# Vulnerabilities published in 2022


- [CVE-2022-46059](https://insights.sbomify.com/CVE-2022-46059/): Cross-site request forgery in aerocms project:aerocms (medium 6.5)
- [CVE-2022-46058](https://insights.sbomify.com/CVE-2022-46058/): Cross-site scripting in aerocms project:aerocms (medium 4.8)
- [CVE-2022-46051](https://insights.sbomify.com/CVE-2022-46051/): SQL injection in aerocms project:aerocms (high 7.2)
- [CVE-2022-4605](https://insights.sbomify.com/CVE-2022-4605/): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (medium 6.0)
- [CVE-2022-46047](https://insights.sbomify.com/CVE-2022-46047/): SQL injection in aerocms project:aerocms (medium 4.9)
- [CVE-2022-4604](https://insights.sbomify.com/CVE-2022-4604/): wp-english-wp-admin Plugin english-wp-admin.php register_endpoints cross-site request forgery (medium 4.3)
- [CVE-2022-4603](https://insights.sbomify.com/CVE-2022-4603/): ppp pppdump pppdump.c dumpppp array index (medium 4.3)
- [CVE-2022-46025](https://insights.sbomify.com/CVE-2022-46025/): Missing authorization in totolink:n200re v5 firmware (critical 9.1)
- [CVE-2022-46021](https://insights.sbomify.com/CVE-2022-46021/): SQL injection in x-man project:x-man (high 7.5)
- [CVE-2022-46020](https://insights.sbomify.com/CVE-2022-46020/): File upload in wbce:wbce cms (critical 9.8)
- [CVE-2022-4602](https://insights.sbomify.com/CVE-2022-4602/): Shoplazza LifeStyle Review Flow cross site scripting (low 3.5)
- [CVE-2022-4601](https://insights.sbomify.com/CVE-2022-4601/): Shoplazza LifeStyle Shipping/Member Discount/Icon cross site scripting (low 3.5)
- [CVE-2022-4600](https://insights.sbomify.com/CVE-2022-4600/): Shoplazza LifeStyle Product Carousel cross site scripting (low 3.5)
- [CVE-2022-45997](https://insights.sbomify.com/CVE-2022-45997/): Memory corruption in tenda:w20e firmware (high 7.2)
- [CVE-2022-45996](https://insights.sbomify.com/CVE-2022-45996/): Command injection in tenda:w20e firmware (high 7.2)
- [CVE-2022-45995](https://insights.sbomify.com/CVE-2022-45995/): Memory corruption in tenda:ax12 firmware (critical 9.8)
- [CVE-2022-45990](https://insights.sbomify.com/CVE-2022-45990/): Cross-site scripting in ecommerce-website project:ecommerce-website (medium 6.1)
- [CVE-2022-4599](https://insights.sbomify.com/CVE-2022-4599/): Shoplazza LifeStyle Product cross site scripting (low 3.5)
- [CVE-2022-45988](https://insights.sbomify.com/CVE-2022-45988/): Privilege escalation in starsoftcomm:coocare (high 7.8)
- [CVE-2022-45982](https://insights.sbomify.com/CVE-2022-45982/): Deserialization of Untrusted Data in thinkphp (critical 9.8)
- [CVE-2022-45980](https://insights.sbomify.com/CVE-2022-45980/): Cross-site request forgery in tenda:ax12 firmware (high 8.8)
- [CVE-2022-4598](https://insights.sbomify.com/CVE-2022-4598/): Shoplazza LifeStyle Announcement cross site scripting (low 3.5)
- [CVE-2022-45979](https://insights.sbomify.com/CVE-2022-45979/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2022-45977](https://insights.sbomify.com/CVE-2022-45977/): Command injection in tenda:ax12 firmware (high 8.8)
- [CVE-2022-45970](https://insights.sbomify.com/CVE-2022-45970/): Alist Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2022-4597](https://insights.sbomify.com/CVE-2022-4597/): Shoplazza LifeStyle Create Product v2_products cross site scripting (low 3.5)
- [CVE-2022-45969](https://insights.sbomify.com/CVE-2022-45969/): Alist vulnerable to Path Traversal (critical 9.8)
- [CVE-2022-45968](https://insights.sbomify.com/CVE-2022-45968/): AList vulnerable to Improper Preservation of Permissions (high 8.8)
- [CVE-2022-45966](https://insights.sbomify.com/CVE-2022-45966/): File upload in classcms project:classcms (critical 9.8)
- [CVE-2022-45963](https://insights.sbomify.com/CVE-2022-45963/): Privilege escalation in h3c:secpath f100-c-g3 firmware (critical 9.8)
- [CVE-2022-45962](https://insights.sbomify.com/CVE-2022-45962/): SQL injection in os4ed:opensis (medium 6.5)
- [CVE-2022-4596](https://insights.sbomify.com/CVE-2022-4596/): Shoplazza Add Blog Post cross site scripting (low 3.5)
- [CVE-2022-45957](https://insights.sbomify.com/CVE-2022-45957/): Memory corruption in zte:zxhn-h108ns firmware (high 7.5)
