# Vulnerabilities published in 2022


- [CVE-2022-45154](https://insights.sbomify.com/CVE-2022-45154/): supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh (medium 4.4)
- [CVE-2022-45153](https://insights.sbomify.com/CVE-2022-45153/): saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls (high 7.0)
- [CVE-2022-45152](https://insights.sbomify.com/CVE-2022-45152/): Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library (critical 9.1)
- [CVE-2022-45151](https://insights.sbomify.com/CVE-2022-45151/): Moodle stored-XSS vulnerability in some "social" user profile fields (medium 5.4)
- [CVE-2022-45150](https://insights.sbomify.com/CVE-2022-45150/): Moodle reflected cross-site scripting vulnerability in policy tool (medium 6.1)
- [CVE-2022-4515](https://insights.sbomify.com/CVE-2022-4515/): Command injection in Exuberant Ctags (high 7.8)
- [CVE-2022-45149](https://insights.sbomify.com/CVE-2022-45149/): Cross-Site Request Forgery in Moodle (medium 5.4)
- [CVE-2022-45147](https://insights.sbomify.com/CVE-2022-45147/): Deserialization in SIMATIC PCS neo V4.0 (high 8.5)
- [CVE-2022-45146](https://insights.sbomify.com/CVE-2022-45146/): Garbage collection issue in BC-FJA in Java 13 and later (medium 5.5)
- [CVE-2022-45145](https://insights.sbomify.com/CVE-2022-45145/): Command injection in call-cc:chicken (critical 9.8)
- [CVE-2022-45144](https://insights.sbomify.com/CVE-2022-45144/): Cross-site scripting in algoo:tracim (medium 6.1)
- [CVE-2022-45143](https://insights.sbomify.com/CVE-2022-45143/): Apache Tomcat: JsonErrorReportValve escaping (high 7.5)
- [CVE-2022-45142](https://insights.sbomify.com/CVE-2022-45142/): Weak cryptography in Samba (high 7.5)
- [CVE-2022-45141](https://insights.sbomify.com/CVE-2022-45141/): Weak cryptography in Samba (critical 9.8)
- [CVE-2022-45140](https://insights.sbomify.com/CVE-2022-45140/): WAGO: Missing Authentication for Critical Function (critical 9.8)
- [CVE-2022-4514](https://insights.sbomify.com/CVE-2022-4514/): Opencaching Deutschland oc-server3 varset.inc.php cross site scripting (low 3.5)
- [CVE-2022-45139](https://insights.sbomify.com/CVE-2022-45139/): WAGO: Origin validation error through CORS misconfiguration (medium 5.3)
- [CVE-2022-45138](https://insights.sbomify.com/CVE-2022-45138/): WAGO: Missing Authentication for Critical Function (critical 9.8)
- [CVE-2022-45137](https://insights.sbomify.com/CVE-2022-45137/): WAGO: Reflective Cross-Site Scripting (medium 6.1)
- [CVE-2022-45136](https://insights.sbomify.com/CVE-2022-45136/): Apache Jena SDB allows arbitrary deserialisation via JDBC (critical 9.8)
- [CVE-2022-45135](https://insights.sbomify.com/CVE-2022-45135/): Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction (critical 9.8)
- [CVE-2022-45134](https://insights.sbomify.com/CVE-2022-45134/): Deserialization in mahara:mahara (critical 9.8)
- [CVE-2022-45133](https://insights.sbomify.com/CVE-2022-45133/): File upload in mahara:mahara (medium 6.5)
- [CVE-2022-45132](https://insights.sbomify.com/CVE-2022-45132/): Code injection in linaro:lava (critical 9.8)
- [CVE-2022-45130](https://insights.sbomify.com/CVE-2022-45130/): Cross-site request forgery in plesk:obsidian (medium 6.5)
- [CVE-2022-4513](https://insights.sbomify.com/CVE-2022-4513/): European Environment Agency eionet.contreg cross site scripting (low 3.5)
- [CVE-2022-45129](https://insights.sbomify.com/CVE-2022-45129/): Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF (high 7.5)
- [CVE-2022-45128](https://insights.sbomify.com/CVE-2022-45128/): Missing authorization in Intel(R) EMA software (medium 5.0)
- [CVE-2022-45127](https://insights.sbomify.com/CVE-2022-45127/): CVE-2022-45127 (high 8.1)
- [CVE-2022-45126](https://insights.sbomify.com/CVE-2022-45126/): Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime. (medium 4.0)
- [CVE-2022-45124](https://insights.sbomify.com/CVE-2022-45124/): Information disclosure in KingHistorian (high 7.5)
- [CVE-2022-45122](https://insights.sbomify.com/CVE-2022-45122/): Cross-site scripting in Movable Type (medium 6.1)
- [CVE-2022-45121](https://insights.sbomify.com/CVE-2022-45121/): CVE-2022-45121 (medium 5.5)
