# Vulnerabilities published in 2022


- [CVE-2022-45442](https://insights.sbomify.com/CVE-2022-45442/): Sinatra vulnerable to Reflected File Download attack (high 8.8)
- [CVE-2022-45441](https://insights.sbomify.com/CVE-2022-45441/): Cross-site scripting in NBG-418N v2 firmware (medium 6.1)
- [CVE-2022-45440](https://insights.sbomify.com/CVE-2022-45440/): Path traversal in AX7501-B0 firmware (medium 4.4)
- [CVE-2022-4544](https://insights.sbomify.com/CVE-2022-4544/): MashShare < 3.8.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45439](https://insights.sbomify.com/CVE-2022-45439/): Information disclosure in AX7501-B0 firmware (medium 6.5)
- [CVE-2022-45438](https://insights.sbomify.com/CVE-2022-45438/): Apache Superset: Dashboard metadata information leak (medium 5.3)
- [CVE-2022-45437](https://insights.sbomify.com/CVE-2022-45437/): Stored cross-site scripting vulnerability in the reporting dashboard module (medium 6.5)
- [CVE-2022-45436](https://insights.sbomify.com/CVE-2022-45436/): Stored cross-site scripting vulnerability in network maps editor feature (medium 6.1)
- [CVE-2022-45435](https://insights.sbomify.com/CVE-2022-45435/): SailPoint IdentityIQ Access Control Bypass (medium 6.8)
- [CVE-2022-45434](https://insights.sbomify.com/CVE-2022-45434/): Denial of service in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (medium 5.9)
- [CVE-2022-45433](https://insights.sbomify.com/CVE-2022-45433/): Missing authorization in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (low 3.7)
- [CVE-2022-45432](https://insights.sbomify.com/CVE-2022-45432/): Auth bypass in DSS Professional、DSS Express、DHI-DSS7016D-S2/DHI-DSS7016DR-S2、DHI-DSS4004-S2 (medium 5.3)
- [CVE-2022-45431](https://insights.sbomify.com/CVE-2022-45431/): Missing authorization in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (high 7.5)
- [CVE-2022-45430](https://insights.sbomify.com/CVE-2022-45430/): Missing authorization in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (low 3.7)
- [CVE-2022-4543](https://insights.sbomify.com/CVE-2022-4543/): Information disclosure in Linux kernel (medium 5.5)
- [CVE-2022-45429](https://insights.sbomify.com/CVE-2022-45429/): Server-side request forgery in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (high 7.5)
- [CVE-2022-45428](https://insights.sbomify.com/CVE-2022-45428/): Information disclosure in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (low 2.7)
- [CVE-2022-45427](https://insights.sbomify.com/CVE-2022-45427/): File upload in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (high 7.2)
- [CVE-2022-45426](https://insights.sbomify.com/CVE-2022-45426/): Path traversal in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (medium 6.5)
- [CVE-2022-45425](https://insights.sbomify.com/CVE-2022-45425/): Hardcoded credentials in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (high 7.5)
- [CVE-2022-45424](https://insights.sbomify.com/CVE-2022-45424/): Missing authorization in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (medium 5.3)
- [CVE-2022-45423](https://insights.sbomify.com/CVE-2022-45423/): Information disclosure in DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 (high 7.5)
- [CVE-2022-45422](https://insights.sbomify.com/CVE-2022-45422/): Privilege escalation in LG PC (high 7.8)
- [CVE-2022-45421](https://insights.sbomify.com/CVE-2022-45421/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-45420](https://insights.sbomify.com/CVE-2022-45420/): Other in Firefox (medium 6.5)
- [CVE-2022-4542](https://insights.sbomify.com/CVE-2022-4542/): Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45419](https://insights.sbomify.com/CVE-2022-45419/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-45418](https://insights.sbomify.com/CVE-2022-45418/): Other in Firefox (medium 6.1)
- [CVE-2022-45417](https://insights.sbomify.com/CVE-2022-45417/): Information disclosure in Firefox (medium 4.3)
- [CVE-2022-45416](https://insights.sbomify.com/CVE-2022-45416/): Information disclosure in Firefox (medium 6.5)
- [CVE-2022-45415](https://insights.sbomify.com/CVE-2022-45415/): File upload in Firefox (high 7.8)
- [CVE-2022-45414](https://insights.sbomify.com/CVE-2022-45414/): Security feature bypass in Thunderbird (high 8.1)
- [CVE-2022-45413](https://insights.sbomify.com/CVE-2022-45413/): Open redirect in Firefox (medium 6.1)
- [CVE-2022-45412](https://insights.sbomify.com/CVE-2022-45412/): Information disclosure in Firefox (high 8.8)
