# Vulnerabilities published in 2022


- [CVE-2022-44002](https://insights.sbomify.com/CVE-2022-44002/): Cross-site scripting in backclick:backclick (medium 6.1)
- [CVE-2022-44001](https://insights.sbomify.com/CVE-2022-44001/): Auth bypass in backclick:backclick (critical 9.8)
- [CVE-2022-44000](https://insights.sbomify.com/CVE-2022-44000/): Command injection in backclick:backclick (critical 9.8)
- [CVE-2022-4400](https://insights.sbomify.com/CVE-2022-4400/): zbl1996 FS-Blog Title cross site scripting (low 3.5)
- [CVE-2022-43999](https://insights.sbomify.com/CVE-2022-43999/): Missing authorization in backclick:backclick (critical 9.8)
- [CVE-2022-43997](https://insights.sbomify.com/CVE-2022-43997/): Privilege escalation in aternity:aternity (high 7.8)
- [CVE-2022-43996](https://insights.sbomify.com/CVE-2022-43996/): csaf-poc/csaf_distribution Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2022-43995](https://insights.sbomify.com/CVE-2022-43995/): Memory corruption in sudo project:sudo (high 7.1)
- [CVE-2022-43990](https://insights.sbomify.com/CVE-2022-43990/): Auth bypass in SICK SIM1012 (high 7.3)
- [CVE-2022-4399](https://insights.sbomify.com/CVE-2022-4399/): TicklishHoneyBee nodau db.c sql injection (medium 5.5)
- [CVE-2022-43989](https://insights.sbomify.com/CVE-2022-43989/): Auth bypass in SICK SIM2x00 (ARM) (high 7.3)
- [CVE-2022-43985](https://insights.sbomify.com/CVE-2022-43985/): Apache Airflow prior to 2.4.2 has an open redirect (medium 6.1)
- [CVE-2022-43984](https://insights.sbomify.com/CVE-2022-43984/): Browsershot 3.57.3 - Server Side XSS to LFR via HTML (high 8.2)
- [CVE-2022-43983](https://insights.sbomify.com/CVE-2022-43983/): Browsershot 3.57.2 - Server Side XSS to LFR via HTML (high 8.2)
- [CVE-2022-43982](https://insights.sbomify.com/CVE-2022-43982/): Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL (medium 6.1)
- [CVE-2022-43980](https://insights.sbomify.com/CVE-2022-43980/): Cross-site scripting vulnerability in the network maps edit functionality (medium 5.2)
- [CVE-2022-4398](https://insights.sbomify.com/CVE-2022-4398/): Integer Overflow or Wraparound in radareorg/radare2 (medium 6.1)
- [CVE-2022-43979](https://insights.sbomify.com/CVE-2022-43979/): Path Traversal leading to Local File Inclusion (medium 5.9)
- [CVE-2022-43978](https://insights.sbomify.com/CVE-2022-43978/): Limited Authentication bypass due to hardcoded secret (medium 5.6)
- [CVE-2022-43977](https://insights.sbomify.com/CVE-2022-43977/): Missing authorization in ge:ms 3000 firmware (critical 9.8)
- [CVE-2022-43976](https://insights.sbomify.com/CVE-2022-43976/): Missing authorization in ge:ms 3000 firmware (critical 9.8)
- [CVE-2022-43975](https://insights.sbomify.com/CVE-2022-43975/): Path traversal in ge:ms 3000 firmware (high 7.5)
- [CVE-2022-43974](https://insights.sbomify.com/CVE-2022-43974/): Integer overflow in matrixssl:matrixssl (high 8.1)
- [CVE-2022-43973](https://insights.sbomify.com/CVE-2022-43973/): Arbitrary code execution in Linksys WRT54GL (high 7.2)
- [CVE-2022-43972](https://insights.sbomify.com/CVE-2022-43972/): Null pointer dereference in Linksys WRT54GL (medium 6.5)
- [CVE-2022-43971](https://insights.sbomify.com/CVE-2022-43971/): Arbitrary code execution in Linksys WUMC710 (high 7.2)
- [CVE-2022-43970](https://insights.sbomify.com/CVE-2022-43970/): Buffer overflow in Linksys WRT54GL (high 7.2)
- [CVE-2022-4397](https://insights.sbomify.com/CVE-2022-4397/): morontt zend-blog-number-2 Comment Comment.php cross-site request forgery (medium 4.3)
- [CVE-2022-43969](https://insights.sbomify.com/CVE-2022-43969/): Information disclosure in ricoh:im 2500 firmware (critical 9.1)
- [CVE-2022-43968](https://insights.sbomify.com/CVE-2022-43968/): Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons (medium 6.1)
- [CVE-2022-43967](https://insights.sbomify.com/CVE-2022-43967/): Concrete CMS vulnerable to Cross-site Scripting via multilingual report (medium 6.1)
- [CVE-2022-4396](https://insights.sbomify.com/CVE-2022-4396/): RDFlib pyrdfa3 __init__.py _get_option cross site scripting (low 3.5)
- [CVE-2022-43959](https://insights.sbomify.com/CVE-2022-43959/): Information disclosure in bitrix24:bitrix24 (medium 4.9)
