# Vulnerabilities published in 2022


- [CVE-2022-44669](https://insights.sbomify.com/CVE-2022-44669/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-44668](https://insights.sbomify.com/CVE-2022-44668/): Windows Media Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-44667](https://insights.sbomify.com/CVE-2022-44667/): Windows Media Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-44666](https://insights.sbomify.com/CVE-2022-44666/): Windows Contacts Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-4466](https://insights.sbomify.com/CVE-2022-4466/): WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-44654](https://insights.sbomify.com/CVE-2022-44654/): Memory corruption in Trend Micro Apex One (high 7.5)
- [CVE-2022-44653](https://insights.sbomify.com/CVE-2022-44653/): Path traversal in Trend Micro Apex One (high 7.8)
- [CVE-2022-44652](https://insights.sbomify.com/CVE-2022-44652/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-44651](https://insights.sbomify.com/CVE-2022-44651/): Race condition in Trend Micro Apex One (high 7.0)
- [CVE-2022-44650](https://insights.sbomify.com/CVE-2022-44650/): Memory corruption in Trend Micro Apex One (high 7.8)
- [CVE-2022-4465](https://insights.sbomify.com/CVE-2022-4465/): WP Video Lightbox < 1.9.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-44649](https://insights.sbomify.com/CVE-2022-44649/): Memory corruption in Trend Micro Apex One (high 7.8)
- [CVE-2022-44648](https://insights.sbomify.com/CVE-2022-44648/): Memory corruption in Trend Micro Apex One (medium 5.5)
- [CVE-2022-44647](https://insights.sbomify.com/CVE-2022-44647/): Memory corruption in Trend Micro Apex One (medium 5.5)
- [CVE-2022-44646](https://insights.sbomify.com/CVE-2022-44646/): Other in TeamCity (low 2.2)
- [CVE-2022-44645](https://insights.sbomify.com/CVE-2022-44645/): Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability (high 8.8)
- [CVE-2022-44644](https://insights.sbomify.com/CVE-2022-44644/): Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability (medium 6.5)
- [CVE-2022-44643](https://insights.sbomify.com/CVE-2022-44643/): Access policy with access to all tenants and using label selectors has more access (medium 5.7)
- [CVE-2022-44641](https://insights.sbomify.com/CVE-2022-44641/): XML external entity in debian:debian linux (medium 6.5)
- [CVE-2022-44640](https://insights.sbomify.com/CVE-2022-44640/): Memory corruption in heimdal project:heimdal (critical 9.8)
- [CVE-2022-4464](https://insights.sbomify.com/CVE-2022-4464/): Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-44638](https://insights.sbomify.com/CVE-2022-44638/): Integer overflow in debian:debian linux (high 8.8)
- [CVE-2022-44637](https://insights.sbomify.com/CVE-2022-44637/): Cross-site scripting in redmine:redmine (medium 6.1)
- [CVE-2022-44636](https://insights.sbomify.com/CVE-2022-44636/): Auth bypass in samsung:t-ksu2eakuc firmware (medium 4.6)
- [CVE-2022-44635](https://insights.sbomify.com/CVE-2022-44635/): Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal (high 8.8)
- [CVE-2022-44634](https://insights.sbomify.com/CVE-2022-44634/): WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability (medium 4.9)
- [CVE-2022-44633](https://insights.sbomify.com/CVE-2022-44633/): Missing authorization in YITH WooCommerce Gift Cards Premium (medium 6.5)
- [CVE-2022-44632](https://insights.sbomify.com/CVE-2022-44632/): WordPress Content Repeater – Custom Posts Simplified Plugin <= 1.1.13 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-44631](https://insights.sbomify.com/CVE-2022-44631/): WordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-44630](https://insights.sbomify.com/CVE-2022-44630/): WordPress YITH WooCommerce Product Slider Carousel plugin <= 1.16.0 - Cross-Site Request Forgery (CSRF) (medium 4.6)
