# Vulnerabilities published in 2022


- [CVE-2022-43596](https://insights.sbomify.com/CVE-2022-43596/): Information disclosure in OpenImageIO (medium 5.9)
- [CVE-2022-43595](https://insights.sbomify.com/CVE-2022-43595/): Null dereference in OpenImageIO (medium 5.9)
- [CVE-2022-43594](https://insights.sbomify.com/CVE-2022-43594/): Null dereference in OpenImageIO (medium 5.9)
- [CVE-2022-43593](https://insights.sbomify.com/CVE-2022-43593/): Null dereference in OpenImageIO (medium 5.9)
- [CVE-2022-43592](https://insights.sbomify.com/CVE-2022-43592/): Information disclosure in OpenImageIO (medium 5.9)
- [CVE-2022-43591](https://insights.sbomify.com/CVE-2022-43591/): Memory corruption in Qt (high 8.8)
- [CVE-2022-43590](https://insights.sbomify.com/CVE-2022-43590/): Null dereference in CBFS Filter (medium 6.2)
- [CVE-2022-4359](https://insights.sbomify.com/CVE-2022-4359/): WP RSS By Publishers <= 0.1 - Admin+ SQLi (high 7.2)
- [CVE-2022-43589](https://insights.sbomify.com/CVE-2022-43589/): Null dereference in CBFS Filter (medium 6.2)
- [CVE-2022-43588](https://insights.sbomify.com/CVE-2022-43588/): Null dereference in CBFS Filter (medium 6.2)
- [CVE-2022-43581](https://insights.sbomify.com/CVE-2022-43581/): IBM Content Navigator code execution (high 7.5)
- [CVE-2022-4358](https://insights.sbomify.com/CVE-2022-4358/): WP RSS By Publishers <= 0.1 - Admin+ SQLi (high 7.2)
- [CVE-2022-43579](https://insights.sbomify.com/CVE-2022-43579/): IBM Sterling B2B Integrator Standard Edition cross-site scripting (medium 4.6)
- [CVE-2022-43578](https://insights.sbomify.com/CVE-2022-43578/): IBM Sterling B2B Integrator Standard Edition cross-site scripting (medium 4.6)
- [CVE-2022-43575](https://insights.sbomify.com/CVE-2022-43575/): IBM Aspera Console cross-site scripting (medium 5.4)
- [CVE-2022-43574](https://insights.sbomify.com/CVE-2022-43574/): Misconfiguration in IBM Robotic Process Automation (high 7.5)
- [CVE-2022-43573](https://insights.sbomify.com/CVE-2022-43573/): IBM Robotic Process Automation information disclosure (low 3.1)
- [CVE-2022-43572](https://insights.sbomify.com/CVE-2022-43572/): Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise (high 7.5)
- [CVE-2022-43571](https://insights.sbomify.com/CVE-2022-43571/): Remote Code Execution through dashboard PDF generation component in Splunk Enterprise (high 8.8)
- [CVE-2022-43570](https://insights.sbomify.com/CVE-2022-43570/): XML External Entity Injection through a custom View in Splunk Enterprise (high 8.8)
- [CVE-2022-4357](https://insights.sbomify.com/CVE-2022-4357/): LetsRecover < 1.2.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-43569](https://insights.sbomify.com/CVE-2022-43569/): Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise (high 8.0)
- [CVE-2022-43568](https://insights.sbomify.com/CVE-2022-43568/): Reflected Cross-Site Scripting via the radio template in Splunk Enterprise (high 8.8)
- [CVE-2022-43567](https://insights.sbomify.com/CVE-2022-43567/): Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature (high 8.8)
- [CVE-2022-43566](https://insights.sbomify.com/CVE-2022-43566/): Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise (high 7.3)
- [CVE-2022-43565](https://insights.sbomify.com/CVE-2022-43565/): Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise (high 8.1)
- [CVE-2022-43564](https://insights.sbomify.com/CVE-2022-43564/): Denial of Service in Splunk Enterprise through search macros (medium 4.9)
- [CVE-2022-43563](https://insights.sbomify.com/CVE-2022-43563/): Risky command safeguards bypass via rex search command field names in Splunk Enterprise (high 8.1)
- [CVE-2022-43562](https://insights.sbomify.com/CVE-2022-43562/): Host Header Injection in Splunk Enterprise (low 3.0)
- [CVE-2022-43561](https://insights.sbomify.com/CVE-2022-43561/): Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise (medium 6.4)
- [CVE-2022-4356](https://insights.sbomify.com/CVE-2022-4356/): LetsRecover < 1.2.0 - Admin+ SQLi (high 7.2)
- [CVE-2022-43557](https://insights.sbomify.com/CVE-2022-43557/): BD BodyGuard™ Pumps – RS-232 Interface Vulnerability (medium 5.3)
- [CVE-2022-43556](https://insights.sbomify.com/CVE-2022-43556/): Concrete CMS vulnerable to cross-site scripting in the text input field (medium 6.1)