- [CVE-2022-45411](https://insights.sbomify.com/CVE-2022-45411/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2022-45410](https://insights.sbomify.com/CVE-2022-45410/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-4541](https://insights.sbomify.com/CVE-2022-4541/): WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header (high 7.2)
- [CVE-2022-45409](https://insights.sbomify.com/CVE-2022-45409/): Use after free in Firefox (high 8.8)
- [CVE-2022-45408](https://insights.sbomify.com/CVE-2022-45408/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-45407](https://insights.sbomify.com/CVE-2022-45407/): Use after free in Firefox (high 7.5)
- [CVE-2022-45406](https://insights.sbomify.com/CVE-2022-45406/): Use after free in Firefox (critical 9.8)
- [CVE-2022-45405](https://insights.sbomify.com/CVE-2022-45405/): Use after free in Firefox (medium 6.5)
- [CVE-2022-45404](https://insights.sbomify.com/CVE-2022-45404/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-45403](https://insights.sbomify.com/CVE-2022-45403/): Information disclosure in Firefox (medium 6.5)
- [CVE-2022-45402](https://insights.sbomify.com/CVE-2022-45402/): Apache Airflow: Open redirect during login (medium 6.1)
- [CVE-2022-45401](https://insights.sbomify.com/CVE-2022-45401/): Jenkins Associated Files Plugin vulnerable to cross-site scripting (XSS) (medium 5.4)
- [CVE-2022-45400](https://insights.sbomify.com/CVE-2022-45400/): XXE vulnerability in Jenkins JAPEX Plugin (critical 9.8)
- [CVE-2022-45399](https://insights.sbomify.com/CVE-2022-45399/): Jenkins Cluster Statistics Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-45398](https://insights.sbomify.com/CVE-2022-45398/): Cross-Site Request Forgery in Jenkins Cluster Statistics Plugin (medium 4.3)
- [CVE-2022-45397](https://insights.sbomify.com/CVE-2022-45397/): XXE vulnerability on agents in Jenkins OSF Builder Suite : : XML Linter Plugin (critical 9.8)
- [CVE-2022-45396](https://insights.sbomify.com/CVE-2022-45396/): XXE vulnerability on agents in Jenkins SourceMonitor Plugin (critical 9.8)
- [CVE-2022-45395](https://insights.sbomify.com/CVE-2022-45395/): XML External Entity Reference in Jenkins CCCC Plugin (critical 9.8)
- [CVE-2022-45394](https://insights.sbomify.com/CVE-2022-45394/): Missing permission check in Jenkins Delete log Plugin (medium 4.3)
- [CVE-2022-45393](https://insights.sbomify.com/CVE-2022-45393/): Cross-Site Request Forgery in Jenkins Delete log Plugin (low 3.5)
- [CVE-2022-45392](https://insights.sbomify.com/CVE-2022-45392/): Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin (medium 6.5)
- [CVE-2022-45391](https://insights.sbomify.com/CVE-2022-45391/): Jenkins NS-ND Integration Performance Publisher Plugin disables SSL/TLS certificate validation globally and unconditionally (high 7.5)
- [CVE-2022-45390](https://insights.sbomify.com/CVE-2022-45390/): Missing permission check in Jenkins loader.io Plugin allows enumerating credentials IDs (medium 4.3)
- [CVE-2022-4539](https://insights.sbomify.com/CVE-2022-4539/): Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass (medium 5.3)
- [CVE-2022-45389](https://insights.sbomify.com/CVE-2022-45389/): Missing Authorization in Jenkins XP-Dev Plugin (medium 5.3)
- [CVE-2022-45388](https://insights.sbomify.com/CVE-2022-45388/): Jenkins Config Rotator Plugin vulnerable to path traversal (high 7.5)
- [CVE-2022-45387](https://insights.sbomify.com/CVE-2022-45387/): Jenkins BART Plugin vulnerable to cross-site scripting (XSS) (medium 5.4)
- [CVE-2022-45386](https://insights.sbomify.com/CVE-2022-45386/): XML External Entity Reference in Jenkins Violations Plugin (medium 5.5)
- [CVE-2022-45385](https://insights.sbomify.com/CVE-2022-45385/): Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin (high 7.5)
- [CVE-2022-45384](https://insights.sbomify.com/CVE-2022-45384/): Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords (medium 6.5)
- [CVE-2022-45383](https://insights.sbomify.com/CVE-2022-45383/): Incorrect permission checks in Jenkins Support Core Plugin (medium 6.5)
- [CVE-2022-45382](https://insights.sbomify.com/CVE-2022-45382/): Cross-site Scripting in Jenkins Naginator Plugin (medium 5.4)
- [CVE-2022-45381](https://insights.sbomify.com/CVE-2022-45381/): Arbitrary file read vulnerability in Jenkins Pipeline Utility Steps Plugin (high 8.1)
