# Vulnerabilities published in 2022


- [CVE-2022-45868](https://insights.sbomify.com/CVE-2022-45868/): Password exposure in H2 Database (high 8.4)
- [CVE-2022-45867](https://insights.sbomify.com/CVE-2022-45867/): Path traversal in mybb:mybb (high 7.2)
- [CVE-2022-45866](https://insights.sbomify.com/CVE-2022-45866/): Path traversal in fedoraproject:fedora (medium 5.3)
- [CVE-2022-45862](https://insights.sbomify.com/CVE-2022-45862/): Auth bypass in FortiOS (low 3.5)
- [CVE-2022-45861](https://insights.sbomify.com/CVE-2022-45861/): Null dereference in FortiOS (medium 6.4)
- [CVE-2022-45860](https://insights.sbomify.com/CVE-2022-45860/): Auth bypass in FortiNAC (medium 5.0)
- [CVE-2022-4586](https://insights.sbomify.com/CVE-2022-4586/): Opencaching Deutschland oc-server3 Cachelist cachelists.tpl cross site scripting (low 3.5)
- [CVE-2022-45859](https://insights.sbomify.com/CVE-2022-45859/): Information disclosure in FortiNAC (low 3.9)
- [CVE-2022-45858](https://insights.sbomify.com/CVE-2022-45858/): Weak cryptography in FortiNAC (low 3.8)
- [CVE-2022-45857](https://insights.sbomify.com/CVE-2022-45857/): Auth bypass in FortiManager (medium 6.0)
- [CVE-2022-45856](https://insights.sbomify.com/CVE-2022-45856/): Security feature bypass in FortiClientAndroid (medium 4.6)
- [CVE-2022-45855](https://insights.sbomify.com/CVE-2022-45855/): Apache Ambari: Allows authenticated metrics consumers to perform RCE (high 8.0)
- [CVE-2022-45854](https://insights.sbomify.com/CVE-2022-45854/): Denial of service in NWA110AX firmware (medium 4.3)
- [CVE-2022-45853](https://insights.sbomify.com/CVE-2022-45853/): Privilege escalation in GS1900-8 firmware (medium 6.7)
- [CVE-2022-45852](https://insights.sbomify.com/CVE-2022-45852/): WordPress WP-FormAssembly plugin <= 2.0.5 - Auth. Arbitrary File Read vulnerability (medium 6.5)
- [CVE-2022-45851](https://insights.sbomify.com/CVE-2022-45851/): WordPress ShareThis Dashboard for Google Analytics plugin <= 3.1.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45850](https://insights.sbomify.com/CVE-2022-45850/): Cross-site request forgery in Image Map Pro (medium 6.1)
- [CVE-2022-4585](https://insights.sbomify.com/CVE-2022-4585/): Opencaching Deutschland oc-server3 Cookie start.tpl cross site scripting (low 3.5)
- [CVE-2022-45849](https://insights.sbomify.com/CVE-2022-45849/): WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-45848](https://insights.sbomify.com/CVE-2022-45848/): WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2022-45847](https://insights.sbomify.com/CVE-2022-45847/): WordPress Countdown Widget plugin <= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-45846](https://insights.sbomify.com/CVE-2022-45846/): WordPress Image Map Pro Plugin < 5.6.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-45845](https://insights.sbomify.com/CVE-2022-45845/): WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection (medium 4.3)
- [CVE-2022-45843](https://insights.sbomify.com/CVE-2022-45843/): WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-45842](https://insights.sbomify.com/CVE-2022-45842/): WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability (medium 5.3)
- [CVE-2022-45841](https://insights.sbomify.com/CVE-2022-45841/): WordPress Robo Gallery plugin <= 3.2.9 - Auth. Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45840](https://insights.sbomify.com/CVE-2022-45840/): WordPress Auto Affiliate Links plugin <= 6.2.1.5 - Unauth. Broken Access Control vulnerability (medium 6.5)
- [CVE-2022-4584](https://insights.sbomify.com/CVE-2022-4584/): Axiomatic Bento4 mp42aac heap-based overflow (medium 6.3)
- [CVE-2022-45839](https://insights.sbomify.com/CVE-2022-45839/): WordPress WHA Puzzle Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.3)
- [CVE-2022-45838](https://insights.sbomify.com/CVE-2022-45838/): WordPress ARForms Form Builder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2022-45837](https://insights.sbomify.com/CVE-2022-45837/): WordPress 微信机器人高级版 Plugin <= 6.0.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45836](https://insights.sbomify.com/CVE-2022-45836/): WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45835](https://insights.sbomify.com/CVE-2022-45835/): WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF) (medium 5.8)
- [CVE-2022-45833](https://insights.sbomify.com/CVE-2022-45833/): WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal (medium 6.8)
