# Vulnerabilities published in 2022


- [CVE-2022-46545](https://insights.sbomify.com/CVE-2022-46545/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46544](https://insights.sbomify.com/CVE-2022-46544/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46543](https://insights.sbomify.com/CVE-2022-46543/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46542](https://insights.sbomify.com/CVE-2022-46542/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46541](https://insights.sbomify.com/CVE-2022-46541/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46540](https://insights.sbomify.com/CVE-2022-46540/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-4654](https://insights.sbomify.com/CVE-2022-4654/): Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.3 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46539](https://insights.sbomify.com/CVE-2022-46539/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46538](https://insights.sbomify.com/CVE-2022-46538/): Command injection in tenda:f1203 firmware (critical 9.8)
- [CVE-2022-46537](https://insights.sbomify.com/CVE-2022-46537/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46536](https://insights.sbomify.com/CVE-2022-46536/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46535](https://insights.sbomify.com/CVE-2022-46535/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46534](https://insights.sbomify.com/CVE-2022-46534/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46533](https://insights.sbomify.com/CVE-2022-46533/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46532](https://insights.sbomify.com/CVE-2022-46532/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46531](https://insights.sbomify.com/CVE-2022-46531/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-46530](https://insights.sbomify.com/CVE-2022-46530/): Memory corruption in tenda:f1203 firmware (high 7.5)
- [CVE-2022-4653](https://insights.sbomify.com/CVE-2022-4653/): Greenshift – animation and page builder blocks < 4.8.9 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46527](https://insights.sbomify.com/CVE-2022-46527/): Memory corruption in elsys:ers 1.5 firmware (high 7.5)
- [CVE-2022-4652](https://insights.sbomify.com/CVE-2022-4652/): Video Background < 2.7.5 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-4651](https://insights.sbomify.com/CVE-2022-4651/): Justified Gallery < 1.7.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46505](https://insights.sbomify.com/CVE-2022-46505/): Weak cryptography in matrixssl:matrixssl (high 7.5)
- [CVE-2022-46503](https://insights.sbomify.com/CVE-2022-46503/): Cross-site scripting in online student enrollment system project:online student enrollment system (medium 5.4)
- [CVE-2022-46502](https://insights.sbomify.com/CVE-2022-46502/): SQL injection in online student enrollment system project:online student enrollment system (critical 9.8)
- [CVE-2022-46501](https://insights.sbomify.com/CVE-2022-46501/): SQL injection in accruent:maintenance connection (critical 9.8)
- [CVE-2022-4650](https://insights.sbomify.com/CVE-2022-4650/): HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46499](https://insights.sbomify.com/CVE-2022-46499/): SQL injection in phpgurukul:hospital management system (high 8.8)
- [CVE-2022-46498](https://insights.sbomify.com/CVE-2022-46498/): SQL injection in phpgurukul:hospital management system (low 2.7)
- [CVE-2022-46497](https://insights.sbomify.com/CVE-2022-46497/): SQL injection in phpgurukul:hospital management system (high 8.1)
- [CVE-2022-46496](https://insights.sbomify.com/CVE-2022-46496/): Weak cryptography in bticino:door entry for hometouch (medium 5.9)
- [CVE-2022-46493](https://insights.sbomify.com/CVE-2022-46493/): File upload in nbnbk project:nbnbk (critical 9.8)
- [CVE-2022-46492](https://insights.sbomify.com/CVE-2022-46492/): Path traversal in nbnbk project:nbnbk (medium 6.5)
- [CVE-2022-46491](https://insights.sbomify.com/CVE-2022-46491/): Cross-site request forgery in nbnbk project:nbnbk (medium 6.5)
