# Vulnerabilities published in 2022


- [CVE-2022-46381](https://insights.sbomify.com/CVE-2022-46381/): Cross-site scripting in niceforyou:linear emerge e3 access control firmware (medium 6.1)
- [CVE-2022-4638](https://insights.sbomify.com/CVE-2022-4638/): collective.contact.widget widgets.py title cross site scripting (low 3.5)
- [CVE-2022-46378](https://insights.sbomify.com/CVE-2022-46378/): Memory corruption in uC-FTPs (medium 6.5)
- [CVE-2022-46377](https://insights.sbomify.com/CVE-2022-46377/): Memory corruption in uC-FTPs (medium 6.5)
- [CVE-2022-46372](https://insights.sbomify.com/CVE-2022-46372/): Alotcer - AR7088H-A Authenticated Command execution (high 7.2)
- [CVE-2022-46371](https://insights.sbomify.com/CVE-2022-46371/): Alotcer - AR7088H-A Information disclosure (medium 5.3)
- [CVE-2022-46370](https://insights.sbomify.com/CVE-2022-46370/): Rumpus - FTP server Improper Token Verification (high 7.3)
- [CVE-2022-4637](https://insights.sbomify.com/CVE-2022-4637/): ep3-bs cross site scripting (low 3.5)
- [CVE-2022-46369](https://insights.sbomify.com/CVE-2022-46369/): Rumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vector (medium 6.8)
- [CVE-2022-46368](https://insights.sbomify.com/CVE-2022-46368/): Rumpus - FTP server Cross-site request forgery (CSRF) – Create user (medium 6.8)
- [CVE-2022-46367](https://insights.sbomify.com/CVE-2022-46367/): Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation (medium 6.8)
- [CVE-2022-46366](https://insights.sbomify.com/CVE-2022-46366/): Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input (critical 9.8)
- [CVE-2022-46365](https://insights.sbomify.com/CVE-2022-46365/): Apache StreamPark (incubating): Logic error causing any account reset (critical 9.1)
- [CVE-2022-46364](https://insights.sbomify.com/CVE-2022-46364/): Apache CXF SSRF Vulnerability (critical 9.8)
- [CVE-2022-46363](https://insights.sbomify.com/CVE-2022-46363/): Apache CXF directory listing / code exfiltration (high 7.5)
- [CVE-2022-46361](https://insights.sbomify.com/CVE-2022-46361/): Physical access to the WDM enables use of USB device to gain access to the WDM (medium 6.9)
- [CVE-2022-46360](https://insights.sbomify.com/CVE-2022-46360/): Memory corruption in V-SFT and TELLUS (high 7.8)
- [CVE-2022-4636](https://insights.sbomify.com/CVE-2022-4636/): Path traversal in KVM ACR1000A-R-R2 (high 7.5)
- [CVE-2022-46359](https://insights.sbomify.com/CVE-2022-46359/): Privilege escalation in HP Security Manager (high 8.8)
- [CVE-2022-46358](https://insights.sbomify.com/CVE-2022-46358/): Privilege escalation in HP Security Manager (high 8.8)
- [CVE-2022-46357](https://insights.sbomify.com/CVE-2022-46357/): Privilege escalation in HP Security Manager (high 8.8)
- [CVE-2022-46356](https://insights.sbomify.com/CVE-2022-46356/): Privilege escalation in HP Security Manager (high 8.8)
- [CVE-2022-46355](https://insights.sbomify.com/CVE-2022-46355/): Information disclosure in SCALANCE X204RNA (HSR) (high 7.5)
- [CVE-2022-46354](https://insights.sbomify.com/CVE-2022-46354/): Misconfiguration in SCALANCE X204RNA (HSR) (medium 5.3)
- [CVE-2022-46353](https://insights.sbomify.com/CVE-2022-46353/): Weak cryptography in SCALANCE X204RNA (HSR) (critical 9.8)
- [CVE-2022-46352](https://insights.sbomify.com/CVE-2022-46352/): Denial of service in SCALANCE X204RNA (HSR) (high 7.5)
- [CVE-2022-46351](https://insights.sbomify.com/CVE-2022-46351/): Denial of service in SCALANCE X204RNA (HSR) (medium 5.5)
- [CVE-2022-46350](https://insights.sbomify.com/CVE-2022-46350/): Cross-site scripting in SCALANCE X204RNA (HSR) (medium 6.1)
- [CVE-2022-46349](https://insights.sbomify.com/CVE-2022-46349/): Memory corruption in Parasolid V33.1 (high 7.8)
- [CVE-2022-46348](https://insights.sbomify.com/CVE-2022-46348/): Memory corruption in Parasolid V33.1 (high 7.8)
- [CVE-2022-46347](https://insights.sbomify.com/CVE-2022-46347/): Memory corruption in Parasolid V33.1 (high 7.8)
- [CVE-2022-46346](https://insights.sbomify.com/CVE-2022-46346/): Memory corruption in Parasolid V33.1 (high 7.8)