- [CVE-2022-45832](https://insights.sbomify.com/CVE-2022-45832/): WordPress Attorney theme <= 3 - Unauth. Arbitrary Content Deletion vulnerability (medium 6.5)
- [CVE-2022-45831](https://insights.sbomify.com/CVE-2022-45831/): WordPress Image Hover Effects - Caption Hover with Carousel Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45830](https://insights.sbomify.com/CVE-2022-45830/): WordPress Analytify - Google Analytics Dashboard plugin <= 4.2.3 - Privilege Escalation vulnerability (medium 6.5)
- [CVE-2022-4583](https://insights.sbomify.com/CVE-2022-4583/): jLEMS JUtil.java unpackJar path traversal (medium 6.3)
- [CVE-2022-45829](https://insights.sbomify.com/CVE-2022-45829/): WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion (high 8.7)
- [CVE-2022-45828](https://insights.sbomify.com/CVE-2022-45828/): WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45827](https://insights.sbomify.com/CVE-2022-45827/): WordPress Video Contest WordPress Plugin Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-45826](https://insights.sbomify.com/CVE-2022-45826/): WordPress Sunshine Photo Cart plugin <= 2.9.13 - Auth. Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45825](https://insights.sbomify.com/CVE-2022-45825/): WordPress WPComplete Plugin <= 2.9.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45824](https://insights.sbomify.com/CVE-2022-45824/): WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-45823](https://insights.sbomify.com/CVE-2022-45823/): WordPress Video Contest WordPress Plugin Plugin <= 3.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45822](https://insights.sbomify.com/CVE-2022-45822/): WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection (critical 10.0)
- [CVE-2022-45821](https://insights.sbomify.com/CVE-2022-45821/): WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-45820](https://insights.sbomify.com/CVE-2022-45820/): WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection (critical 9.1)
- [CVE-2022-4582](https://insights.sbomify.com/CVE-2022-4582/): starter-public-edition-4 cross site scripting (low 3.5)
- [CVE-2022-45819](https://insights.sbomify.com/CVE-2022-45819/): WordPress Popup Maker plugin <= 1.17.1 - Broken Access Control vulnerability (low 3.5)
- [CVE-2022-45818](https://insights.sbomify.com/CVE-2022-45818/): WordPress Hero Banner Ultimate Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-45817](https://insights.sbomify.com/CVE-2022-45817/): WordPress GC Testimonials Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-45816](https://insights.sbomify.com/CVE-2022-45816/): WordPress GD bbPress Attachments Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-45815](https://insights.sbomify.com/CVE-2022-45815/): WordPress GDPR Compliance & Cookie Consent Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45814](https://insights.sbomify.com/CVE-2022-45814/): WordPress WP Calendar Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-45813](https://insights.sbomify.com/CVE-2022-45813/): WordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRF (medium 5.4)
- [CVE-2022-45812](https://insights.sbomify.com/CVE-2022-45812/): WordPress Exxp Plugin <= 2.6.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2022-45811](https://insights.sbomify.com/CVE-2022-45811/): WordPress Post Teaser plugin <= 4.1.5 - Auth. Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45810](https://insights.sbomify.com/CVE-2022-45810/): WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-4581](https://insights.sbomify.com/CVE-2022-4581/): 1j01 mind-map app.coffee cross site scripting (low 3.5)
- [CVE-2022-45809](https://insights.sbomify.com/CVE-2022-45809/): WordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race Condition (medium 5.3)
- [CVE-2022-45808](https://insights.sbomify.com/CVE-2022-45808/): WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection (critical 9.9)
- [CVE-2022-45807](https://insights.sbomify.com/CVE-2022-45807/): WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-45806](https://insights.sbomify.com/CVE-2022-45806/): WordPress Formidable Forms plugin <= 5.5.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-45805](https://insights.sbomify.com/CVE-2022-45805/): WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection (high 8.2)
