# Vulnerabilities published in 2022


- [CVE-2022-43868](https://insights.sbomify.com/CVE-2022-43868/): IBM Security Verify Access information disclosure (medium 5.3)
- [CVE-2022-43867](https://insights.sbomify.com/CVE-2022-43867/): IBM Spectrum Scale command execution (high 7.8)
- [CVE-2022-43866](https://insights.sbomify.com/CVE-2022-43866/): IBM Maximo Asset Management cross-site scripting (medium 5.4)
- [CVE-2022-43864](https://insights.sbomify.com/CVE-2022-43864/): IBM Business Automation Workflow information disclosure (high 7.5)
- [CVE-2022-43863](https://insights.sbomify.com/CVE-2022-43863/): IBM QRadar SIEM privilege escalation (medium 6.7)
- [CVE-2022-43860](https://insights.sbomify.com/CVE-2022-43860/): IBM Navigator for i SQL injection (medium 4.3)
- [CVE-2022-4386](https://insights.sbomify.com/CVE-2022-4386/): Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRF (medium 4.3)
- [CVE-2022-43859](https://insights.sbomify.com/CVE-2022-43859/): IBM Navigator for i SQL injection (medium 6.3)
- [CVE-2022-43858](https://insights.sbomify.com/CVE-2022-43858/): IBM Navigator for i information disclosure (medium 4.3)
- [CVE-2022-43857](https://insights.sbomify.com/CVE-2022-43857/): IBM Navigator for i information disclosure (medium 4.3)
- [CVE-2022-43855](https://insights.sbomify.com/CVE-2022-43855/): IBM SPSS Statistics denial of service (medium 6.2)
- [CVE-2022-43852](https://insights.sbomify.com/CVE-2022-43852/): IBM Aspera Console information disclosure (medium 5.3)
- [CVE-2022-43851](https://insights.sbomify.com/CVE-2022-43851/): IBM Aspera Console information disclosure (medium 5.9)
- [CVE-2022-43850](https://insights.sbomify.com/CVE-2022-43850/): IBM Aspera Console cross-site scripting (medium 5.4)
- [CVE-2022-4385](https://insights.sbomify.com/CVE-2022-4385/): Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update (medium 4.3)
- [CVE-2022-43849](https://insights.sbomify.com/CVE-2022-43849/): IBM AIX denial of service (medium 6.2)
- [CVE-2022-43848](https://insights.sbomify.com/CVE-2022-43848/): IBM AIX denial of service (medium 6.2)
- [CVE-2022-43847](https://insights.sbomify.com/CVE-2022-43847/): IBM Aspera Console HTTP header injection (medium 5.4)
- [CVE-2022-43845](https://insights.sbomify.com/CVE-2022-43845/): IBM Aspera Console information disclosure (low 3.7)
- [CVE-2022-43844](https://insights.sbomify.com/CVE-2022-43844/): IBM Robotic Process Automation for Cloud Pak session fixation (high 8.8)
- [CVE-2022-43843](https://insights.sbomify.com/CVE-2022-43843/): IBM Spectrum Scale information disclosure (medium 5.9)
- [CVE-2022-43842](https://insights.sbomify.com/CVE-2022-43842/): IBM Aspera Console SQL injection (high 8.6)
- [CVE-2022-43841](https://insights.sbomify.com/CVE-2022-43841/): IBM Aspera Console information disclosure (medium 4.0)
- [CVE-2022-43840](https://insights.sbomify.com/CVE-2022-43840/): IBM Aspera Console XPath injection (medium 4.3)
- [CVE-2022-4384](https://insights.sbomify.com/CVE-2022-4384/): Stream < 3.9.2 - Subscriber+ Alert Creation (medium 6.5)
- [CVE-2022-43831](https://insights.sbomify.com/CVE-2022-43831/): IBM Spectrum Scale privilege escalation (high 7.4)
- [CVE-2022-4383](https://insights.sbomify.com/CVE-2022-4383/): CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-4382](https://insights.sbomify.com/CVE-2022-4382/): Use after free in Linux kernel (medium 6.4)
- [CVE-2022-4381](https://insights.sbomify.com/CVE-2022-4381/): Popup Maker < 1.16.9 - Contributor+ Stored XSS via Subscription Form (medium 5.4)
- [CVE-2022-4379](https://insights.sbomify.com/CVE-2022-4379/): Use after free in Linux kernel (high 7.5)
- [CVE-2022-43782](https://insights.sbomify.com/CVE-2022-43782/): Misconfiguration in Crowd Data Center (critical 9.8)
- [CVE-2022-43781](https://insights.sbomify.com/CVE-2022-43781/): Command injection in Bitbucket Data Center (critical 9.8)
- [CVE-2022-43780](https://insights.sbomify.com/CVE-2022-43780/): Denial of service in Certain HP ENVY, OfficeJet, and DeskJet printers (high 7.5)
- [CVE-2022-4378](https://insights.sbomify.com/CVE-2022-4378/): Memory corruption in kernel (high 7.8)