- [CVE-2022-4512](https://insights.sbomify.com/CVE-2022-4512/): Better Font Awesome < 2.0.4 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2022-45118](https://insights.sbomify.com/CVE-2022-45118/): Telephony in communication subsystem sends public events with personal data, but the permission is not set. (medium 6.2)
- [CVE-2022-45115](https://insights.sbomify.com/CVE-2022-45115/): Memory corruption in Ichitaro (high 7.8)
- [CVE-2022-45113](https://insights.sbomify.com/CVE-2022-45113/): Other in Movable Type (medium 6.5)
- [CVE-2022-45112](https://insights.sbomify.com/CVE-2022-45112/): Privilege escalation in Intel(R) VROC software (high 7.3)
- [CVE-2022-4511](https://insights.sbomify.com/CVE-2022-4511/): RainyGao DocSys path traversal (medium 5.3)
- [CVE-2022-45109](https://insights.sbomify.com/CVE-2022-45109/): Information disclosure in Intel Unison software (low 3.3)
- [CVE-2022-45104](https://insights.sbomify.com/CVE-2022-45104/): Command injection in Unisphere for PowerMax vApp (high 8.8)
- [CVE-2022-45103](https://insights.sbomify.com/CVE-2022-45103/): Information disclosure in Unisphere for PowerMax vApp (medium 6.5)
- [CVE-2022-45102](https://insights.sbomify.com/CVE-2022-45102/): Other in Data Protection Central (medium 5.4)
- [CVE-2022-45101](https://insights.sbomify.com/CVE-2022-45101/): Privilege escalation in PowerScale OneFS (high 7.3)
- [CVE-2022-45100](https://insights.sbomify.com/CVE-2022-45100/): Security feature bypass in PowerScale OneFS (high 8.1)
- [CVE-2022-4510](https://insights.sbomify.com/CVE-2022-4510/): Path Traversal in binwalk (high 7.8)
- [CVE-2022-45099](https://insights.sbomify.com/CVE-2022-45099/): Weak cryptography in PowerScale OneFS (high 7.8)
- [CVE-2022-45098](https://insights.sbomify.com/CVE-2022-45098/): Information disclosure in PowerScale OneFS (medium 6.1)
- [CVE-2022-45097](https://insights.sbomify.com/CVE-2022-45097/): Privilege escalation in PowerScale OneFS (medium 6.3)
- [CVE-2022-45096](https://insights.sbomify.com/CVE-2022-45096/): Information disclosure in PowerScale OneFS (medium 5.4)
- [CVE-2022-45095](https://insights.sbomify.com/CVE-2022-45095/): Command injection in PowerScale OneFS (medium 6.7)
- [CVE-2022-45094](https://insights.sbomify.com/CVE-2022-45094/): Command injection in SINEC INS (high 8.4)
- [CVE-2022-45093](https://insights.sbomify.com/CVE-2022-45093/): Path traversal in SINEC INS (high 8.5)
- [CVE-2022-45092](https://insights.sbomify.com/CVE-2022-45092/): Path traversal in SINEC INS (critical 9.9)
- [CVE-2022-45091](https://insights.sbomify.com/CVE-2022-45091/): Cross-site Scripting in Smartpower Web (medium 5.4)
- [CVE-2022-45090](https://insights.sbomify.com/CVE-2022-45090/): SQL Injection in Smartpower Web (high 8.8)
- [CVE-2022-4509](https://insights.sbomify.com/CVE-2022-4509/): Content Control < 1.1.10 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45089](https://insights.sbomify.com/CVE-2022-45089/): SQL Injection in Smartpower Web (high 8.8)
- [CVE-2022-45088](https://insights.sbomify.com/CVE-2022-45088/): Local File Inclusion in Smartpower Web (critical 9.8)
- [CVE-2022-45087](https://insights.sbomify.com/CVE-2022-45087/): Cross-site Scripting in Smartpower Web (medium 6.1)
- [CVE-2022-45086](https://insights.sbomify.com/CVE-2022-45086/): Cross-site Scripting in Smartpower Web (medium 5.4)
- [CVE-2022-45085](https://insights.sbomify.com/CVE-2022-45085/): Server-Side Request Forgery in Smartpower Web (medium 6.5)
- [CVE-2022-45084](https://insights.sbomify.com/CVE-2022-45084/): WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45083](https://insights.sbomify.com/CVE-2022-45083/): WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection (medium 6.6)
- [CVE-2022-45082](https://insights.sbomify.com/CVE-2022-45082/): WordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (low 3.4)
- [CVE-2022-45080](https://insights.sbomify.com/CVE-2022-45080/): WordPress Add Multiple Marker Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-4508](https://insights.sbomify.com/CVE-2022-4508/): ConvertKit < 2.0.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45079](https://insights.sbomify.com/CVE-2022-45079/): WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.7)