- [CVE-2022-43958](https://insights.sbomify.com/CVE-2022-43958/): Weak cryptography in QMS Automotive (high 7.6)
- [CVE-2022-43955](https://insights.sbomify.com/CVE-2022-43955/): Cross-site scripting in FortiWeb (high 8.0)
- [CVE-2022-43954](https://insights.sbomify.com/CVE-2022-43954/): Information disclosure in FortiPortal (medium 4.1)
- [CVE-2022-43953](https://insights.sbomify.com/CVE-2022-43953/): Memory corruption in FortiOS (medium 6.3)
- [CVE-2022-43952](https://insights.sbomify.com/CVE-2022-43952/): Cross-site scripting in FortiADC (low 3.3)
- [CVE-2022-43951](https://insights.sbomify.com/CVE-2022-43951/): Information disclosure in FortiNAC (medium 4.8)
- [CVE-2022-43950](https://insights.sbomify.com/CVE-2022-43950/): Open redirect in FortiNAC (low 3.9)
- [CVE-2022-4395](https://insights.sbomify.com/CVE-2022-4395/): Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2022-43949](https://insights.sbomify.com/CVE-2022-43949/): Weak cryptography in FortiSIEM (medium 5.9)
- [CVE-2022-43948](https://insights.sbomify.com/CVE-2022-43948/): Command injection in FortiADC (medium 6.5)
- [CVE-2022-43947](https://insights.sbomify.com/CVE-2022-43947/): Auth bypass in FortiOS (medium 4.7)
- [CVE-2022-43946](https://insights.sbomify.com/CVE-2022-43946/): Race condition in FortiClientWindows (high 7.3)
- [CVE-2022-43945](https://insights.sbomify.com/CVE-2022-43945/): Memory corruption in linux kernel (high 7.5)
- [CVE-2022-43941](https://insights.sbomify.com/CVE-2022-43941/): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (high 7.1)
- [CVE-2022-43940](https://insights.sbomify.com/CVE-2022-43940/): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (high 8.8)
- [CVE-2022-4394](https://insights.sbomify.com/CVE-2022-4394/): iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-43939](https://insights.sbomify.com/CVE-2022-43939/): Hitachi Vantara Pentaho BA Server Authorization Bypass (high 8.6, exploited in the wild)
- [CVE-2022-43938](https://insights.sbomify.com/CVE-2022-43938/): Code injection in Pentaho Business Analytics Server (high 8.8)
- [CVE-2022-43937](https://insights.sbomify.com/CVE-2022-43937/): Brocade SANnav Information Disclosure Vulnerability (medium 5.7)
- [CVE-2022-43936](https://insights.sbomify.com/CVE-2022-43936/): Brocade Fabric OS switch passwords when debugging is enabled (medium 6.8)
- [CVE-2022-43935](https://insights.sbomify.com/CVE-2022-43935/): Switch passwords and authorization IDs are printed in the embedded MLS DB file (medium 5.3)
- [CVE-2022-43934](https://insights.sbomify.com/CVE-2022-43934/): Weak Key-exchange algorithms (medium 6.5)
- [CVE-2022-43933](https://insights.sbomify.com/CVE-2022-43933/): configuration secrets are logged in support-save (medium 4.4)
- [CVE-2022-43932](https://insights.sbomify.com/CVE-2022-43932/): Path traversal in Synology Router Manager (SRM) (high 7.5)
- [CVE-2022-43931](https://insights.sbomify.com/CVE-2022-43931/): Memory corruption in VPN Plus Server (critical 10.0)
- [CVE-2022-43930](https://insights.sbomify.com/CVE-2022-43930/): IBM Db2 for Linux, UNIX and Windows information disclosure (medium 6.2)
- [CVE-2022-4393](https://insights.sbomify.com/CVE-2022-4393/): ImageLinks Interactive Image Builder for WordPress <= 1.5.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-43929](https://insights.sbomify.com/CVE-2022-43929/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 4.9)
- [CVE-2022-43928](https://insights.sbomify.com/CVE-2022-43928/): IBM Db2 Mirror for i information disclosure (medium 4.9)
- [CVE-2022-43927](https://insights.sbomify.com/CVE-2022-43927/): IBM Db2 for Linux, UNIX and Windows information disclosure (medium 5.9)
- [CVE-2022-43923](https://insights.sbomify.com/CVE-2022-43923/): Information disclosure in Maximo Application Suite (medium 6.2)
- [CVE-2022-43922](https://insights.sbomify.com/CVE-2022-43922/): IBM App Connect Enterprise Certified Container information disclosure (medium 5.3)
- [CVE-2022-43920](https://insights.sbomify.com/CVE-2022-43920/): IBM Sterling B2B Integrator Standard Edition privilege escalation (medium 6.3)
- [CVE-2022-4392](https://insights.sbomify.com/CVE-2022-4392/): iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-43919](https://insights.sbomify.com/CVE-2022-43919/): IBM MQ denial of service (medium 5.3)