- [CVE-2022-44629](https://insights.sbomify.com/CVE-2022-44629/): WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-44628](https://insights.sbomify.com/CVE-2022-44628/): WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2022-44627](https://insights.sbomify.com/CVE-2022-44627/): WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-44626](https://insights.sbomify.com/CVE-2022-44626/): WordPress Squirrly SEO (Peaks) plugin <= 12.1.20 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2022-44625](https://insights.sbomify.com/CVE-2022-44625/): WordPress Cyklodev WP Notify Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-44624](https://insights.sbomify.com/CVE-2022-44624/): Information disclosure in TeamCity (medium 6.5)
- [CVE-2022-44623](https://insights.sbomify.com/CVE-2022-44623/): Information disclosure in TeamCity (medium 6.5)
- [CVE-2022-44622](https://insights.sbomify.com/CVE-2022-44622/): Missing authorization in TeamCity (low 2.7)
- [CVE-2022-44621](https://insights.sbomify.com/CVE-2022-44621/): Apache Kylin: Command injection by Diagnosis Controller (critical 9.8)
- [CVE-2022-44620](https://insights.sbomify.com/CVE-2022-44620/): Auth bypass in UDR-JA1604/UDR-JA1608/UDR-JA1616 (high 8.8)
- [CVE-2022-4462](https://insights.sbomify.com/CVE-2022-4462/): Information disclosure in GitLab (medium 5.0)
- [CVE-2022-44619](https://insights.sbomify.com/CVE-2022-44619/): Information disclosure in Intel(R) DCM software (high 8.2)
- [CVE-2022-44617](https://insights.sbomify.com/CVE-2022-44617/): Denial of service in libXpm (high 7.5)
- [CVE-2022-44612](https://insights.sbomify.com/CVE-2022-44612/): Hardcoded credentials in Intel(R) Unison(TM) software (medium 5.5)
- [CVE-2022-44611](https://insights.sbomify.com/CVE-2022-44611/): Privilege escalation in Intel(R) Processors (medium 6.9)
- [CVE-2022-44610](https://insights.sbomify.com/CVE-2022-44610/): Auth bypass in Intel(R) DCM software (medium 5.4)
- [CVE-2022-44608](https://insights.sbomify.com/CVE-2022-44608/): Denial of service in Cybozu Remote Service (high 7.5)
- [CVE-2022-44606](https://insights.sbomify.com/CVE-2022-44606/): Command injection in UDR-JA1604/UDR-JA1608/UDR-JA1616 (high 8.8)
- [CVE-2022-4460](https://insights.sbomify.com/CVE-2022-4460/): Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-44595](https://insights.sbomify.com/CVE-2022-44595/): WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability (medium 5.3)
- [CVE-2022-44594](https://insights.sbomify.com/CVE-2022-44594/): WordPress All in One Time Clock Lite Plugin <= 1.3.320 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-44593](https://insights.sbomify.com/CVE-2022-44593/): WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerability (low 3.7)
- [CVE-2022-44591](https://insights.sbomify.com/CVE-2022-44591/): WordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-44590](https://insights.sbomify.com/CVE-2022-44590/): WordPress Simple Video Embedder plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-4459](https://insights.sbomify.com/CVE-2022-4459/): WP Show Posts < 1.1.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-44589](https://insights.sbomify.com/CVE-2022-44589/): WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure (high 8.1)
- [CVE-2022-44588](https://insights.sbomify.com/CVE-2022-44588/): WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL Injection (critical 9.9)
- [CVE-2022-44587](https://insights.sbomify.com/CVE-2022-44587/): WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2022-44586](https://insights.sbomify.com/CVE-2022-44586/): WordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-44585](https://insights.sbomify.com/CVE-2022-44585/): WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-44584](https://insights.sbomify.com/CVE-2022-44584/): WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability (critical 9.1)
- [CVE-2022-44583](https://insights.sbomify.com/CVE-2022-44583/): WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability (high 7.5)
- [CVE-2022-44582](https://insights.sbomify.com/CVE-2022-44582/): WordPress Apptivo Business Site CRM Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-44581](https://insights.sbomify.com/CVE-2022-44581/): WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability (medium 5.0)