- [CVE-2022-45078](https://insights.sbomify.com/CVE-2022-45078/): WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection (medium 5.9)
- [CVE-2022-45077](https://insights.sbomify.com/CVE-2022-45077/): WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability (medium 6.3)
- [CVE-2022-45076](https://insights.sbomify.com/CVE-2022-45076/): WordPress Flexible Elementor Panel Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45074](https://insights.sbomify.com/CVE-2022-45074/): WordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45073](https://insights.sbomify.com/CVE-2022-45073/): WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-45072](https://insights.sbomify.com/CVE-2022-45072/): WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-45071](https://insights.sbomify.com/CVE-2022-45071/): WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-45070](https://insights.sbomify.com/CVE-2022-45070/): WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability (medium 5.3)
- [CVE-2022-4507](https://insights.sbomify.com/CVE-2022-4507/): Real Cookie Banner < 3.4.10 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-45069](https://insights.sbomify.com/CVE-2022-45069/): WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability (medium 6.3)
- [CVE-2022-45068](https://insights.sbomify.com/CVE-2022-45068/): WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45067](https://insights.sbomify.com/CVE-2022-45067/): WordPress Exclusive Addons Elementor Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-45066](https://insights.sbomify.com/CVE-2022-45066/): WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-45065](https://insights.sbomify.com/CVE-2022-45065/): WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.20 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-45064](https://insights.sbomify.com/CVE-2022-45064/): Apache Sling Engine: Include-based XSS (high 8.0)
- [CVE-2022-45063](https://insights.sbomify.com/CVE-2022-45063/): Command injection in fedoraproject:fedora (critical 9.8)
- [CVE-2022-45062](https://insights.sbomify.com/CVE-2022-45062/): Command injection in debian:debian linux (critical 9.8)
- [CVE-2022-45061](https://insights.sbomify.com/CVE-2022-45061/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2022-45060](https://insights.sbomify.com/CVE-2022-45060/): Other in debian:debian linux (high 7.5)
- [CVE-2022-4506](https://insights.sbomify.com/CVE-2022-4506/): Unrestricted Upload of File with Dangerous Type in openemr/openemr (high 7.6)
- [CVE-2022-45059](https://insights.sbomify.com/CVE-2022-45059/): Other in fedoraproject:fedora (high 7.5)
- [CVE-2022-45052](https://insights.sbomify.com/CVE-2022-45052/): Local File Inclusion in Axiell Iguana CMS (high 8.8)
- [CVE-2022-45051](https://insights.sbomify.com/CVE-2022-45051/): Reflected POST XSS in Axiell Iguana CMS (medium 6.1)
- [CVE-2022-45050](https://insights.sbomify.com/CVE-2022-45050/): Reflected XSS in Axiell Iguana CMS (medium 6.1)
- [CVE-2022-4505](https://insights.sbomify.com/CVE-2022-4505/): Authorization Bypass Through User-Controlled Key in openemr/openemr (high 8.8)
- [CVE-2022-45049](https://insights.sbomify.com/CVE-2022-45049/): Reflected XSS in Axiell Iguana CMS (medium 6.1)
- [CVE-2022-45048](https://insights.sbomify.com/CVE-2022-45048/): Apache Ranger: code execution vulnerability in policy expressions (high 8.4)
- [CVE-2022-45047](https://insights.sbomify.com/CVE-2022-45047/): Apache MINA SSHD: Java unsafe deserialization vulnerability (critical 9.8)
- [CVE-2022-45045](https://insights.sbomify.com/CVE-2022-45045/): Command injection in xiongmaitech:mbd6304t (high 8.8)
- [CVE-2022-45044](https://insights.sbomify.com/CVE-2022-45044/): Denial of service in SIPROTEC 5 6MD84 (CP300) (medium 5.3)
- [CVE-2022-45043](https://insights.sbomify.com/CVE-2022-45043/): Command injection in tenda:ax12 firmware (high 8.8)
- [CVE-2022-45041](https://insights.sbomify.com/CVE-2022-45041/): SQL Injection exits in xinhu < 2.5.0 (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/216/