- [CVE-2022-46490](https://insights.sbomify.com/CVE-2022-46490/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2022-4649](https://insights.sbomify.com/CVE-2022-4649/): WP Extended Search < 2.1.2 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-46489](https://insights.sbomify.com/CVE-2022-46489/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2022-46487](https://insights.sbomify.com/CVE-2022-46487/): Other in scontain:scone (high 7.8)
- [CVE-2022-46486](https://insights.sbomify.com/CVE-2022-46486/): Information disclosure in scontain:scone (medium 5.5)
- [CVE-2022-46485](https://insights.sbomify.com/CVE-2022-46485/): Denial of service in ngsurvey:ngsurvey (high 7.5)
- [CVE-2022-46484](https://insights.sbomify.com/CVE-2022-46484/): Information disclosure in ngsurvey:ngsurvey (high 7.5)
- [CVE-2022-46480](https://insights.sbomify.com/CVE-2022-46480/): Auth bypass in u-tec:ultraloq ul3 bt firmware (high 8.1)
- [CVE-2022-4648](https://insights.sbomify.com/CVE-2022-4648/): Real Testimonials < 2.6.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-46478](https://insights.sbomify.com/CVE-2022-46478/): Deserialization in datax-web project:datax-web (critical 9.8)
- [CVE-2022-46476](https://insights.sbomify.com/CVE-2022-46476/): Command injection in dlink:dir-859 a1 firmware (critical 9.8)
- [CVE-2022-46475](https://insights.sbomify.com/CVE-2022-46475/): Memory corruption in dlink:dir-645 firmware (critical 9.8)
- [CVE-2022-46472](https://insights.sbomify.com/CVE-2022-46472/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46471](https://insights.sbomify.com/CVE-2022-46471/): SQL injection in online health care system project:online health care system (critical 9.8)
- [CVE-2022-4647](https://insights.sbomify.com/CVE-2022-4647/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 5.1)
- [CVE-2022-46463](https://insights.sbomify.com/CVE-2022-46463/): Missing authorization in linuxfoundation:harbor (high 7.5)
- [CVE-2022-4646](https://insights.sbomify.com/CVE-2022-4646/): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb (medium 5.3)
- [CVE-2022-46457](https://insights.sbomify.com/CVE-2022-46457/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2022-46456](https://insights.sbomify.com/CVE-2022-46456/): Memory corruption in nasm:netwide assembler (high 7.8)
- [CVE-2022-4645](https://insights.sbomify.com/CVE-2022-4645/): Memory corruption in libtiff (medium 6.8)
- [CVE-2022-46449](https://insights.sbomify.com/CVE-2022-46449/): Memory corruption in musicpd:music player daemon (high 7.5)
- [CVE-2022-46443](https://insights.sbomify.com/CVE-2022-46443/): SQL injection in bangresto project:bangresto (high 8.8)
- [CVE-2022-46442](https://insights.sbomify.com/CVE-2022-46442/): SQL injection in dedecms:dedecms (critical 9.8)
- [CVE-2022-46440](https://insights.sbomify.com/CVE-2022-46440/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2022-4644](https://insights.sbomify.com/CVE-2022-4644/): Open Redirect in ikus060/rdiffweb (medium 5.9)
- [CVE-2022-46438](https://insights.sbomify.com/CVE-2022-46438/): Cross-site scripting in douco:douphp (medium 5.4)
- [CVE-2022-46435](https://insights.sbomify.com/CVE-2022-46435/): File upload in tp-link:tl-wr941nd v2 firmware (high 8.8)
- [CVE-2022-46434](https://insights.sbomify.com/CVE-2022-46434/): File upload in tp-link:tl-wa7510n v1 firmware (high 7.5)
- [CVE-2022-46432](https://insights.sbomify.com/CVE-2022-46432/): Security feature bypass in tp-link:tl-wr743nd v1 firmware (high 7.5)
- [CVE-2022-46430](https://insights.sbomify.com/CVE-2022-46430/): File upload in tp-link:tl-wr740n v1 firmware (medium 4.8)
- [CVE-2022-4643](https://insights.sbomify.com/CVE-2022-4643/): docconv pdf_ocr.go ConvertPDFImages os command injection (medium 6.3)
- [CVE-2022-46428](https://insights.sbomify.com/CVE-2022-46428/): File upload in tp-link:tl-wr1043nd v1 firmware (medium 4.8)
- [CVE-2022-46424](https://insights.sbomify.com/CVE-2022-46424/): Security feature bypass in netgear:xwn5001 firmware (high 8.1)
- [CVE-2022-46423](https://insights.sbomify.com/CVE-2022-46423/): Security feature bypass in netgear:wnr2000 firmware (high 8.1)
- [CVE-2022-46422](https://insights.sbomify.com/CVE-2022-46422/): Denial of service in netgear:wnr2000 firmware (medium 4.8)