- [CVE-2022-46345](https://insights.sbomify.com/CVE-2022-46345/): Memory corruption in Parasolid V33.1 (high 7.8)
- [CVE-2022-46344](https://insights.sbomify.com/CVE-2022-46344/): Memory corruption in xorg-x11-server (high 8.8)
- [CVE-2022-46343](https://insights.sbomify.com/CVE-2022-46343/): Use after free in xorg-x11-server (high 8.8)
- [CVE-2022-46342](https://insights.sbomify.com/CVE-2022-46342/): Use after free in xorg-x11-server (high 8.8)
- [CVE-2022-46341](https://insights.sbomify.com/CVE-2022-46341/): Memory corruption in xorg-x11-server (high 8.8)
- [CVE-2022-46340](https://insights.sbomify.com/CVE-2022-46340/): Memory corruption in xorg-x11-server (high 8.8)
- [CVE-2022-4634](https://insights.sbomify.com/CVE-2022-4634/): CVE-2022-4634 (high 7.8)
- [CVE-2022-46338](https://insights.sbomify.com/CVE-2022-46338/): Misconfiguration in debian:debian linux (medium 6.5)
- [CVE-2022-46337](https://insights.sbomify.com/CVE-2022-46337/): Apache Derby: LDAP injection vulnerability in authenticator (critical 9.8)
- [CVE-2022-46334](https://insights.sbomify.com/CVE-2022-46334/): Proofpoint Enterprise Protection Local Privilege Escalation (high 7.8)
- [CVE-2022-46333](https://insights.sbomify.com/CVE-2022-46333/): Proofpoint Enterprise Protection perl eval() arbitrary command execution (high 7.2)
- [CVE-2022-46332](https://insights.sbomify.com/CVE-2022-46332/): Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names" (critical 9.6)
- [CVE-2022-46331](https://insights.sbomify.com/CVE-2022-46331/): Missing authorization in Proficy Historian (high 7.5)
- [CVE-2022-46330](https://insights.sbomify.com/CVE-2022-46330/): Other in Installers generated by Squirrel.Windows (high 7.8)
- [CVE-2022-4633](https://insights.sbomify.com/CVE-2022-4633/): Auto Upload Images Settings setting-page.php cross-site request forgery (medium 4.3)
- [CVE-2022-46329](https://insights.sbomify.com/CVE-2022-46329/): Security feature bypass in Intel(R) PROSet/Wireless WiFi software (high 8.2)
- [CVE-2022-46328](https://insights.sbomify.com/CVE-2022-46328/): Other in EMUI (high 7.5)
- [CVE-2022-46327](https://insights.sbomify.com/CVE-2022-46327/): Privilege escalation in EMUI (critical 9.8)
- [CVE-2022-46326](https://insights.sbomify.com/CVE-2022-46326/): Memory corruption in EMUI (critical 9.8)
- [CVE-2022-46325](https://insights.sbomify.com/CVE-2022-46325/): Memory corruption in EMUI (critical 9.8)
- [CVE-2022-46324](https://insights.sbomify.com/CVE-2022-46324/): Memory corruption in EMUI (critical 9.8)
- [CVE-2022-46323](https://insights.sbomify.com/CVE-2022-46323/): Memory corruption in EMUI (critical 9.8)
- [CVE-2022-46322](https://insights.sbomify.com/CVE-2022-46322/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-46321](https://insights.sbomify.com/CVE-2022-46321/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-46320](https://insights.sbomify.com/CVE-2022-46320/): Memory corruption in EMUI (critical 9.8)
- [CVE-2022-4632](https://insights.sbomify.com/CVE-2022-4632/): Auto Upload Images cross site scripting (low 3.5)
- [CVE-2022-46319](https://insights.sbomify.com/CVE-2022-46319/): Memory corruption in EMUI (critical 9.8)
- [CVE-2022-46318](https://insights.sbomify.com/CVE-2022-46318/): Business logic in EMUI (medium 5.3)
- [CVE-2022-46317](https://insights.sbomify.com/CVE-2022-46317/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-46316](https://insights.sbomify.com/CVE-2022-46316/): Auth bypass in HarmonyOS (critical 9.8)
- [CVE-2022-46315](https://insights.sbomify.com/CVE-2022-46315/): Denial of service in EMUI (high 7.5)
- [CVE-2022-46314](https://insights.sbomify.com/CVE-2022-46314/): Other in HarmonyOS (high 7.5)
- [CVE-2022-46313](https://insights.sbomify.com/CVE-2022-46313/): Auth bypass in HarmonyOS (medium 5.3)
- [CVE-2022-46312](https://insights.sbomify.com/CVE-2022-46312/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-46311](https://insights.sbomify.com/CVE-2022-46311/): Use after free in HarmonyOS (high 7.5)
- [CVE-2022-46310](https://insights.sbomify.com/CVE-2022-46310/): Information disclosure in HarmonyOS (high 7.5)
