# Vulnerabilities published in 2022


- [CVE-2022-4626](https://insights.sbomify.com/CVE-2022-4626/): PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-46258](https://insights.sbomify.com/CVE-2022-46258/): Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope (medium 6.5)
- [CVE-2022-46257](https://insights.sbomify.com/CVE-2022-46257/): Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names (medium 4.3)
- [CVE-2022-46256](https://insights.sbomify.com/CVE-2022-46256/): Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages (high 8.8)
- [CVE-2022-46255](https://insights.sbomify.com/CVE-2022-46255/): Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE (critical 9.8)
- [CVE-2022-4625](https://insights.sbomify.com/CVE-2022-4625/): Login Logout Menu < 1.4.0 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-4624](https://insights.sbomify.com/CVE-2022-4624/): GS Logo Slider < 3.3.8 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-4623](https://insights.sbomify.com/CVE-2022-4623/): ND Shortcodes < 7.0 - Contributor+ Stored XSS via Shortcodes (medium 5.4)
- [CVE-2022-4622](https://insights.sbomify.com/CVE-2022-4622/): Login Logout Menu <= 1.3.3 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-4621](https://insights.sbomify.com/CVE-2022-4621/): Panasonic Sanyo CCTV Network Camera (high 7.5)
- [CVE-2022-4619](https://insights.sbomify.com/CVE-2022-4619/): Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-46181](https://insights.sbomify.com/CVE-2022-46181/): Gotify server XSS vulnerability in the application image file upload (medium 6.1)
- [CVE-2022-46180](https://insights.sbomify.com/CVE-2022-46180/): Arbitrary HTML injection in discourse-mermaid-theme-component (medium 5.0)
- [CVE-2022-46179](https://insights.sbomify.com/CVE-2022-46179/): LiuOS vulnerable to Authorization Bypass through User-Controlled Key (critical 9.2)
- [CVE-2022-46178](https://insights.sbomify.com/CVE-2022-46178/): Path Traversal In MeterSpere allows file upload to any path (high 7.4)
- [CVE-2022-46177](https://insights.sbomify.com/CVE-2022-46177/): Discourse password reset link can lead to in account takeover if user changes to a new email (medium 5.7)
- [CVE-2022-46176](https://insights.sbomify.com/CVE-2022-46176/): Cargo did not verify SSH host keys (medium 5.3)
- [CVE-2022-46175](https://insights.sbomify.com/CVE-2022-46175/): Prototype Pollution in JSON5 via Parse Method (high 7.1)
- [CVE-2022-46174](https://insights.sbomify.com/CVE-2022-46174/): Race condition during concurrent TLS mounts in efs-utils (medium 4.2)
- [CVE-2022-46173](https://insights.sbomify.com/CVE-2022-46173/): Elrond go Processing: fallback search of SCRs when not found in the main cache (high 7.2)
- [CVE-2022-46172](https://insights.sbomify.com/CVE-2022-46172/): authentik allows existing authenticated users to create arbitrary accounts (medium 6.4)
- [CVE-2022-46171](https://insights.sbomify.com/CVE-2022-46171/): Tauri vulnerable to path traversal (medium 6.8)
- [CVE-2022-46170](https://insights.sbomify.com/CVE-2022-46170/): CodeIgniter is vulnerable to improper authentication via Session Handlers (high 8.6)
- [CVE-2022-4617](https://insights.sbomify.com/CVE-2022-4617/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (low 2.7)
- [CVE-2022-46169](https://insights.sbomify.com/CVE-2022-46169/): Cacti Command Injection (critical 9.8, exploited in the wild)
- [CVE-2022-46168](https://insights.sbomify.com/CVE-2022-46168/): Group SMTP user emails are exposed in CC email header (low 3.5)
- [CVE-2022-46167](https://insights.sbomify.com/CVE-2022-46167/): Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace (high 8.8)
- [CVE-2022-46166](https://insights.sbomify.com/CVE-2022-46166/): Spring Boot Admins integrated notifier support allows arbitrary code execution (high 8.1)
- [CVE-2022-46165](https://insights.sbomify.com/CVE-2022-46165/): Cross-site Scripting (XSS) in Web GUI in syncthing (medium 4.6)
- [CVE-2022-46164](https://insights.sbomify.com/CVE-2022-46164/): Account takeover via prototype vulnerability (critical 9.4)
- [CVE-2022-46163](https://insights.sbomify.com/CVE-2022-46163/): travel-support-program vulnerable to data exfiltration via Ransack query injection (high 7.5)
- [CVE-2022-46162](https://insights.sbomify.com/CVE-2022-46162/): Discourse BBCode plugin vulnerable to arbitrary CSS injection (high 8.8)
- [CVE-2022-46161](https://insights.sbomify.com/CVE-2022-46161/): Code injection in pdfmake (critical 10.0)