- [CVE-2022-43779](https://insights.sbomify.com/CVE-2022-43779/): Race condition in HP PC products using AMI UEFI Firmware (high 7.0)
- [CVE-2022-43778](https://insights.sbomify.com/CVE-2022-43778/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-43777](https://insights.sbomify.com/CVE-2022-43777/): Race condition in HP PC BIOS (high 7.8)
- [CVE-2022-43776](https://insights.sbomify.com/CVE-2022-43776/): Server-side request forgery in Metabase (medium 6.5)
- [CVE-2022-43775](https://insights.sbomify.com/CVE-2022-43775/): SQL injection in Delta Electronics DIAEnergie (critical 9.8)
- [CVE-2022-43774](https://insights.sbomify.com/CVE-2022-43774/): SQL injection in Delta Electronics DIAEnergie (critical 9.8)
- [CVE-2022-43773](https://insights.sbomify.com/CVE-2022-43773/): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource (high 8.8)
- [CVE-2022-43772](https://insights.sbomify.com/CVE-2022-43772/): Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File (low 3.8)
- [CVE-2022-43771](https://insights.sbomify.com/CVE-2022-43771/): Path traversal in Pentaho Business Analytics Server (medium 6.5)
- [CVE-2022-43770](https://insights.sbomify.com/CVE-2022-43770/): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (medium 5.4)
- [CVE-2022-4377](https://insights.sbomify.com/CVE-2022-4377/): S-CMS Contact Information Page cross site scripting (low 3.5)
- [CVE-2022-43769](https://insights.sbomify.com/CVE-2022-43769/): Hitachi Vantara Pentaho BA Server Special Element Injection (high 8.8, exploited in the wild)
- [CVE-2022-43768](https://insights.sbomify.com/CVE-2022-43768/): Denial of service in SIMATIC CP 1242-7 V2 (high 7.5)
- [CVE-2022-43767](https://insights.sbomify.com/CVE-2022-43767/): Denial of service in SIMATIC CP 1242-7 V2 (high 7.5)
- [CVE-2022-43766](https://insights.sbomify.com/CVE-2022-43766/): Apache IoTDB prior to 0.13.3 allows DoS (high 7.5)
- [CVE-2022-43765](https://insights.sbomify.com/CVE-2022-43765/): DoS in APROLs Tbase server (high 7.5)
- [CVE-2022-43764](https://insights.sbomify.com/CVE-2022-43764/): Buffer overflow when changing configuration on Tbase Server (critical 9.8)
- [CVE-2022-43763](https://insights.sbomify.com/CVE-2022-43763/): Lack of checking preconditions in APROL (high 7.5)
- [CVE-2022-43762](https://insights.sbomify.com/CVE-2022-43762/): Memory leak when receiving messages in APROL Tbase server (high 7.5)
- [CVE-2022-43761](https://insights.sbomify.com/CVE-2022-43761/): Lack of authentication when managing APROL database (critical 9.4)
- [CVE-2022-43760](https://insights.sbomify.com/CVE-2022-43760/): Rancher UI has multiple Cross-Site Scripting (XSS) issues (high 8.4)
- [CVE-2022-4376](https://insights.sbomify.com/CVE-2022-4376/): Information disclosure in GitLab (low 3.1)
- [CVE-2022-43759](https://insights.sbomify.com/CVE-2022-43759/): Rancher: Privilege escalation via promoted roles (high 7.2)
- [CVE-2022-43758](https://insights.sbomify.com/CVE-2022-43758/): Rancher: Command injection in Git package (high 7.6)
- [CVE-2022-43757](https://insights.sbomify.com/CVE-2022-43757/): Rancher: Exposure of sensitive fields (critical 9.9)
- [CVE-2022-43756](https://insights.sbomify.com/CVE-2022-43756/): Rancher/Wrangler: Denial of service when processing Git credentials (medium 5.9)
- [CVE-2022-43755](https://insights.sbomify.com/CVE-2022-43755/): Rancher: Non-random authentication token (high 7.1)
- [CVE-2022-43754](https://insights.sbomify.com/CVE-2022-43754/): SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do (low 2.6)
- [CVE-2022-43753](https://insights.sbomify.com/CVE-2022-43753/): SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownload (medium 4.3)
- [CVE-2022-43752](https://insights.sbomify.com/CVE-2022-43752/): Privilege escalation in common desktop environment project: common desktop environment (high 7.8)
- [CVE-2022-43751](https://insights.sbomify.com/CVE-2022-43751/): Privilege escalation in mcafee:total protection (high 7.8)
- [CVE-2022-43750](https://insights.sbomify.com/CVE-2022-43750/): Memory corruption in debian:debian linux (medium 6.7)
- [CVE-2022-4375](https://insights.sbomify.com/CVE-2022-4375/): Mingsoft MCMS list sql injection (medium 6.3)
