6.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-46862](https://insights.sbomify.com/CVE-2022-46862/): WordPress Quiz And Survey Master Plugin <= 8.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46861](https://insights.sbomify.com/CVE-2022-46861/): WordPress Login Page Styler Plugin <= 6.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-46860](https://insights.sbomify.com/CVE-2022-46860/): WordPress Short URL Plugin <= 1.6.4 is vulnerable to SQL Injection (high 8.5)
- [CVE-2022-4686](https://insights.sbomify.com/CVE-2022-4686/): Authorization Bypass Through User-Controlled Key in usememos/memos (high 8.6)
- [CVE-2022-46859](https://insights.sbomify.com/CVE-2022-46859/): WordPress Spiffy Calendar Plugin <= 4.9.1 is vulnerable to SQL Injection (high 8.5)
- [CVE-2022-46858](https://insights.sbomify.com/CVE-2022-46858/): WordPress Product Specifications for Woocommerce Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-46857](https://insights.sbomify.com/CVE-2022-46857/): WordPress SiteAlert (Formerly WP Health) Plugin <= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46856](https://insights.sbomify.com/CVE-2022-46856/): WordPress Woocommerce Product Designer Plugin <= 4.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46855](https://insights.sbomify.com/CVE-2022-46855/): WordPress Responsive Pricing Table Plugin <= 5.1.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-46854](https://insights.sbomify.com/CVE-2022-46854/): Cross-site request forgery in Launchpad – Coming Soon & Maintenance Mode Plugin (medium 5.4)
- [CVE-2022-46853](https://insights.sbomify.com/CVE-2022-46853/): WordPress The Post Grid Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46852](https://insights.sbomify.com/CVE-2022-46852/): WordPress WP Table Builder – WordPress Table Plugin Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-46851](https://insights.sbomify.com/CVE-2022-46851/): WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46850](https://insights.sbomify.com/CVE-2022-46850/): WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion (high 8.7)
- [CVE-2022-46849](https://insights.sbomify.com/CVE-2022-46849/): WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL Injection (high 7.6)
- [CVE-2022-46848](https://insights.sbomify.com/CVE-2022-46848/): WordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-46846](https://insights.sbomify.com/CVE-2022-46846/): WordPress Trending/Popular Post Slider and Widget plugin <= 1.5.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2022-46845](https://insights.sbomify.com/CVE-2022-46845/): WordPress Slider a SlidersPack plugin <= 2.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2022-46844](https://insights.sbomify.com/CVE-2022-46844/): WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-46843](https://insights.sbomify.com/CVE-2022-46843/): WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-46842](https://insights.sbomify.com/CVE-2022-46842/): WordPress JS Help Desk plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46841](https://insights.sbomify.com/CVE-2022-46841/): WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46840](https://insights.sbomify.com/CVE-2022-46840/): WordPress JS Help Desk plugin <= 2.7.1 - Broken Access Control (medium 5.4)
- [CVE-2022-4684](https://insights.sbomify.com/CVE-2022-4684/): Improper Access Control in usememos/memos (high 7.6)
- [CVE-2022-46839](https://insights.sbomify.com/CVE-2022-46839/): WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2022-46838](https://insights.sbomify.com/CVE-2022-46838/): WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability (critical 9.1)
- [CVE-2022-46836](https://insights.sbomify.com/CVE-2022-46836/): PHP code injection in watolib (critical 9.1)
- [CVE-2022-46835](https://insights.sbomify.com/CVE-2022-46835/): SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability (high 8.8)
- [CVE-2022-46834](https://insights.sbomify.com/CVE-2022-46834/): Weak cryptography in SICK RFU65x Firmware (medium 6.5)
- [CVE-2022-46833](https://insights.sbomify.com/CVE-2022-46833/): Weak cryptography in SICK RFU63x Firmware (medium 6.5)
- [CVE-2022-46832](https://insights.sbomify.com/CVE-2022-46832/): Weak cryptography in SICK RFU62x Firmware (medium 6.5)
- [CVE-2022-46831](https://insights.sbomify.com/CVE-2022-46831/): Privilege escalation in TeamCity (medium 6.6)
- [CVE-2022-46830](https://insights.sbomify.com/CVE-2022-46830/): Server-side request forgery in TeamCity (medium 4.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/204/