- [CVE-2022-45804](https://insights.sbomify.com/CVE-2022-45804/): WordPress Robo Gallery Plugin <= 3.2.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-45803](https://insights.sbomify.com/CVE-2022-45803/): WordPress Gutenberg Forms plugin <= 2.2.8.3 - Auth. Broken Access Control vulnerability (medium 6.5)
- [CVE-2022-45802](https://insights.sbomify.com/CVE-2022-45802/): Apache StreamPark (incubating): Upload any file to any directory (critical 9.8)
- [CVE-2022-45801](https://insights.sbomify.com/CVE-2022-45801/): Apache StreamPark (incubating): LDAP Injection Vulnerability (medium 5.4)
- [CVE-2022-4580](https://insights.sbomify.com/CVE-2022-4580/): Twenty20 Image Before-After <= 1.5.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45798](https://insights.sbomify.com/CVE-2022-45798/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-45797](https://insights.sbomify.com/CVE-2022-45797/): Privilege escalation in Trend Micro Apex One (high 7.1)
- [CVE-2022-45796](https://insights.sbomify.com/CVE-2022-45796/): SHARP Multifunction Printer - Command Injection (critical 9.1)
- [CVE-2022-45794](https://insights.sbomify.com/CVE-2022-45794/): Omron CJ-series and CS-series unauthenticated filesystem access. (high 8.6)
- [CVE-2022-45793](https://insights.sbomify.com/CVE-2022-45793/): Executable files writable by low-privileged users in Omron Sysmac Studio (medium 5.5)
- [CVE-2022-45792](https://insights.sbomify.com/CVE-2022-45792/): Directory Traversal in Project File Format allows overwrite (Zip Slip) (high 7.8)
- [CVE-2022-45790](https://insights.sbomify.com/CVE-2022-45790/): Omron FINS memory protection susceptible to bruteforce (high 8.6)
- [CVE-2022-45789](https://insights.sbomify.com/CVE-2022-45789/): Auth bypass in EcoStruxure Control Expert (high 8.1)
- [CVE-2022-45788](https://insights.sbomify.com/CVE-2022-45788/): Other in EcoStruxure Control Expert (high 7.5)
- [CVE-2022-45787](https://insights.sbomify.com/CVE-2022-45787/): Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider (medium 5.5)
- [CVE-2022-45786](https://insights.sbomify.com/CVE-2022-45786/): Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection (high 8.1)
- [CVE-2022-45783](https://insights.sbomify.com/CVE-2022-45783/): Path traversal in dotcms:dotcms (medium 6.5)
- [CVE-2022-45782](https://insights.sbomify.com/CVE-2022-45782/): Weak cryptography in dotcms:dotcms (high 8.8)
- [CVE-2022-45781](https://insights.sbomify.com/CVE-2022-45781/): Memory corruption in tenda:ax1803 firmware (high 8.8)
- [CVE-2022-4578](https://insights.sbomify.com/CVE-2022-4578/): Video Conferencing with Zoom < 4.0.10 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45778](https://insights.sbomify.com/CVE-2022-45778/): Auth bypass in hillstonenet:sc-6000-wv02 firmware (critical 9.8)
- [CVE-2022-45771](https://insights.sbomify.com/CVE-2022-45771/): File upload in pwndoc project:pwndoc (high 8.8)
- [CVE-2022-45770](https://insights.sbomify.com/CVE-2022-45770/): Privilege escalation in adguard:adguard (high 7.8)
- [CVE-2022-4577](https://insights.sbomify.com/CVE-2022-4577/): Easy Testimonials < 3.9.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45769](https://insights.sbomify.com/CVE-2022-45769/): Cross-site scripting in clicshopping:clicshopping v3 (medium 6.1)
- [CVE-2022-45768](https://insights.sbomify.com/CVE-2022-45768/): Command injection in edimax:br-6428ns firmware (high 8.8)
- [CVE-2022-45766](https://insights.sbomify.com/CVE-2022-45766/): Hardcoded credentials in keystorage:global facilities management software (critical 9.1)
- [CVE-2022-45760](https://insights.sbomify.com/CVE-2022-45760/): Missing authorization in sens project:sens (high 8.8)
- [CVE-2022-4576](https://insights.sbomify.com/CVE-2022-4576/): Easy Bootstrap Shortcode <= 4.5.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45759](https://insights.sbomify.com/CVE-2022-45759/): File upload in sens project:sens (high 8.8)
- [CVE-2022-45758](https://insights.sbomify.com/CVE-2022-45758/): Cross-site scripting in sens project:sens (medium 5.4)
- [CVE-2022-45756](https://insights.sbomify.com/CVE-2022-45756/): Cross-site scripting in sens project:sens (medium 6.1)
- [CVE-2022-45755](https://insights.sbomify.com/CVE-2022-45755/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2022-4575](https://insights.sbomify.com/CVE-2022-4575/): Security feature bypass in ThinkPad BIOS (medium 6.7)
- [CVE-2022-45748](https://insights.sbomify.com/CVE-2022-45748/): Use after free in assimp:assimp (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/211/