# Vulnerabilities published in 2022


- [CVE-2022-43485](https://insights.sbomify.com/CVE-2022-43485/): Insecure random number used for generating keys for signing Jwt tokens (medium 6.2)
- [CVE-2022-43484](https://insights.sbomify.com/CVE-2022-43484/): TERASOLUNA Server Framework vulnerable to ClassLoader manipulation (high 7.8)
- [CVE-2022-43483](https://insights.sbomify.com/CVE-2022-43483/): CVE-2022-43483 (critical 9.1)
- [CVE-2022-43482](https://insights.sbomify.com/CVE-2022-43482/): WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-43481](https://insights.sbomify.com/CVE-2022-43481/): WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-43480](https://insights.sbomify.com/CVE-2022-43480/): WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2022-4348](https://insights.sbomify.com/CVE-2022-4348/): y_project RuoYi-Cloud JSON cross site scripting (low 3.5)
- [CVE-2022-43479](https://insights.sbomify.com/CVE-2022-43479/): Open redirect in SHIRASAGI (medium 6.1)
- [CVE-2022-43477](https://insights.sbomify.com/CVE-2022-43477/): Information disclosure in Intel Unison software (low 3.3)
- [CVE-2022-43476](https://insights.sbomify.com/CVE-2022-43476/): WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2022-43475](https://insights.sbomify.com/CVE-2022-43475/): Information disclosure in Intel(R) DCM software (medium 6.0)
- [CVE-2022-43474](https://insights.sbomify.com/CVE-2022-43474/): Privilege escalation in DSP Builder software installer for Intel(R) FPGAs Pro Edition (medium 6.7)
- [CVE-2022-43473](https://insights.sbomify.com/CVE-2022-43473/): XML external entity in OpManager (medium 5.8)
- [CVE-2022-43472](https://insights.sbomify.com/CVE-2022-43472/): WordPress eRoom plugin <= 1.4.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-43470](https://insights.sbomify.com/CVE-2022-43470/): Cross-site request forgery in +F FS040U, +F FS020W, +F FS030W, and +F FS040W (high 7.3)
- [CVE-2022-4347](https://insights.sbomify.com/CVE-2022-4347/): xiandafu beetl-bbs WebUtils.java cross site scripting (low 3.5)
- [CVE-2022-43469](https://insights.sbomify.com/CVE-2022-43469/): Cross-site request forgery in Corona Virus (COVID-19) Banner & Live Data (medium 5.4)
- [CVE-2022-43468](https://insights.sbomify.com/CVE-2022-43468/): Business logic in WordPress Popular Posts (high 7.5)
- [CVE-2022-43467](https://insights.sbomify.com/CVE-2022-43467/): Open Babel has out-of-bounds write in PQS coord_file parser (critical 9.8)
- [CVE-2022-43466](https://insights.sbomify.com/CVE-2022-43466/): Command injection in WEX-1800AX4 (medium 6.8)
- [CVE-2022-43465](https://insights.sbomify.com/CVE-2022-43465/): Missing authorization in Intel(R) SCS software (medium 5.0)
- [CVE-2022-43464](https://insights.sbomify.com/CVE-2022-43464/): Command injection in UDR-JA1604/UDR-JA1608/UDR-JA1616 (high 8.8)
- [CVE-2022-43463](https://insights.sbomify.com/CVE-2022-43463/): WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-43462](https://insights.sbomify.com/CVE-2022-43462/): WordPress IP Blacklist Cloud Plugin <= 5.00 is vulnerable to SQL Injection (SQLi) vulnerability (critical 9.1)
- [CVE-2022-43461](https://insights.sbomify.com/CVE-2022-43461/): WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-43460](https://insights.sbomify.com/CVE-2022-43460/): Weak cryptography in Driver Distributor (high 7.5)
- [CVE-2022-4346](https://insights.sbomify.com/CVE-2022-4346/): All In One WP Security & Firewall < 5.1.3 - Configuration Leak (medium 5.3)
- [CVE-2022-43459](https://insights.sbomify.com/CVE-2022-43459/): WordPress Forms by CaptainForm Plugin <= 2.5.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-43458](https://insights.sbomify.com/CVE-2022-43458/): WordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (medium 4.1)
- [CVE-2022-43457](https://insights.sbomify.com/CVE-2022-43457/): Delta Electronics DIAEnergie SQL Injection (high 8.8)
- [CVE-2022-43456](https://insights.sbomify.com/CVE-2022-43456/): Privilege escalation in Intel(R) RST software (medium 6.7)
- [CVE-2022-43455](https://insights.sbomify.com/CVE-2022-43455/): CVE-2022-43455 (medium 5.5)
