# Vulnerabilities published in 2022


- [CVE-2022-45349](https://insights.sbomify.com/CVE-2022-45349/): WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-45348](https://insights.sbomify.com/CVE-2022-45348/): WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection (medium 5.8)
- [CVE-2022-45347](https://insights.sbomify.com/CVE-2022-45347/): Apache ShardingSphere-Proxy: MySQL authentication bypass (critical 9.8)
- [CVE-2022-45343](https://insights.sbomify.com/CVE-2022-45343/): Use after free in gpac:gpac (high 7.8)
- [CVE-2022-4534](https://insights.sbomify.com/CVE-2022-4534/): Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass (medium 5.3)
- [CVE-2022-45338](https://insights.sbomify.com/CVE-2022-45338/): File upload in exactsoftware:exact synergy (high 7.8)
- [CVE-2022-45337](https://insights.sbomify.com/CVE-2022-45337/): Memory corruption in tenda:tx9 pro firmware (high 7.5)
- [CVE-2022-45332](https://insights.sbomify.com/CVE-2022-45332/): Memory corruption in gnu:libredwg (high 7.8)
- [CVE-2022-45331](https://insights.sbomify.com/CVE-2022-45331/): SQL injection in aerocms project:aerocms (high 7.5)
- [CVE-2022-45330](https://insights.sbomify.com/CVE-2022-45330/): SQL injection in aerocms project:aerocms (high 7.5)
- [CVE-2022-4533](https://insights.sbomify.com/CVE-2022-4533/): Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass (medium 5.3)
- [CVE-2022-45329](https://insights.sbomify.com/CVE-2022-45329/): SQL injection in aerocms project:aerocms (high 7.5)
- [CVE-2022-45328](https://insights.sbomify.com/CVE-2022-45328/): SQL injection in church management system project:church management system (high 7.2)
- [CVE-2022-45326](https://insights.sbomify.com/CVE-2022-45326/): XML external entity in kwoksys:information server (medium 4.9)
- [CVE-2022-45320](https://insights.sbomify.com/CVE-2022-45320/): Privilege escalation in Liferay Portal (medium 6.3)
- [CVE-2022-4532](https://insights.sbomify.com/CVE-2022-4532/): LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass (medium 6.5)
- [CVE-2022-45315](https://insights.sbomify.com/CVE-2022-45315/): Memory corruption in RouterOS (medium 6.4)
- [CVE-2022-45313](https://insights.sbomify.com/CVE-2022-45313/): Memory corruption in mikrotik:routeros (high 8.8)
- [CVE-2022-45307](https://insights.sbomify.com/CVE-2022-45307/): Misconfiguration in chocolatey:chocolatey php (medium 4.3)
- [CVE-2022-45306](https://insights.sbomify.com/CVE-2022-45306/): Misconfiguration in chocolatey:chocolatey azure-pipelines-agent (medium 4.3)
- [CVE-2022-45305](https://insights.sbomify.com/CVE-2022-45305/): Misconfiguration in chocolatey:chocolatey python3 (medium 4.3)
- [CVE-2022-45304](https://insights.sbomify.com/CVE-2022-45304/): Misconfiguration in chocolatey:chocolatey cmder (medium 4.3)
- [CVE-2022-45301](https://insights.sbomify.com/CVE-2022-45301/): Misconfiguration in chocolatey:chocolatey ruby (medium 4.3)
- [CVE-2022-45299](https://insights.sbomify.com/CVE-2022-45299/): webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL (critical 9.8)
- [CVE-2022-45297](https://insights.sbomify.com/CVE-2022-45297/): SQL injection in eq project:eq (critical 9.8)
- [CVE-2022-45292](https://insights.sbomify.com/CVE-2022-45292/): Business logic in funkwhale:funkwhale (medium 5.3)
- [CVE-2022-45291](https://insights.sbomify.com/CVE-2022-45291/): Hardcoded credentials in pwsdashboard:personal weather station dashboard (high 7.2)
- [CVE-2022-45290](https://insights.sbomify.com/CVE-2022-45290/): Path traversal in kbase doc project:kbase doc (critical 9.1)
- [CVE-2022-4529](https://insights.sbomify.com/CVE-2022-4529/): Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass (medium 5.3)
- [CVE-2022-45287](https://insights.sbomify.com/CVE-2022-45287/): Privilege escalation in temenos:cwx (high 8.8)
- [CVE-2022-45285](https://insights.sbomify.com/CVE-2022-45285/): Cross-site scripting in vsourz:advanced cf7 db (medium 6.1)
- [CVE-2022-45283](https://insights.sbomify.com/CVE-2022-45283/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-45280](https://insights.sbomify.com/CVE-2022-45280/): Cross-site scripting in eyoucms:eyoucms (medium 5.4)
- [CVE-2022-45278](https://insights.sbomify.com/CVE-2022-45278/): SQL injection in jizhicms:jizhicms (high 8.8)