- [CVE-2022-45956](https://insights.sbomify.com/CVE-2022-45956/): Auth bypass in boa:boa (medium 5.3)
- [CVE-2022-4595](https://insights.sbomify.com/CVE-2022-4595/): django-openipam exposed_hosts.html cross site scripting (low 3.5)
- [CVE-2022-45942](https://insights.sbomify.com/CVE-2022-45942/): Command injection in baijiacms project:baijiacms (high 8.8)
- [CVE-2022-4594](https://insights.sbomify.com/CVE-2022-4594/): drogatkin TJWS2 WarRoller.java deployWar path traversal (medium 6.3)
- [CVE-2022-45939](https://insights.sbomify.com/CVE-2022-45939/): Command injection in debian:debian linux (high 7.8)
- [CVE-2022-45938](https://insights.sbomify.com/CVE-2022-45938/): Cross-site scripting in xfinity:comcast defined technologies microeisbss (high 8.0)
- [CVE-2022-45937](https://insights.sbomify.com/CVE-2022-45937/): Information disclosure in APOGEE PXC Compact (BACnet) (high 8.8)
- [CVE-2022-45936](https://insights.sbomify.com/CVE-2022-45936/): Missing authorization in Mendix Email Connector (high 8.1)
- [CVE-2022-45935](https://insights.sbomify.com/CVE-2022-45935/): Apache James server: Temporary File Information Disclosure (medium 5.5)
- [CVE-2022-45934](https://insights.sbomify.com/CVE-2022-45934/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2022-45933](https://insights.sbomify.com/CVE-2022-45933/): KubeView vulnerable to full cluster takeover due to improper authentication (critical 9.8)
- [CVE-2022-45932](https://insights.sbomify.com/CVE-2022-45932/): SQL injection in linuxfoundation:opendaylight (high 7.5)
- [CVE-2022-45931](https://insights.sbomify.com/CVE-2022-45931/): SQL injection in linuxfoundation:opendaylight (high 7.5)
- [CVE-2022-45930](https://insights.sbomify.com/CVE-2022-45930/): SQL injection in linuxfoundation:opendaylight (high 7.5)
- [CVE-2022-4593](https://insights.sbomify.com/CVE-2022-4593/): retra-system cross site scripting (low 3.5)
- [CVE-2022-45929](https://insights.sbomify.com/CVE-2022-45929/): Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change (high 8.8)
- [CVE-2022-45928](https://insights.sbomify.com/CVE-2022-45928/): Code injection in opentext:opentext extended ecm (high 8.8)
- [CVE-2022-45927](https://insights.sbomify.com/CVE-2022-45927/): Auth bypass in opentext:opentext extended ecm (high 8.8)
- [CVE-2022-45926](https://insights.sbomify.com/CVE-2022-45926/): Server-side request forgery in opentext:opentext extended ecm (high 8.8)
- [CVE-2022-45925](https://insights.sbomify.com/CVE-2022-45925/): Information disclosure in opentext:opentext extended ecm (high 7.5)
- [CVE-2022-45924](https://insights.sbomify.com/CVE-2022-45924/): Missing authorization in opentext:opentext extended ecm (high 8.1)
- [CVE-2022-45923](https://insights.sbomify.com/CVE-2022-45923/): Memory corruption in opentext:opentext extended ecm (high 8.8)
- [CVE-2022-45922](https://insights.sbomify.com/CVE-2022-45922/): Auth bypass in opentext:opentext extended ecm (high 8.8)
- [CVE-2022-45921](https://insights.sbomify.com/CVE-2022-45921/): FusionAuth vulnerable to directory traversal attack (high 7.5)
- [CVE-2022-45920](https://insights.sbomify.com/CVE-2022-45920/): Denial of service in softing:uatoolkit embedded (high 7.5)
- [CVE-2022-4592](https://insights.sbomify.com/CVE-2022-4592/): luckyshot CRMx index.php commentdelete sql injection (medium 6.3)
- [CVE-2022-45919](https://insights.sbomify.com/CVE-2022-45919/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2022-45918](https://insights.sbomify.com/CVE-2022-45918/): Path traversal in ilias:ilias (medium 6.5)
- [CVE-2022-45917](https://insights.sbomify.com/CVE-2022-45917/): ILIAS before 7.16 has an Open Redirect. (medium 6.1)
- [CVE-2022-45916](https://insights.sbomify.com/CVE-2022-45916/): ILIAS before 7.16 allows XSS. (medium 5.4)
- [CVE-2022-45915](https://insights.sbomify.com/CVE-2022-45915/): Command injection in ilias:ilias (high 8.8)
- [CVE-2022-45914](https://insights.sbomify.com/CVE-2022-45914/): Auth bypass in electronic shelf label protocol project:electronic shelf label protocol (medium 6.5)
- [CVE-2022-45913](https://insights.sbomify.com/CVE-2022-45913/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2022-45912](https://insights.sbomify.com/CVE-2022-45912/): File upload in zimbra:collaboration (high 7.2)