- [CVE-2022-4631](https://insights.sbomify.com/CVE-2022-4631/): WP-Ban ban-options.php cross site scripting (low 3.5)
- [CVE-2022-46309](https://insights.sbomify.com/CVE-2022-46309/): Galaxy Software Services Corporation. Vitals ESP - Arbitrary Path File Reading (medium 6.5)
- [CVE-2022-46308](https://insights.sbomify.com/CVE-2022-46308/): SGUDA U-Lock - Broken Access Control (high 8.8)
- [CVE-2022-46307](https://insights.sbomify.com/CVE-2022-46307/): SGUDA U-Lock - Broken Access Control (high 8.8)
- [CVE-2022-46306](https://insights.sbomify.com/CVE-2022-46306/): ChangingTec ServiSign - Path Traversal (high 8.8)
- [CVE-2022-46305](https://insights.sbomify.com/CVE-2022-46305/): ChangingTec ServiSign - Path Traversal (medium 6.5)
- [CVE-2022-46304](https://insights.sbomify.com/CVE-2022-46304/): ChangingTec ServiSign - Command Injection (high 8.8)
- [CVE-2022-46303](https://insights.sbomify.com/CVE-2022-46303/): Command injection in SMS notifications (high 8.0)
- [CVE-2022-46302](https://insights.sbomify.com/CVE-2022-46302/): Remote Code Execution with Root Privileges via Broad Apache Permissions (high 8.8)
- [CVE-2022-46301](https://insights.sbomify.com/CVE-2022-46301/): Denial of service in Intel Unison software (low 1.9)
- [CVE-2022-46300](https://insights.sbomify.com/CVE-2022-46300/): CVE-2022-46300 (medium 5.5)
- [CVE-2022-4630](https://insights.sbomify.com/CVE-2022-4630/): Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius (medium 5.3)
- [CVE-2022-46299](https://insights.sbomify.com/CVE-2022-46299/): Information disclosure in Intel Unison software (low 3.3)
- [CVE-2022-46298](https://insights.sbomify.com/CVE-2022-46298/): Other in Intel Unison software (low 1.9)
- [CVE-2022-46295](https://insights.sbomify.com/CVE-2022-46295/): Open Babel has out-of-bounds write in MSI translationVectors[] (critical 9.8)
- [CVE-2022-46294](https://insights.sbomify.com/CVE-2022-46294/): Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom) (critical 9.8)
- [CVE-2022-46293](https://insights.sbomify.com/CVE-2022-46293/): Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT) (critical 9.8)
- [CVE-2022-46292](https://insights.sbomify.com/CVE-2022-46292/): Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION) (critical 9.8)
- [CVE-2022-46291](https://insights.sbomify.com/CVE-2022-46291/): Open Babel has out-of-bounds write in Gaussian translationVectors[] (critical 9.8)
- [CVE-2022-46290](https://insights.sbomify.com/CVE-2022-46290/): Open Babel has out-of-bounds write in ORCA nAtoms parser (second variant) (critical 9.8)
- [CVE-2022-4629](https://insights.sbomify.com/CVE-2022-4629/): Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-46289](https://insights.sbomify.com/CVE-2022-46289/): Open Babel has out-of-bounds write in ORCA nAtoms parser (critical 9.8)
- [CVE-2022-46288](https://insights.sbomify.com/CVE-2022-46288/): Open redirect in DENSHI NYUSATSU CORE SYSTEM (medium 6.1)
- [CVE-2022-46287](https://insights.sbomify.com/CVE-2022-46287/): Cross-site scripting in DENSHI NYUSATSU CORE SYSTEM (medium 6.1)
- [CVE-2022-46286](https://insights.sbomify.com/CVE-2022-46286/): CVE-2022-46286 (medium 5.5)
- [CVE-2022-46285](https://insights.sbomify.com/CVE-2022-46285/): Denial of service in libXpm (high 7.5)
- [CVE-2022-46282](https://insights.sbomify.com/CVE-2022-46282/): Use after free in CX-Drive (high 7.8)
- [CVE-2022-46280](https://insights.sbomify.com/CVE-2022-46280/): Open Babel has uninitialized pointer dereference in PQS pFormat (critical 9.8)
- [CVE-2022-4628](https://insights.sbomify.com/CVE-2022-4628/): Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-46279](https://insights.sbomify.com/CVE-2022-46279/): Missing authorization in Intel(R) Retail Edge android application (medium 5.0)
- [CVE-2022-4627](https://insights.sbomify.com/CVE-2022-4627/): ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-46265](https://insights.sbomify.com/CVE-2022-46265/): Open redirect in Polarion ALM (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/208/