- [CVE-2022-46160](https://insights.sbomify.com/CVE-2022-46160/): Tuleap dashboards vulnerable to Incorrect Authorization (medium 4.3)
- [CVE-2022-4616](https://insights.sbomify.com/CVE-2022-4616/): Command injection in 4G Router DX-3021 (high 7.2)
- [CVE-2022-46159](https://insights.sbomify.com/CVE-2022-46159/): Any authenticated Discourse user can create an unlisted topic (medium 4.3)
- [CVE-2022-46158](https://insights.sbomify.com/CVE-2022-46158/): Potential Information exposure in the upload directory in PrestaShop (medium 5.3)
- [CVE-2022-46157](https://insights.sbomify.com/CVE-2022-46157/): Remote php code execution in Akeneo PIM (high 8.8)
- [CVE-2022-46156](https://insights.sbomify.com/CVE-2022-46156/): Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information (high 7.2)
- [CVE-2022-46155](https://insights.sbomify.com/CVE-2022-46155/): Airtable.js credentials exposed in browser builds (high 7.6)
- [CVE-2022-46154](https://insights.sbomify.com/CVE-2022-46154/): Arbitrary file access in KodExplorer (high 8.6)
- [CVE-2022-46153](https://insights.sbomify.com/CVE-2022-46153/): Routes exposed with an empty TLSOption in traefik (high 8.1)
- [CVE-2022-46152](https://insights.sbomify.com/CVE-2022-46152/): OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function (high 8.2)
- [CVE-2022-46151](https://insights.sbomify.com/CVE-2022-46151/): Reflected XSS (medium 6.3)
- [CVE-2022-46150](https://insights.sbomify.com/CVE-2022-46150/): Discourse may allow exposure of hidden tags in the subject of notification emails (medium 4.3)
- [CVE-2022-4615](https://insights.sbomify.com/CVE-2022-4615/): Cross-site Scripting (XSS) - Reflected in openemr/openemr (high 8.3)
- [CVE-2022-46149](https://insights.sbomify.com/CVE-2022-46149/): Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list. (medium 5.4)
- [CVE-2022-46148](https://insights.sbomify.com/CVE-2022-46148/): Discourse allows self-XSS through malicious composer message (high 7.1)
- [CVE-2022-46147](https://insights.sbomify.com/CVE-2022-46147/): Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields (high 8.4)
- [CVE-2022-46146](https://insights.sbomify.com/CVE-2022-46146/): Prometheus Exporter Toolkit vulnerable to basic authentication bypass (medium 6.2)
- [CVE-2022-46145](https://insights.sbomify.com/CVE-2022-46145/): authentik vulnerable to unauthorized user creation and potential account takeover (high 8.1)
- [CVE-2022-46144](https://insights.sbomify.com/CVE-2022-46144/): Denial of service in SCALANCE SC622-2C (high 7.1)
- [CVE-2022-46143](https://insights.sbomify.com/CVE-2022-46143/): Information disclosure in RUGGEDCOM RM1224 LTE(4G) EU (medium 5.1)
- [CVE-2022-46142](https://insights.sbomify.com/CVE-2022-46142/): Weak cryptography in RUGGEDCOM RM1224 LTE(4G) EU (medium 5.2)
- [CVE-2022-46141](https://insights.sbomify.com/CVE-2022-46141/): Information disclosure in SIMATIC STEP 7 (TIA Portal) (medium 4.2)
- [CVE-2022-46140](https://insights.sbomify.com/CVE-2022-46140/): Weak cryptography in RUGGEDCOM RM1224 LTE(4G) EU (high 7.1)
- [CVE-2022-4614](https://insights.sbomify.com/CVE-2022-4614/): Cross-site Scripting (XSS) - Stored in alagrede/znote-app (low 2.3)
- [CVE-2022-46139](https://insights.sbomify.com/CVE-2022-46139/): Denial of service in tp-link:tl-wr940n v4 firmware (medium 6.5)
- [CVE-2022-46137](https://insights.sbomify.com/CVE-2022-46137/): Path traversal in aerocms project:aerocms (high 7.5)
- [CVE-2022-46135](https://insights.sbomify.com/CVE-2022-46135/): File upload in aerocms project:aerocms (high 7.2)
- [CVE-2022-4613](https://insights.sbomify.com/CVE-2022-4613/): Click Studios Passwordstate Browser Extension Provisioning improper authorization (medium 5.0)
- [CVE-2022-46128](https://insights.sbomify.com/CVE-2022-46128/): Cross-site scripting in phpgurukul:doctor appointment management system (medium 6.1)
- [CVE-2022-46127](https://insights.sbomify.com/CVE-2022-46127/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46126](https://insights.sbomify.com/CVE-2022-46126/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46125](https://insights.sbomify.com/CVE-2022-46125/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46124](https://insights.sbomify.com/CVE-2022-46124/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46123](https://insights.sbomify.com/CVE-2022-46123/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46122](https://insights.sbomify.com/CVE-2022-46122/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46121](https://insights.sbomify.com/CVE-2022-46121/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46120](https://insights.sbomify.com/CVE-2022-46120/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-4612](https://insights.sbomify.com/CVE-2022-4612/): Click Studios Passwordstate insufficiently protected credentials (medium 4.3)