- [CVE-2022-43749](https://insights.sbomify.com/CVE-2022-43749/): Privilege escalation in Presto File Server (medium 4.3)
- [CVE-2022-43748](https://insights.sbomify.com/CVE-2022-43748/): Path traversal in Presto File Server (medium 5.8)
- [CVE-2022-43747](https://insights.sbomify.com/CVE-2022-43747/): Other in baramundi:management suite (high 7.5)
- [CVE-2022-43740](https://insights.sbomify.com/CVE-2022-43740/): IBM Security Verify Access denial of service (high 7.5)
- [CVE-2022-4374](https://insights.sbomify.com/CVE-2022-4374/): Bg Bible References <= 3.8.14 - Reflected XSS (medium 6.1)
- [CVE-2022-4373](https://insights.sbomify.com/CVE-2022-4373/): Quote-O-Matic <= 1.0.5 - Admin+ SQLi (high 7.2)
- [CVE-2022-43724](https://insights.sbomify.com/CVE-2022-43724/): Information disclosure in SICAM PAS/PQS (critical 9.8)
- [CVE-2022-43723](https://insights.sbomify.com/CVE-2022-43723/): Denial of service in SICAM PAS/PQS (high 7.5)
- [CVE-2022-43722](https://insights.sbomify.com/CVE-2022-43722/): Privilege escalation in SICAM PAS/PQS (high 7.8)
- [CVE-2022-43721](https://insights.sbomify.com/CVE-2022-43721/): Apache Superset: Open Redirect Vulnerability (medium 5.4)
- [CVE-2022-43720](https://insights.sbomify.com/CVE-2022-43720/): Apache Superset: Improper rendering of user input (medium 5.4)
- [CVE-2022-4372](https://insights.sbomify.com/CVE-2022-4372/): Web Invoice <= 2.1.3 - Authenticated SQLi (high 7.2)
- [CVE-2022-43719](https://insights.sbomify.com/CVE-2022-43719/): Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API (high 8.8)
- [CVE-2022-43718](https://insights.sbomify.com/CVE-2022-43718/): Apache Superset: Cross-Site Scripting vulnerability on upload forms (medium 5.4)
- [CVE-2022-43717](https://insights.sbomify.com/CVE-2022-43717/): Apache Superset: Cross-Site Scripting on dashboards (medium 5.4)
- [CVE-2022-43716](https://insights.sbomify.com/CVE-2022-43716/): Use after free in SIMATIC CP 1242-7 V2 (high 7.5)
- [CVE-2022-43713](https://insights.sbomify.com/CVE-2022-43713/): Security feature bypass in gxsoftware:xperiencentral (high 7.5)
- [CVE-2022-43712](https://insights.sbomify.com/CVE-2022-43712/): Missing authorization in gxsoftware:xperiencentral (medium 6.5)
- [CVE-2022-43711](https://insights.sbomify.com/CVE-2022-43711/): Cross-site scripting in gxsoftware:xperiencentral (medium 6.1)
- [CVE-2022-43710](https://insights.sbomify.com/CVE-2022-43710/): Cross-site request forgery in gxsoftware:xperiencentral (high 8.8)
- [CVE-2022-4371](https://insights.sbomify.com/CVE-2022-4371/): Web Invoice <= 2.1.3 - Authenticated SQLi (high 7.2)
- [CVE-2022-43709](https://insights.sbomify.com/CVE-2022-43709/): SQL injection in mybb:mybb (medium 4.9)
- [CVE-2022-43708](https://insights.sbomify.com/CVE-2022-43708/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2022-43707](https://insights.sbomify.com/CVE-2022-43707/): Cross-site scripting in mybb:mybb (medium 6.1)
- [CVE-2022-43706](https://insights.sbomify.com/CVE-2022-43706/): Cross-site scripting in stackstorm:stackstorm (medium 5.4)
- [CVE-2022-43705](https://insights.sbomify.com/CVE-2022-43705/): Security feature bypass in botan project:botan (critical 9.1)
- [CVE-2022-43704](https://insights.sbomify.com/CVE-2022-43704/): Auth bypass in sinilink:xy-wft1 firmware (medium 5.9)
- [CVE-2022-43703](https://insights.sbomify.com/CVE-2022-43703/): Incomplete verification of installation file signature (high 7.8)
- [CVE-2022-43702](https://insights.sbomify.com/CVE-2022-43702/): Incomplete verification of installation file signature (high 7.8)
- [CVE-2022-43701](https://insights.sbomify.com/CVE-2022-43701/): Insecure directory permissions on installer files (high 7.8)
- [CVE-2022-4370](https://insights.sbomify.com/CVE-2022-4370/): Multimedial Images <= 1.0b - Admin+ SQLi (high 7.2)
- [CVE-2022-43699](https://insights.sbomify.com/CVE-2022-43699/): Server-side request forgery in open-xchange:ox app suite (medium 4.3)
- [CVE-2022-43698](https://insights.sbomify.com/CVE-2022-43698/): Server-side request forgery in open-xchange:ox app suite (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/224/