# Vulnerabilities published in 2022


- [CVE-2022-4683](https://insights.sbomify.com/CVE-2022-4683/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos (medium 4.3)
- [CVE-2022-46829](https://insights.sbomify.com/CVE-2022-46829/): Auth bypass in JetBrains Gateway (high 7.1)
- [CVE-2022-46828](https://insights.sbomify.com/CVE-2022-46828/): Code injection in IntelliJ IDEA (medium 5.2)
- [CVE-2022-46827](https://insights.sbomify.com/CVE-2022-46827/): XML external entity in IntelliJ IDEA (low 3.9)
- [CVE-2022-46826](https://insights.sbomify.com/CVE-2022-46826/): Path traversal in IntelliJ IDEA (medium 6.2)
- [CVE-2022-46825](https://insights.sbomify.com/CVE-2022-46825/): Information disclosure in IntelliJ IDEA (medium 4.0)
- [CVE-2022-46824](https://insights.sbomify.com/CVE-2022-46824/): Memory corruption in IntelliJ IDEA (medium 5.6)
- [CVE-2022-46823](https://insights.sbomify.com/CVE-2022-46823/): Cross-site scripting in Mendix SAML (Mendix 8 compatible) (critical 9.3)
- [CVE-2022-46822](https://insights.sbomify.com/CVE-2022-46822/): WordPress WooCommerce JazzCash Gateway Plugin Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-46821](https://insights.sbomify.com/CVE-2022-46821/): WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection (medium 5.8)
- [CVE-2022-46820](https://insights.sbomify.com/CVE-2022-46820/): WordPress Joli Table Of Contents Plugin <= 1.3.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-4682](https://insights.sbomify.com/CVE-2022-4682/): Lightbox Gallery < 0.9.5 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2022-46819](https://insights.sbomify.com/CVE-2022-46819/): WordPress Continuous announcement scroller Plugin <= 13.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-46818](https://insights.sbomify.com/CVE-2022-46818/): WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection (high 8.2)
- [CVE-2022-46817](https://insights.sbomify.com/CVE-2022-46817/): WordPress Flyzoo Chat Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-46816](https://insights.sbomify.com/CVE-2022-46816/): WordPress Booking Ultra Pro Plugin <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46815](https://insights.sbomify.com/CVE-2022-46815/): WordPress Conditional Shipping for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46814](https://insights.sbomify.com/CVE-2022-46814/): WordPress Kodex Posts likes Plugin <= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46813](https://insights.sbomify.com/CVE-2022-46813/): WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46812](https://insights.sbomify.com/CVE-2022-46812/): Cross-site request forgery in Thank You Page Customizer for WooCommerce – Increase Your Sales (medium 4.3)
- [CVE-2022-46811](https://insights.sbomify.com/CVE-2022-46811/): Missing authorization in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce (medium 4.3)
- [CVE-2022-46810](https://insights.sbomify.com/CVE-2022-46810/): Cross-site request forgery in Thank You Page Customizer for WooCommerce – Increase Your Sales (medium 4.3)
- [CVE-2022-4681](https://insights.sbomify.com/CVE-2022-4681/): Hide My WP < 6.2.9 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-46809](https://insights.sbomify.com/CVE-2022-46809/): WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-46808](https://insights.sbomify.com/CVE-2022-46808/): WordPress ARMember Plugin <= 3.4.11 is vulnerable to SQL Injection (high 8.2)
- [CVE-2022-46807](https://insights.sbomify.com/CVE-2022-46807/): WordPress Stock Sync for WooCommerce plugin <= 2.3.2 - Broken Access Control (medium 4.3)
- [CVE-2022-46806](https://insights.sbomify.com/CVE-2022-46806/): WordPress Cart All In One For WooCommerce Plugin <= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46805](https://insights.sbomify.com/CVE-2022-46805/): WordPress Conditional Payments for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46804](https://insights.sbomify.com/CVE-2022-46804/): WordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection (medium 5.8)