- [CVE-2022-46119](https://insights.sbomify.com/CVE-2022-46119/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46118](https://insights.sbomify.com/CVE-2022-46118/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-46117](https://insights.sbomify.com/CVE-2022-46117/): SQL injection in helmet store showroom site project:helmet store showroom site (high 7.2)
- [CVE-2022-4611](https://insights.sbomify.com/CVE-2022-4611/): Click Studios Passwordstate hard-coded credentials (medium 4.3)
- [CVE-2022-46109](https://insights.sbomify.com/CVE-2022-46109/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2022-46102](https://insights.sbomify.com/CVE-2022-46102/): File upload in ayacms project:ayacms (critical 9.8)
- [CVE-2022-46101](https://insights.sbomify.com/CVE-2022-46101/): Code injection in ayacms project:ayacms (high 8.8)
- [CVE-2022-4610](https://insights.sbomify.com/CVE-2022-4610/): Click Studios Passwordstate risky encryption (low 1.9)
- [CVE-2022-46096](https://insights.sbomify.com/CVE-2022-46096/): Cross-site scripting in covid-19 directory on vaccination system project:covid-19 directory on vaccination system (medium 6.1)
- [CVE-2022-46095](https://insights.sbomify.com/CVE-2022-46095/): Cross-site scripting in covid-19 directory on vaccination system project:covid-19 directory on vaccination system (medium 6.1)
- [CVE-2022-46093](https://insights.sbomify.com/CVE-2022-46093/): SQL injection in hospital management system project:hospital management system (high 8.2)
- [CVE-2022-46091](https://insights.sbomify.com/CVE-2022-46091/): Cross-site scripting in oretnom23:online flight booking management system (medium 4.7)
- [CVE-2022-4609](https://insights.sbomify.com/CVE-2022-4609/): Cross-site Scripting (XSS) - Stored in usememos/memos (high 7.6)
- [CVE-2022-46089](https://insights.sbomify.com/CVE-2022-46089/): Cross-site scripting in oretnom23:online flight booking management system (medium 6.1)
- [CVE-2022-46088](https://insights.sbomify.com/CVE-2022-46088/): Cross-site scripting in oretnom23:online flight booking management system (medium 6.1)
- [CVE-2022-46087](https://insights.sbomify.com/CVE-2022-46087/): Cross-site scripting in cloudschool project:cloudschool (medium 5.4)
- [CVE-2022-46081](https://insights.sbomify.com/CVE-2022-46081/): Information disclosure in garmin:connect (high 7.5)
- [CVE-2022-46080](https://insights.sbomify.com/CVE-2022-46080/): Auth bypass in nexxtsolutions:nebula1200-ac firmware (critical 9.8)
- [CVE-2022-4608](https://insights.sbomify.com/CVE-2022-4608/): Memory corruption in RTU500 series (high 7.5)
- [CVE-2022-46076](https://insights.sbomify.com/CVE-2022-46076/): Auth bypass in dlink:dir-869 firmware (high 7.5)
- [CVE-2022-46074](https://insights.sbomify.com/CVE-2022-46074/): Cross-site request forgery in helmet store showroom project:helmet store showroom (high 8.8)
- [CVE-2022-46073](https://insights.sbomify.com/CVE-2022-46073/): Cross-site scripting in helmet store showroom project:helmet store showroom (medium 6.1)
- [CVE-2022-46072](https://insights.sbomify.com/CVE-2022-46072/): SQL injection in helmet store showroom project:helmet store showroom (critical 9.8)
- [CVE-2022-46071](https://insights.sbomify.com/CVE-2022-46071/): SQL injection in helmet store showroom site project:helmet store showroom site (critical 9.8)
- [CVE-2022-46070](https://insights.sbomify.com/CVE-2022-46070/): Path traversal in geovision:gv-asmanager (high 7.5)
- [CVE-2022-4607](https://insights.sbomify.com/CVE-2022-4607/): 3D City Database OGC Web Feature Service xml external entity reference (medium 5.5)
- [CVE-2022-46062](https://insights.sbomify.com/CVE-2022-46062/): Cross-site request forgery in gym management system project:gym management system (medium 4.5)
- [CVE-2022-46061](https://insights.sbomify.com/CVE-2022-46061/): Other in aerocms project:aerocms (medium 6.1)
- [CVE-2022-4606](https://insights.sbomify.com/CVE-2022-4606/): PHP Remote File Inclusion in flatpressblog/flatpress (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/209/