- [CVE-2022-45380](https://insights.sbomify.com/CVE-2022-45380/): Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion (medium 5.4)
- [CVE-2022-45379](https://insights.sbomify.com/CVE-2022-45379/): Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions (high 7.5)
- [CVE-2022-45378](https://insights.sbomify.com/CVE-2022-45378/): Apache SOAP allows unauthenticated users to potentially invoke arbitrary code (critical 9.8)
- [CVE-2022-45377](https://insights.sbomify.com/CVE-2022-45377/): WordPress Drag and Drop Multiple File Upload for WooCommerce Plugin <= 1.0.8 is vulnerable to Multiple Vulnerabilities (medium 6.5)
- [CVE-2022-45376](https://insights.sbomify.com/CVE-2022-45376/): WordPress Side Cart Woocommerce (Ajax) Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45375](https://insights.sbomify.com/CVE-2022-45375/): WordPress iFeature Slider plugin <= 1.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-45374](https://insights.sbomify.com/CVE-2022-45374/): WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.4 - Local File Inclusion (high 7.7)
- [CVE-2022-45373](https://insights.sbomify.com/CVE-2022-45373/): WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to SQL Injection (high 8.8)
- [CVE-2022-45372](https://insights.sbomify.com/CVE-2022-45372/): WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45371](https://insights.sbomify.com/CVE-2022-45371/): WordPress ShopEngine Plugin <= 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-45370](https://insights.sbomify.com/CVE-2022-45370/): WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-4537](https://insights.sbomify.com/CVE-2022-4537/): Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass (medium 6.5)
- [CVE-2022-45369](https://insights.sbomify.com/CVE-2022-45369/): WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-45368](https://insights.sbomify.com/CVE-2022-45368/): WordPress 1003 Mortgage Application plugin <= 1.75 - Local File Inclusion (high 7.7)
- [CVE-2022-45367](https://insights.sbomify.com/CVE-2022-45367/): WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45366](https://insights.sbomify.com/CVE-2022-45366/): WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45365](https://insights.sbomify.com/CVE-2022-45365/): WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45364](https://insights.sbomify.com/CVE-2022-45364/): Cross-site request forgery in Drag and Drop Multiple File Upload – Contact Form 7 (medium 5.4)
- [CVE-2022-45363](https://insights.sbomify.com/CVE-2022-45363/): WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-45362](https://insights.sbomify.com/CVE-2022-45362/): WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF) (high 7.2)
- [CVE-2022-45361](https://insights.sbomify.com/CVE-2022-45361/): WordPress 0mk Shortener Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-45360](https://insights.sbomify.com/CVE-2022-45360/): WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection (medium 4.7)
- [CVE-2022-4536](https://insights.sbomify.com/CVE-2022-4536/): IP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass (medium 5.3)
- [CVE-2022-45359](https://insights.sbomify.com/CVE-2022-45359/): WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.19.0 is vulnerable to Arbitrary File Upload (critical 9.8)
- [CVE-2022-45358](https://insights.sbomify.com/CVE-2022-45358/): WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-45357](https://insights.sbomify.com/CVE-2022-45357/): WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection (medium 6.1)
- [CVE-2022-45356](https://insights.sbomify.com/CVE-2022-45356/): WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45355](https://insights.sbomify.com/CVE-2022-45355/): WordPress WP Pipes Plugin <= 1.33 is vulnerable to SQL Injection (SQLi) (high 8.2)
- [CVE-2022-45354](https://insights.sbomify.com/CVE-2022-45354/): WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2022-45353](https://insights.sbomify.com/CVE-2022-45353/): WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2022-45352](https://insights.sbomify.com/CVE-2022-45352/): WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45351](https://insights.sbomify.com/CVE-2022-45351/): WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45350](https://insights.sbomify.com/CVE-2022-45350/): WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection (low 3.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/214/