- [CVE-2022-43917](https://insights.sbomify.com/CVE-2022-43917/): IBM WebSphere Application Server information disclosure (medium 5.9)
- [CVE-2022-43916](https://insights.sbomify.com/CVE-2022-43916/): IBM App Connect Enterprise Certified Container improper communications restriction (medium 6.8)
- [CVE-2022-43915](https://insights.sbomify.com/CVE-2022-43915/): IBM App Connect Enterprise Certified Container (medium 6.8)
- [CVE-2022-43914](https://insights.sbomify.com/CVE-2022-43914/): IBM TRIRIGA Application Platform cross-site scripting (medium 4.6)
- [CVE-2022-43910](https://insights.sbomify.com/CVE-2022-43910/): IBM Security Guardium privilege escalation (high 8.4)
- [CVE-2022-4391](https://insights.sbomify.com/CVE-2022-4391/): Vision Interactive For WordPress <= 1.5.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-43909](https://insights.sbomify.com/CVE-2022-43909/): IBM Security Guardium cross-site scripting (medium 4.6)
- [CVE-2022-43908](https://insights.sbomify.com/CVE-2022-43908/): IBM Security Guardium denial of service (medium 4.3)
- [CVE-2022-43907](https://insights.sbomify.com/CVE-2022-43907/): IBM Security Guardium command execution (high 7.2)
- [CVE-2022-43906](https://insights.sbomify.com/CVE-2022-43906/): IBM Security Guardium information disclosure (low 3.1)
- [CVE-2022-43904](https://insights.sbomify.com/CVE-2022-43904/): IBM Security Guardium information disclosure (high 7.5)
- [CVE-2022-43903](https://insights.sbomify.com/CVE-2022-43903/): IBM Security Guardium denial of service (medium 4.3)
- [CVE-2022-43902](https://insights.sbomify.com/CVE-2022-43902/): IBM MQ denial of service (medium 6.5)
- [CVE-2022-43901](https://insights.sbomify.com/CVE-2022-43901/): IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps information disclosure (medium 5.7)
- [CVE-2022-43900](https://insights.sbomify.com/CVE-2022-43900/): IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps security bypass (medium 5.3)
- [CVE-2022-4390](https://insights.sbomify.com/CVE-2022-4390/): Misconfiguration in NETGEAR Nighthawk RAX30 (critical 10.0)
- [CVE-2022-43893](https://insights.sbomify.com/CVE-2022-43893/): IBM Security Verify Privilege denial of service (low 2.7)
- [CVE-2022-43892](https://insights.sbomify.com/CVE-2022-43892/): IBM Security Verify Privilege information disclosure (low 3.7)
- [CVE-2022-43891](https://insights.sbomify.com/CVE-2022-43891/): IBM Security Verify Privilege information disclosure (low 2.7)
- [CVE-2022-43890](https://insights.sbomify.com/CVE-2022-43890/): IBM Security Verify Privilege On-Premises information disclosure (medium 5.3)
- [CVE-2022-43889](https://insights.sbomify.com/CVE-2022-43889/): IBM Security Verify Privilege information disclosure (medium 5.3)
- [CVE-2022-43887](https://insights.sbomify.com/CVE-2022-43887/): IBM Cognos Analytics information disclosure (medium 5.3)
- [CVE-2022-43883](https://insights.sbomify.com/CVE-2022-43883/): IBM Cognos Analytics data manipulation (medium 6.5)
- [CVE-2022-43880](https://insights.sbomify.com/CVE-2022-43880/): IBM QRadar WinCollect Agent (medium 4.4)
- [CVE-2022-43877](https://insights.sbomify.com/CVE-2022-43877/): IBM UrbanCode Deploy (UCD) information disclosure (medium 5.1)
- [CVE-2022-43875](https://insights.sbomify.com/CVE-2022-43875/): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms denial of service (medium 6.2)
- [CVE-2022-43874](https://insights.sbomify.com/CVE-2022-43874/): IBM App Connect Enterprise Certified Container (medium 6.1)
- [CVE-2022-43873](https://insights.sbomify.com/CVE-2022-43873/): IBM Spectrum Virtualize privilege escalation (medium 6.3)
- [CVE-2022-43872](https://insights.sbomify.com/CVE-2022-43872/): IBM Financial Transaction Manager information disclosure (medium 5.3)
- [CVE-2022-43871](https://insights.sbomify.com/CVE-2022-43871/): IBM Financial Transaction Manager for SWIFT Services cross-site scripting (medium 4.6)
- [CVE-2022-43870](https://insights.sbomify.com/CVE-2022-43870/): IBM Spectrum Virtualize information disclosure (medium 6.5)
- [CVE-2022-43869](https://insights.sbomify.com/CVE-2022-43869/): IBM Spectrum Scale denial of service (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/223/