- [CVE-2022-46803](https://insights.sbomify.com/CVE-2022-46803/): WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-46802](https://insights.sbomify.com/CVE-2022-46802/): WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-46801](https://insights.sbomify.com/CVE-2022-46801/): WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-46800](https://insights.sbomify.com/CVE-2022-46800/): WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-4680](https://insights.sbomify.com/CVE-2022-4680/): Revive Old Posts – Social Media Auto Post and Scheduling Plugin < 9.0.11 - PHP Object Injection (high 7.2)
- [CVE-2022-46799](https://insights.sbomify.com/CVE-2022-46799/): WordPress Easy Testimonial Slider and Form Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-46798](https://insights.sbomify.com/CVE-2022-46798/): WordPress WooLentor Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46797](https://insights.sbomify.com/CVE-2022-46797/): WordPress Conversios.io Plugin <= 5.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46796](https://insights.sbomify.com/CVE-2022-46796/): WordPress CURCY plugin <= 2.1.25 - Unauthenticated plugin settings change vulnerability (medium 6.5)
- [CVE-2022-46795](https://insights.sbomify.com/CVE-2022-46795/): WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerability (medium 6.5)
- [CVE-2022-46794](https://insights.sbomify.com/CVE-2022-46794/): WordPress WooCommerce Weight Based Shipping Plugin <= 5.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-46793](https://insights.sbomify.com/CVE-2022-46793/): WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-46792](https://insights.sbomify.com/CVE-2022-46792/): Missing authorization in hasura:graphql engine (high 8.8)
- [CVE-2022-4679](https://insights.sbomify.com/CVE-2022-4679/): Wufoo Shortcode < 1.52 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46786](https://insights.sbomify.com/CVE-2022-46786/): Cross-site scripting in squaredup:dashboard server (medium 5.4)
- [CVE-2022-46785](https://insights.sbomify.com/CVE-2022-46785/): Cross-site scripting in squaredup:dashboard server (medium 6.1)
- [CVE-2022-46784](https://insights.sbomify.com/CVE-2022-46784/): Open redirect in squaredup:dashboard server (medium 6.1)
- [CVE-2022-46783](https://insights.sbomify.com/CVE-2022-46783/): Weak cryptography in stormshield:ssl vpn client (medium 5.3)
- [CVE-2022-46782](https://insights.sbomify.com/CVE-2022-46782/): Privilege escalation in stormshield:ssl vpn client (high 7.8)
- [CVE-2022-46781](https://insights.sbomify.com/CVE-2022-46781/): Memory corruption in arm:avalon gpu kernel driver (low 3.3)
- [CVE-2022-4678](https://insights.sbomify.com/CVE-2022-4678/): TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46774](https://insights.sbomify.com/CVE-2022-46774/): IBM Manage Application security bypass (medium 5.4)
- [CVE-2022-46773](https://insights.sbomify.com/CVE-2022-46773/): IBM Robotic Process Automation security bypass (medium 4.3)
- [CVE-2022-46771](https://insights.sbomify.com/CVE-2022-46771/): IBM UrbanCode Deploy (UCD) cross-site scripting (medium 4.6)
- [CVE-2022-46770](https://insights.sbomify.com/CVE-2022-46770/): Denial of service in linuxfoundation:mirage firewall (high 7.5)
- [CVE-2022-4677](https://insights.sbomify.com/CVE-2022-4677/): Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.12.7 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46769](https://insights.sbomify.com/CVE-2022-46769/): Apache Sling App CMS: XSS in CMS Site Group Detail (medium 5.4)
- [CVE-2022-46768](https://insights.sbomify.com/CVE-2022-46768/): File name information disclosure vulnerability in Zabbix Web Service Report Generation (medium 5.9)
- [CVE-2022-46764](https://insights.sbomify.com/CVE-2022-46764/): SQL injection in TrueConf Server (critical 9.8)
- [CVE-2022-46763](https://insights.sbomify.com/CVE-2022-46763/): SQL injection in TrueConf Server (high 8.8)
- [CVE-2022-46762](https://insights.sbomify.com/CVE-2022-46762/): Security feature bypass in EMUI (high 7.5)
- [CVE-2022-46761](https://insights.sbomify.com/CVE-2022-46761/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-4676](https://insights.sbomify.com/CVE-2022-4676/): OSM – OpenStreetMap <= 6.01 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46756](https://insights.sbomify.com/CVE-2022-46756/): Privilege escalation in VxRail HCI (high 8.2)