- [CVE-2022-45911](https://insights.sbomify.com/CVE-2022-45911/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2022-45910](https://insights.sbomify.com/CVE-2022-45910/): Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities (medium 5.3)
- [CVE-2022-4591](https://insights.sbomify.com/CVE-2022-4591/): mschaef toto Email Parameter cross site scripting (low 3.5)
- [CVE-2022-45909](https://insights.sbomify.com/CVE-2022-45909/): Memory corruption in drachtio:drachtio-server (critical 9.1)
- [CVE-2022-45908](https://insights.sbomify.com/CVE-2022-45908/): PaddlePaddle vulnerable to code injection via winstr (critical 9.8)
- [CVE-2022-45907](https://insights.sbomify.com/CVE-2022-45907/): PyTorch vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2022-4590](https://insights.sbomify.com/CVE-2022-4590/): mschaef toto Todo List cross site scripting (low 3.5)
- [CVE-2022-45899](https://insights.sbomify.com/CVE-2022-45899/): Command injection in nokia:broadcast message center (medium 6.5)
- [CVE-2022-45897](https://insights.sbomify.com/CVE-2022-45897/): Information disclosure in xerox:workcentre 3550 firmware (medium 6.5)
- [CVE-2022-45896](https://insights.sbomify.com/CVE-2022-45896/): File upload in planetestream:planet estream (critical 9.8)
- [CVE-2022-45895](https://insights.sbomify.com/CVE-2022-45895/): Information disclosure in planetestream:planet estream (medium 6.5)
- [CVE-2022-45894](https://insights.sbomify.com/CVE-2022-45894/): Path traversal in planetestream:planet estream (medium 6.5)
- [CVE-2022-45893](https://insights.sbomify.com/CVE-2022-45893/): Auth bypass in planetestream:planet estream (high 8.8)
- [CVE-2022-45892](https://insights.sbomify.com/CVE-2022-45892/): Cross-site scripting in planetestream:planet estream (medium 5.4)
- [CVE-2022-45891](https://insights.sbomify.com/CVE-2022-45891/): Missing authorization in planetestream:planet estream (critical 9.1)
- [CVE-2022-45890](https://insights.sbomify.com/CVE-2022-45890/): Cross-site scripting in planetestream:planet estream (medium 6.1)
- [CVE-2022-4589](https://insights.sbomify.com/CVE-2022-4589/): cyface Terms and Conditions Module views.py returnTo redirect (medium 5.5)
- [CVE-2022-45889](https://insights.sbomify.com/CVE-2022-45889/): SQL injection in planetestream:planet estream (high 7.2)
- [CVE-2022-45888](https://insights.sbomify.com/CVE-2022-45888/): Use after free in linux:linux kernel (medium 6.4)
- [CVE-2022-45887](https://insights.sbomify.com/CVE-2022-45887/): Denial of service in linux:linux kernel (medium 4.7)
- [CVE-2022-45886](https://insights.sbomify.com/CVE-2022-45886/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2022-45885](https://insights.sbomify.com/CVE-2022-45885/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2022-45884](https://insights.sbomify.com/CVE-2022-45884/): Use after free in linux:linux kernel (high 7.0)
- [CVE-2022-4588](https://insights.sbomify.com/CVE-2022-4588/): Boston Sleep slice Layout cross site scripting (low 2.4)
- [CVE-2022-45877](https://insights.sbomify.com/CVE-2022-45877/): Weak cryptography in OpenHarmony (high 8.3)
- [CVE-2022-45876](https://insights.sbomify.com/CVE-2022-45876/): CVE-2022-45876 (medium 5.5)
- [CVE-2022-45875](https://insights.sbomify.com/CVE-2022-45875/): Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin (critical 9.8)
- [CVE-2022-45874](https://insights.sbomify.com/CVE-2022-45874/): Missing authorization in Aslan-AL10 (medium 5.5)
- [CVE-2022-45873](https://insights.sbomify.com/CVE-2022-45873/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2022-45872](https://insights.sbomify.com/CVE-2022-45872/): Other in iterm2:iterm2 (critical 9.8)
- [CVE-2022-45871](https://insights.sbomify.com/CVE-2022-45871/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-4587](https://insights.sbomify.com/CVE-2022-4587/): Opencaching Deutschland oc-server3 Login Page login.tpl cross site scripting (medium 4.3)
- [CVE-2022-45869](https://insights.sbomify.com/CVE-2022-45869/): Race condition in linux:linux kernel (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/210/