- [CVE-2022-45276](https://insights.sbomify.com/CVE-2022-45276/): Auth bypass in eyunjing:yjcms (critical 9.8)
- [CVE-2022-45275](https://insights.sbomify.com/CVE-2022-45275/): File upload in dynamic transaction queuing system project:dynamic transaction queuing system (high 7.2)
- [CVE-2022-4527](https://insights.sbomify.com/CVE-2022-4527/): collective.task table.py AssignedGroupColumn cross site scripting (low 3.5)
- [CVE-2022-45269](https://insights.sbomify.com/CVE-2022-45269/): Path traversal in gmaolinx:linx sphere (high 7.5)
- [CVE-2022-4526](https://insights.sbomify.com/CVE-2022-4526/): django-photologue Default Template photo_detail.html cross site scripting (low 3.5)
- [CVE-2022-4525](https://insights.sbomify.com/CVE-2022-4525/): National Sleep Research Resource sleepdata.org cross site scripting (low 3.5)
- [CVE-2022-4524](https://insights.sbomify.com/CVE-2022-4524/): Roots soil Plugin CleanUpModule.php language_attributes cross site scripting (low 3.5)
- [CVE-2022-4523](https://insights.sbomify.com/CVE-2022-4523/): vexim2 cross site scripting (low 3.5)
- [CVE-2022-45228](https://insights.sbomify.com/CVE-2022-45228/): Cross-site request forgery in dragino:lg01 lora firmware (low 3.5)
- [CVE-2022-45227](https://insights.sbomify.com/CVE-2022-45227/): Information disclosure in dragino:lg01 lora firmware (high 7.5)
- [CVE-2022-45225](https://insights.sbomify.com/CVE-2022-45225/): Cross-site scripting in book store management system project:book store management system (medium 6.1)
- [CVE-2022-45224](https://insights.sbomify.com/CVE-2022-45224/): Cross-site scripting in web-based student clearance system project:web-based student clearance system (medium 4.8)
- [CVE-2022-45223](https://insights.sbomify.com/CVE-2022-45223/): Cross-site scripting in web-based student clearance system project:web-based student clearance system (medium 4.8)
- [CVE-2022-45221](https://insights.sbomify.com/CVE-2022-45221/): Cross-site scripting in web-based student clearance system project:web-based student clearance system (medium 4.8)
- [CVE-2022-4522](https://insights.sbomify.com/CVE-2022-4522/): CalendarXP cross site scripting (low 3.5)
- [CVE-2022-45218](https://insights.sbomify.com/CVE-2022-45218/): Cross-site scripting in oretnom23:human resource management system (medium 6.1)
- [CVE-2022-45217](https://insights.sbomify.com/CVE-2022-45217/): Cross-site scripting in book store management system project:book store management system (medium 5.4)
- [CVE-2022-45215](https://insights.sbomify.com/CVE-2022-45215/): Cross-site scripting in book store management system project:book store management system (medium 5.4)
- [CVE-2022-45214](https://insights.sbomify.com/CVE-2022-45214/): Cross-site scripting in sanitization management system project:sanitization management system (medium 6.1)
- [CVE-2022-45213](https://insights.sbomify.com/CVE-2022-45213/): Other in perfsonar:perfsonar (medium 5.3)
- [CVE-2022-45210](https://insights.sbomify.com/CVE-2022-45210/): Jeecg-boot vulnerable to SQL Injection (medium 4.3)
- [CVE-2022-4521](https://insights.sbomify.com/CVE-2022-4521/): WSO2 carbon-registry Request Parameter cross site scripting (low 3.5)
- [CVE-2022-45208](https://insights.sbomify.com/CVE-2022-45208/): Jeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin (medium 4.3)
- [CVE-2022-45207](https://insights.sbomify.com/CVE-2022-45207/): Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString (critical 9.8)
- [CVE-2022-45206](https://insights.sbomify.com/CVE-2022-45206/): Jeecg-boot vulnerable to SQL Injection (critical 9.8)
- [CVE-2022-45205](https://insights.sbomify.com/CVE-2022-45205/): SQL injection in jeecg:jeecg boot (medium 5.3)
- [CVE-2022-45204](https://insights.sbomify.com/CVE-2022-45204/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2022-45202](https://insights.sbomify.com/CVE-2022-45202/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-4520](https://insights.sbomify.com/CVE-2022-4520/): WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting (low 3.5)
- [CVE-2022-45199](https://insights.sbomify.com/CVE-2022-45199/): Pillow subject to DoS via SAMPLESPERPIXEL tag (high 7.5)
- [CVE-2022-45198](https://insights.sbomify.com/CVE-2022-45198/): Pillow vulnerable to Data Amplification attack. (high 7.5)