- [CVE-2022-46755](https://insights.sbomify.com/CVE-2022-46755/): Missing authorization in Wyse Management Suite (medium 4.9)
- [CVE-2022-46754](https://insights.sbomify.com/CVE-2022-46754/): Missing authorization in Wyse Management Suite (high 8.7)
- [CVE-2022-46752](https://insights.sbomify.com/CVE-2022-46752/): Missing authorization in CPG BIOS (medium 4.6)
- [CVE-2022-46751](https://insights.sbomify.com/CVE-2022-46751/): Apache Ivy: XML External Entity vulnerability in Apache Ivy (high 8.2)
- [CVE-2022-4675](https://insights.sbomify.com/CVE-2022-4675/): Mongoose Page Plugin < 1.9.0 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46742](https://insights.sbomify.com/CVE-2022-46742/): PaddlePaddle vulnerable to Code Injection (critical 10.0)
- [CVE-2022-46741](https://insights.sbomify.com/CVE-2022-46741/): PaddlePaddle Out-of-bounds Read vulnerability (high 7.1)
- [CVE-2022-46740](https://insights.sbomify.com/CVE-2022-46740/): Denial of service in WS7100-20 (medium 6.5)
- [CVE-2022-4674](https://insights.sbomify.com/CVE-2022-4674/): Ibtana – WordPress Website Builder < 1.1.8.8 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46738](https://insights.sbomify.com/CVE-2022-46738/): CVE-2022-46738 (high 7.2)
- [CVE-2022-46733](https://insights.sbomify.com/CVE-2022-46733/): CVE-2022-46733 (medium 6.3)
- [CVE-2022-46732](https://insights.sbomify.com/CVE-2022-46732/): CVE-2022-46732 (critical 9.8)
- [CVE-2022-4673](https://insights.sbomify.com/CVE-2022-4673/): Rate my Post – WP Rating System < 3.3.9 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46725](https://insights.sbomify.com/CVE-2022-46725/): Other in iOS and iPadOS (medium 4.3)
- [CVE-2022-46724](https://insights.sbomify.com/CVE-2022-46724/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2022-46723](https://insights.sbomify.com/CVE-2022-46723/): Memory corruption in macOS (critical 9.8)
- [CVE-2022-46722](https://insights.sbomify.com/CVE-2022-46722/): Business logic in macOS (medium 5.5)
- [CVE-2022-46721](https://insights.sbomify.com/CVE-2022-46721/): Memory corruption in macOS (high 7.8)
- [CVE-2022-46720](https://insights.sbomify.com/CVE-2022-46720/): Integer overflow in macOS (high 8.6)
- [CVE-2022-4672](https://insights.sbomify.com/CVE-2022-4672/): WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46718](https://insights.sbomify.com/CVE-2022-46718/): Security feature bypass in macOS (medium 5.5)
- [CVE-2022-46717](https://insights.sbomify.com/CVE-2022-46717/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2022-46716](https://insights.sbomify.com/CVE-2022-46716/): Business logic in macOS (high 7.5)
- [CVE-2022-46715](https://insights.sbomify.com/CVE-2022-46715/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2022-46713](https://insights.sbomify.com/CVE-2022-46713/): Race condition in macOS (medium 4.7)
- [CVE-2022-46712](https://insights.sbomify.com/CVE-2022-46712/): Use after free in macOS (high 7.8)
- [CVE-2022-46710](https://insights.sbomify.com/CVE-2022-46710/): Business logic in iOS and iPadOS (medium 5.5)
- [CVE-2022-4671](https://insights.sbomify.com/CVE-2022-4671/): PixCodes < 2.3.7 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-46709](https://insights.sbomify.com/CVE-2022-46709/): Memory corruption in macOS (critical 9.8)
- [CVE-2022-46706](https://insights.sbomify.com/CVE-2022-46706/): Memory corruption in Security Update - Catalina (high 7.8)
- [CVE-2022-46705](https://insights.sbomify.com/CVE-2022-46705/): Other in macOS (medium 4.3)
- [CVE-2022-46704](https://insights.sbomify.com/CVE-2022-46704/): Business logic in macOS (medium 5.5)
- [CVE-2022-46703](https://insights.sbomify.com/CVE-2022-46703/): Business logic in macOS (medium 5.5)
- [CVE-2022-46702](https://insights.sbomify.com/CVE-2022-46702/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2022-46701](https://insights.sbomify.com/CVE-2022-46701/): Memory corruption in tvOS (high 7.8)
- [CVE-2022-46700](https://insights.sbomify.com/CVE-2022-46700/): Memory corruption in tvOS (high 8.8)
- [CVE-2022-4670](https://insights.sbomify.com/CVE-2022-4670/): PDF.js Viewer < 2.1.8 - Contributor+ Stored XSS via Shortcode (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/205/