- [CVE-2022-44580](https://insights.sbomify.com/CVE-2022-44580/): WordPress Plugin for Google Reviews Plugin <= 2.2.3 is vulnerable to SQL Injection (critical 9.1)
- [CVE-2022-4458](https://insights.sbomify.com/CVE-2022-4458/): Amr Shortcode Any Widget <= 4.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-44578](https://insights.sbomify.com/CVE-2022-44578/): WordPress Owl Carousel plugin <= 0.5.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2022-44576](https://insights.sbomify.com/CVE-2022-44576/): WordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-44575](https://insights.sbomify.com/CVE-2022-44575/): Cross-site scripting in PLM Help Server V4.2 (medium 6.1)
- [CVE-2022-44574](https://insights.sbomify.com/CVE-2022-44574/): Auth bypass in Ivanti Avalanche (high 7.5)
- [CVE-2022-44572](https://insights.sbomify.com/CVE-2022-44572/): Denial of service via multipart parsing in Rack (high 7.5)
- [CVE-2022-44571](https://insights.sbomify.com/CVE-2022-44571/): Denial of Service Vulnerability in Rack Content-Disposition parsing (high 7.5)
- [CVE-2022-44570](https://insights.sbomify.com/CVE-2022-44570/): Denial of service via header parsing in Rack (high 7.5)
- [CVE-2022-4457](https://insights.sbomify.com/CVE-2022-4457/): WARP client manifest misconfiguration leading to Task Hijacking (medium 5.5)
- [CVE-2022-44569](https://insights.sbomify.com/CVE-2022-44569/): Auth bypass in Automation (high 8.8)
- [CVE-2022-44567](https://insights.sbomify.com/CVE-2022-44567/): Command injection in Rocket.chat - Electron Desktop (critical 9.8)
- [CVE-2022-44566](https://insights.sbomify.com/CVE-2022-44566/): Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter (high 7.5)
- [CVE-2022-44565](https://insights.sbomify.com/CVE-2022-44565/): Missing authorization in UISP Wireless (medium 5.3)
- [CVE-2022-44564](https://insights.sbomify.com/CVE-2022-44564/): Path traversal in Aslan-AL10 (high 7.8)
- [CVE-2022-44563](https://insights.sbomify.com/CVE-2022-44563/): Race condition in EMUI (medium 5.9)
- [CVE-2022-44562](https://insights.sbomify.com/CVE-2022-44562/): Deserialization in EMUI (critical 9.8)
- [CVE-2022-44561](https://insights.sbomify.com/CVE-2022-44561/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-44560](https://insights.sbomify.com/CVE-2022-44560/): Open redirect in EMUI (medium 5.3)
- [CVE-2022-4456](https://insights.sbomify.com/CVE-2022-4456/): falling-fruit cross site scripting (low 3.5)
- [CVE-2022-44559](https://insights.sbomify.com/CVE-2022-44559/): Deserialization in EMUI (critical 9.8)
- [CVE-2022-44558](https://insights.sbomify.com/CVE-2022-44558/): Deserialization in EMUI (critical 9.8)
- [CVE-2022-44557](https://insights.sbomify.com/CVE-2022-44557/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-44556](https://insights.sbomify.com/CVE-2022-44556/): Other in EMUI (high 7.5)
- [CVE-2022-44555](https://insights.sbomify.com/CVE-2022-44555/): Other in EMUI (high 7.5)
- [CVE-2022-44554](https://insights.sbomify.com/CVE-2022-44554/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-44553](https://insights.sbomify.com/CVE-2022-44553/): Other in EMUI (medium 5.3)
- [CVE-2022-44552](https://insights.sbomify.com/CVE-2022-44552/): Other in EMUI (high 7.5)
- [CVE-2022-44551](https://insights.sbomify.com/CVE-2022-44551/): Race condition in EMUI (critical 9.8)
- [CVE-2022-44550](https://insights.sbomify.com/CVE-2022-44550/): Use after free in EMUI (high 7.5)
- [CVE-2022-4455](https://insights.sbomify.com/CVE-2022-4455/): sproctor php-calendar index.php cross site scripting (medium 5.1)
- [CVE-2022-44549](https://insights.sbomify.com/CVE-2022-44549/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-44548](https://insights.sbomify.com/CVE-2022-44548/): Security feature bypass in EMUI (medium 4.3)
- [CVE-2022-44547](https://insights.sbomify.com/CVE-2022-44547/): Use after free in EMUI (high 7.5)
- [CVE-2022-44546](https://insights.sbomify.com/CVE-2022-44546/): Other in EMUI (high 7.5)
- [CVE-2022-44544](https://insights.sbomify.com/CVE-2022-44544/): Command injection in mahara:mahara (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/219/