- [CVE-2022-45197](https://insights.sbomify.com/CVE-2022-45197/): Slixmpp lacks SSL Certificate hostname validation in XMLStream (high 7.5)
- [CVE-2022-45196](https://insights.sbomify.com/CVE-2022-45196/): Denial of service in hyperledger:fabric (high 7.5)
- [CVE-2022-45195](https://insights.sbomify.com/CVE-2022-45195/): Weak cryptography in simplex:simplex chat (medium 5.3)
- [CVE-2022-45194](https://insights.sbomify.com/CVE-2022-45194/): XML external entity in bruhn-newtech:cbrn-analysis (low 3.8)
- [CVE-2022-45193](https://insights.sbomify.com/CVE-2022-45193/): Misconfiguration in bruhn-newtech:cbrn-analysis (medium 5.9)
- [CVE-2022-45192](https://insights.sbomify.com/CVE-2022-45192/): Denial of service in microchip:rn4870 firmware (medium 6.5)
- [CVE-2022-45191](https://insights.sbomify.com/CVE-2022-45191/): Denial of service in microchip:rn4870 firmware (medium 6.5)
- [CVE-2022-45190](https://insights.sbomify.com/CVE-2022-45190/): Auth bypass in microchip:rn4870 firmware (medium 5.3)
- [CVE-2022-4519](https://insights.sbomify.com/CVE-2022-4519/): WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-45188](https://insights.sbomify.com/CVE-2022-45188/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-45186](https://insights.sbomify.com/CVE-2022-45186/): Information disclosure in salesagility:suitecrm (high 8.1)
- [CVE-2022-45185](https://insights.sbomify.com/CVE-2022-45185/): Deserialization in salesagility:suitecrm (high 8.8)
- [CVE-2022-45184](https://insights.sbomify.com/CVE-2022-45184/): Path traversal in ironmansoftware:powershell universal (high 7.2)
- [CVE-2022-45183](https://insights.sbomify.com/CVE-2022-45183/): Privilege escalation in ironmansoftware:powershell universal (high 8.8)
- [CVE-2022-45182](https://insights.sbomify.com/CVE-2022-45182/): Other in pistar:pi-star digital voice dashboard (critical 9.8)
- [CVE-2022-45180](https://insights.sbomify.com/CVE-2022-45180/): Missing authorization in liveboxcloud:vdesk (medium 6.5)
- [CVE-2022-45179](https://insights.sbomify.com/CVE-2022-45179/): Cross-site scripting in liveboxcloud:vdesk (medium 5.4)
- [CVE-2022-45178](https://insights.sbomify.com/CVE-2022-45178/): Privilege escalation in liveboxcloud:vdesk (high 8.8)
- [CVE-2022-45177](https://insights.sbomify.com/CVE-2022-45177/): Information disclosure in liveboxcloud:vdesk (high 7.5)
- [CVE-2022-45176](https://insights.sbomify.com/CVE-2022-45176/): Cross-site scripting in liveboxcloud:vdesk (medium 6.1)
- [CVE-2022-45175](https://insights.sbomify.com/CVE-2022-45175/): Missing authorization in liveboxcloud:vdesk (medium 6.5)
- [CVE-2022-45174](https://insights.sbomify.com/CVE-2022-45174/): Auth bypass in liveboxcloud:vdesk (critical 9.8)
- [CVE-2022-45173](https://insights.sbomify.com/CVE-2022-45173/): Auth bypass in liveboxcloud:vdesk (critical 9.8)
- [CVE-2022-45172](https://insights.sbomify.com/CVE-2022-45172/): Privilege escalation in liveboxcloud:vdesk (critical 9.8)
- [CVE-2022-45171](https://insights.sbomify.com/CVE-2022-45171/): File upload in liveboxcloud:vdesk (high 8.8)
- [CVE-2022-45170](https://insights.sbomify.com/CVE-2022-45170/): Weak cryptography in liveboxcloud:vdesk (medium 6.5)
- [CVE-2022-45169](https://insights.sbomify.com/CVE-2022-45169/): Open redirect in liveboxcloud:vdesk (medium 5.9)
- [CVE-2022-45168](https://insights.sbomify.com/CVE-2022-45168/): Auth bypass in liveboxcloud:vdesk (medium 6.5)
- [CVE-2022-45167](https://insights.sbomify.com/CVE-2022-45167/): Missing authorization in archibus:archibus web central (medium 4.3)
- [CVE-2022-45166](https://insights.sbomify.com/CVE-2022-45166/): Missing authorization in archibus:archibus web central (medium 6.5)
- [CVE-2022-45165](https://insights.sbomify.com/CVE-2022-45165/): SQL injection in archibus:web central (medium 6.5)
- [CVE-2022-45164](https://insights.sbomify.com/CVE-2022-45164/): Missing authorization in archibus:archibus web central (medium 4.3)
- [CVE-2022-45163](https://insights.sbomify.com/CVE-2022-45163/): Information disclosure in nxp:i.mx 6 firmware (medium 5.3)
- [CVE-2022-45157](https://insights.sbomify.com/CVE-2022-45157/): Exposure of vSphere's CPI and CSI credentials in Rancher (high 8.5)
- [CVE-2022-45155](https://insights.sbomify.com/CVE-2022-45155/): obs-service-go_modules: arbitrary directory delete (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/215/