- [CVE-2022-43555](https://insights.sbomify.com/CVE-2022-43555/): Missing authorization in Avalanche (high 7.8)
- [CVE-2022-43554](https://insights.sbomify.com/CVE-2022-43554/): Missing authorization in Avalanche (high 7.8)
- [CVE-2022-43553](https://insights.sbomify.com/CVE-2022-43553/): Privilege escalation in EdgeMAX EdgeRouter (high 8.8)
- [CVE-2022-43552](https://insights.sbomify.com/CVE-2022-43552/): Use after free in https://github.com/curl/curl (medium 5.9)
- [CVE-2022-43551](https://insights.sbomify.com/CVE-2022-43551/): Security feature bypass in https://github.com/curl/curl (high 7.5)
- [CVE-2022-43550](https://insights.sbomify.com/CVE-2022-43550/): Command injection in https://github.com/jitsi (critical 9.8)
- [CVE-2022-4355](https://insights.sbomify.com/CVE-2022-4355/): LetsRecover < 1.2.0 - Admin+ SQLi (high 7.2)
- [CVE-2022-43549](https://insights.sbomify.com/CVE-2022-43549/): Auth bypass in Veeam Backup for Google Cloud (critical 9.8)
- [CVE-2022-43548](https://insights.sbomify.com/CVE-2022-43548/): Command injection in Node (high 8.1)
- [CVE-2022-43546](https://insights.sbomify.com/CVE-2022-43546/): Memory corruption in POWER METER SICAM Q100 (critical 9.9)
- [CVE-2022-43545](https://insights.sbomify.com/CVE-2022-43545/): Memory corruption in POWER METER SICAM Q100 (critical 9.9)
- [CVE-2022-43543](https://insights.sbomify.com/CVE-2022-43543/): Other in KDDI +Message App for Android and for iOS, NTT DOCOMO +Message App for Android and for iOS, and SoftBank +Message App for Android and for iOS (medium 5.4)
- [CVE-2022-43542](https://insights.sbomify.com/CVE-2022-43542/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-43541](https://insights.sbomify.com/CVE-2022-43541/): Command injection in Aruba EdgeConnect Enterprise Software (high 7.2)
- [CVE-2022-43540](https://insights.sbomify.com/CVE-2022-43540/): Information disclosure in Aruba ClearPass Policy Manager (medium 5.5)
- [CVE-2022-4354](https://insights.sbomify.com/CVE-2022-4354/): LinZhaoguan pb-cms Message Board comment cross site scripting (medium 4.3)
- [CVE-2022-43539](https://insights.sbomify.com/CVE-2022-43539/): Information disclosure in Aruba ClearPass Policy Manager (medium 5.7)
- [CVE-2022-43538](https://insights.sbomify.com/CVE-2022-43538/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-43537](https://insights.sbomify.com/CVE-2022-43537/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-43536](https://insights.sbomify.com/CVE-2022-43536/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2022-43535](https://insights.sbomify.com/CVE-2022-43535/): Privilege escalation in Aruba ClearPass Policy Manager (high 7.8)
- [CVE-2022-43534](https://insights.sbomify.com/CVE-2022-43534/): Privilege escalation in Aruba ClearPass Policy Manager (high 7.8)
- [CVE-2022-43533](https://insights.sbomify.com/CVE-2022-43533/): Privilege escalation in Aruba ClearPass Policy Manager (high 7.8)
- [CVE-2022-43532](https://insights.sbomify.com/CVE-2022-43532/): Cross-site scripting in Aruba ClearPass Policy Manager (high 8.0)
- [CVE-2022-43531](https://insights.sbomify.com/CVE-2022-43531/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-43530](https://insights.sbomify.com/CVE-2022-43530/): SQL injection in Aruba ClearPass Policy Manager (high 8.8)
- [CVE-2022-4353](https://insights.sbomify.com/CVE-2022-4353/): LinZhaoguan pb-cms IpUtil.getIpAddr cross site scripting (low 3.5)
- [CVE-2022-43529](https://insights.sbomify.com/CVE-2022-43529/): Auth bypass in Aruba EdgeConnect Enterprise Orchestration Software (medium 4.6)
- [CVE-2022-43528](https://insights.sbomify.com/CVE-2022-43528/): Auth bypass in Aruba EdgeConnect Enterprise Orchestration Software (medium 4.8)
- [CVE-2022-43527](https://insights.sbomify.com/CVE-2022-43527/): Cross-site scripting in Aruba EdgeConnect Enterprise Orchestration Software (medium 6.1)
- [CVE-2022-43526](https://insights.sbomify.com/CVE-2022-43526/): Cross-site scripting in Aruba EdgeConnect Enterprise Orchestration Software (medium 6.1)
- [CVE-2022-43525](https://insights.sbomify.com/CVE-2022-43525/): Cross-site scripting in Aruba EdgeConnect Enterprise Orchestration Software (medium 6.1)
- [CVE-2022-43524](https://insights.sbomify.com/CVE-2022-43524/): Cross-site scripting in Aruba EdgeConnect Enterprise Orchestration Software (high 8.7)