- [CVE-2022-46421](https://insights.sbomify.com/CVE-2022-46421/): Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params (critical 9.8)
- [CVE-2022-4642](https://insights.sbomify.com/CVE-2022-4642/): tatoeba2 Profile Name cross site scripting (low 3.5)
- [CVE-2022-46416](https://insights.sbomify.com/CVE-2022-46416/): Denial of service in parrot:bebop firmware (critical 9.1)
- [CVE-2022-46415](https://insights.sbomify.com/CVE-2022-46415/): Denial of service in dji:spark firmware (critical 9.1)
- [CVE-2022-46414](https://insights.sbomify.com/CVE-2022-46414/): Auth bypass in veritas:access appliance (critical 9.8)
- [CVE-2022-46413](https://insights.sbomify.com/CVE-2022-46413/): Command injection in veritas:access appliance (high 8.8)
- [CVE-2022-46412](https://insights.sbomify.com/CVE-2022-46412/): Privilege escalation in veritas:netbackup flex scale appliance (high 8.8)
- [CVE-2022-46411](https://insights.sbomify.com/CVE-2022-46411/): Hardcoded credentials in veritas:access appliance (high 8.8)
- [CVE-2022-46410](https://insights.sbomify.com/CVE-2022-46410/): Privilege escalation in veritas:netbackup flex scale appliance (high 8.8)
- [CVE-2022-4641](https://insights.sbomify.com/CVE-2022-4641/): pig-vector LogisticRegression.java LogisticRegression temp file (low 2.5)
- [CVE-2022-46408](https://insights.sbomify.com/CVE-2022-46408/): Code injection in ericsson:network manager (medium 6.8)
- [CVE-2022-46407](https://insights.sbomify.com/CVE-2022-46407/): Open redirect in ericsson:network manager (medium 4.8)
- [CVE-2022-46405](https://insights.sbomify.com/CVE-2022-46405/): Denial of service in joinmastodon:mastodon (high 7.5)
- [CVE-2022-46404](https://insights.sbomify.com/CVE-2022-46404/): Command injection in atos:unify openscape 4000 assistant (critical 9.8)
- [CVE-2022-46403](https://insights.sbomify.com/CVE-2022-46403/): Other in microchip:bm70 firmware (high 8.6)
- [CVE-2022-46402](https://insights.sbomify.com/CVE-2022-46402/): Security feature bypass in microchip:bm70 firmware (medium 6.5)
- [CVE-2022-46401](https://insights.sbomify.com/CVE-2022-46401/): Security feature bypass in microchip:bm64 firmware (medium 5.4)
- [CVE-2022-46400](https://insights.sbomify.com/CVE-2022-46400/): Auth bypass in microchip:bm70 firmware (medium 5.4)
- [CVE-2022-4640](https://insights.sbomify.com/CVE-2022-4640/): Mingsoft MCMS Article save cross site scripting (low 3.5)
- [CVE-2022-46399](https://insights.sbomify.com/CVE-2022-46399/): Denial of service in microchip:bm64 firmware (high 7.5)
- [CVE-2022-46397](https://insights.sbomify.com/CVE-2022-46397/): Weak cryptography in lfprojects:vector packet processor (high 7.5)
- [CVE-2022-46396](https://insights.sbomify.com/CVE-2022-46396/): Memory corruption in arm:avalon gpu kernel driver (medium 4.4)
- [CVE-2022-46395](https://insights.sbomify.com/CVE-2022-46395/): Use after free in arm:avalon gpu kernel driver (high 8.8)
- [CVE-2022-46394](https://insights.sbomify.com/CVE-2022-46394/): Use after free in arm:avalon gpu kernel driver (high 8.8)
- [CVE-2022-46393](https://insights.sbomify.com/CVE-2022-46393/): Memory corruption in arm:mbed tls (critical 9.8)
- [CVE-2022-46392](https://insights.sbomify.com/CVE-2022-46392/): Information disclosure in arm:mbed tls (medium 5.3)
- [CVE-2022-46391](https://insights.sbomify.com/CVE-2022-46391/): Cross-site scripting in awstats:awstats (medium 6.1)
- [CVE-2022-4639](https://insights.sbomify.com/CVE-2022-4639/): sslh Packet Dumping probe.c hexdump format string (medium 5.6)
- [CVE-2022-46389](https://insights.sbomify.com/CVE-2022-46389/): Cross-Site Scripting (XSS) vulnerability found on logout functionality (medium 6.1)
- [CVE-2022-46387](https://insights.sbomify.com/CVE-2022-46387/): Command injection in cmder:cmder (critical 9.8)
- [CVE-2022-46383](https://insights.sbomify.com/CVE-2022-46383/): Information disclosure in rackn:digital rebar (critical 9.8)
- [CVE-2022-46382](https://insights.sbomify.com/CVE-2022-46382/): Auth bypass in rackn:digital rebar (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/207/