- [CVE-2022-43523](https://insights.sbomify.com/CVE-2022-43523/): SQL injection in Aruba EdgeConnect Enterprise Orchestration Software (high 8.8)
- [CVE-2022-43522](https://insights.sbomify.com/CVE-2022-43522/): SQL injection in Aruba EdgeConnect Enterprise Orchestration Software (high 8.8)
- [CVE-2022-43521](https://insights.sbomify.com/CVE-2022-43521/): SQL injection in Aruba EdgeConnect Enterprise Orchestration Software (high 8.8)
- [CVE-2022-43520](https://insights.sbomify.com/CVE-2022-43520/): SQL injection in Aruba EdgeConnect Enterprise Orchestration Software (high 8.8)
- [CVE-2022-4352](https://insights.sbomify.com/CVE-2022-4352/): Qe SEO Handyman <= 1.0 - Admin+ SQLi (high 7.2)
- [CVE-2022-43519](https://insights.sbomify.com/CVE-2022-43519/): SQL injection in Aruba EdgeConnect Enterprise Orchestration Software (high 8.8)
- [CVE-2022-43518](https://insights.sbomify.com/CVE-2022-43518/): Path traversal in Aruba EdgeConnect Enterprise Software (medium 4.9)
- [CVE-2022-43517](https://insights.sbomify.com/CVE-2022-43517/): Misconfiguration in Simcenter STAR-CCM+ (high 7.8)
- [CVE-2022-43516](https://insights.sbomify.com/CVE-2022-43516/): Zabbix Agent installer adds “allow all TCP any any” firewall rule (medium 6.5)
- [CVE-2022-43515](https://insights.sbomify.com/CVE-2022-43515/): X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode (medium 5.3)
- [CVE-2022-43514](https://insights.sbomify.com/CVE-2022-43514/): Path traversal in Automation License Manager V5 (high 7.7)
- [CVE-2022-43513](https://insights.sbomify.com/CVE-2022-43513/): Path traversal in Automation License Manager V5 (high 8.2)
- [CVE-2022-43512](https://insights.sbomify.com/CVE-2022-43512/): CVE-2022-43512 (medium 5.5)
- [CVE-2022-4351](https://insights.sbomify.com/CVE-2022-4351/): Qe SEO Handyman <= 1.0 - Admin+ SQLi (high 7.2)
- [CVE-2022-43509](https://insights.sbomify.com/CVE-2022-43509/): Memory corruption in CX-Programmer (high 7.8)
- [CVE-2022-43508](https://insights.sbomify.com/CVE-2022-43508/): Use after free in CX-Programmer (high 7.8)
- [CVE-2022-43507](https://insights.sbomify.com/CVE-2022-43507/): Memory corruption in Intel(R) QAT Engine for OpenSSL (high 7.5)
- [CVE-2022-43506](https://insights.sbomify.com/CVE-2022-43506/): Delta Electronics DIAEnergie SQL Injection (high 8.8)
- [CVE-2022-43505](https://insights.sbomify.com/CVE-2022-43505/): Other in Intel(R) Processors (medium 4.1)
- [CVE-2022-43504](https://insights.sbomify.com/CVE-2022-43504/): Auth bypass in WordPress (medium 5.3)
- [CVE-2022-43501](https://insights.sbomify.com/CVE-2022-43501/): Weak cryptography in Kasago IPv4 (critical 9.1)
- [CVE-2022-43500](https://insights.sbomify.com/CVE-2022-43500/): Cross-site scripting in WordPress (medium 6.1)
- [CVE-2022-4350](https://insights.sbomify.com/CVE-2022-4350/): Mingsoft MCMS search.do cross site scripting (low 3.5)
- [CVE-2022-43499](https://insights.sbomify.com/CVE-2022-43499/): Cross-site scripting in SHIRASAGI (medium 5.4)
- [CVE-2022-43497](https://insights.sbomify.com/CVE-2022-43497/): Cross-site scripting in WordPress (medium 6.1)
- [CVE-2022-43495](https://insights.sbomify.com/CVE-2022-43495/): An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot. (medium 6.5)
- [CVE-2022-43494](https://insights.sbomify.com/CVE-2022-43494/): Missing authorization in Proficy Historian (high 7.5)
- [CVE-2022-43492](https://insights.sbomify.com/CVE-2022-43492/): WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2022-43491](https://insights.sbomify.com/CVE-2022-43491/): WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-43490](https://insights.sbomify.com/CVE-2022-43490/): WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-4349](https://insights.sbomify.com/CVE-2022-4349/): CTF-hacker pwn delete.html cross-site request forgery (medium 4.3)
- [CVE-2022-43488](https://insights.sbomify.com/CVE-2022-43488/): WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-43487](https://insights.sbomify.com/CVE-2022-43487/): Cross-site scripting in Salon booking system (medium 6.1)
- [CVE-2022-43486](https://insights.sbomify.com/CVE-2022-43486/): Code injection in WCR-1166DS (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/226/