- [CVE-2022-43454](https://insights.sbomify.com/CVE-2022-43454/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2022-43453](https://insights.sbomify.com/CVE-2022-43453/): WordPress WP Tools plugin <= 3.41 - Auth. Broken Access Control vulnerability (high 8.8)
- [CVE-2022-43452](https://insights.sbomify.com/CVE-2022-43452/): Delta Electronics DIAEnergie SQL Injection (high 8.8)
- [CVE-2022-43451](https://insights.sbomify.com/CVE-2022-43451/): Multiple path traversal in appspawn and nwebspawn services. (high 8.4)
- [CVE-2022-43450](https://insights.sbomify.com/CVE-2022-43450/): WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) (medium 4.3)
- [CVE-2022-4345](https://insights.sbomify.com/CVE-2022-4345/): Denial of service in Wireshark (medium 6.3)
- [CVE-2022-43449](https://insights.sbomify.com/CVE-2022-43449/): Arbitrary file read via download_server. (medium 6.2)
- [CVE-2022-43448](https://insights.sbomify.com/CVE-2022-43448/): Memory corruption in V-SFT and TELLUS (high 7.8)
- [CVE-2022-43447](https://insights.sbomify.com/CVE-2022-43447/): Delta Electronics DIAEnergie SQL Injection (high 8.8)
- [CVE-2022-43443](https://insights.sbomify.com/CVE-2022-43443/): Command injection in WCR-1166DS (high 8.0)
- [CVE-2022-43442](https://insights.sbomify.com/CVE-2022-43442/): Information disclosure in +F FS040U software (medium 4.6)
- [CVE-2022-43441](https://insights.sbomify.com/CVE-2022-43441/): sqlite vulnerable to code execution due to Object coercion (high 8.1)
- [CVE-2022-43440](https://insights.sbomify.com/CVE-2022-43440/): Privilege escalation via manipulated unixcat executable (high 8.8)
- [CVE-2022-4344](https://insights.sbomify.com/CVE-2022-4344/): Denial of service in Wireshark (medium 6.3)
- [CVE-2022-43439](https://insights.sbomify.com/CVE-2022-43439/): Other in POWER METER SICAM Q100 (critical 9.9)
- [CVE-2022-43438](https://insights.sbomify.com/CVE-2022-43438/): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Incorrect Authorization (high 8.8)
- [CVE-2022-43437](https://insights.sbomify.com/CVE-2022-43437/): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL Injection (high 8.8)
- [CVE-2022-43436](https://insights.sbomify.com/CVE-2022-43436/): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload (high 8.8)
- [CVE-2022-43435](https://insights.sbomify.com/CVE-2022-43435/): Content-Security-Policy protection for user content can be disabled in Jenkins 360 FireLine Plugin (medium 5.3)
- [CVE-2022-43434](https://insights.sbomify.com/CVE-2022-43434/): Content-Security-Policy protection for user content disabled by Jenkins NeuVector Vulnerability Scanner Plugin (medium 5.3)
- [CVE-2022-43433](https://insights.sbomify.com/CVE-2022-43433/): Content-Security-Policy protection for user content disabled by Jenkins ScreenRecorder Plugin (medium 4.3)
- [CVE-2022-43432](https://insights.sbomify.com/CVE-2022-43432/): Content-Security-Policy protection for user content disabled by Jenkins XFramium Builder Plugin (medium 4.3)
- [CVE-2022-43431](https://insights.sbomify.com/CVE-2022-43431/): Jenkins Compuware Strobe Measurement Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-43430](https://insights.sbomify.com/CVE-2022-43430/): XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin (high 7.5)
- [CVE-2022-4343](https://insights.sbomify.com/CVE-2022-4343/): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (medium 5.0)
- [CVE-2022-43429](https://insights.sbomify.com/CVE-2022-43429/): Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure (high 7.5)
- [CVE-2022-43428](https://insights.sbomify.com/CVE-2022-43428/): Agent-to-controller security bypass vulnerabilities in Jenkins Compuware Topaz for Total Test Plugin (medium 5.3)
- [CVE-2022-43427](https://insights.sbomify.com/CVE-2022-43427/): Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins (medium 4.3)
- [CVE-2022-43426](https://insights.sbomify.com/CVE-2022-43426/): AWS secrets displayed without masking by Jenkins S3 Explorer Plugin (medium 5.3)
- [CVE-2022-43425](https://insights.sbomify.com/CVE-2022-43425/): Stored XSS vulnerability in Jenkins Custom Checkbox Parameter Plugin (medium 5.4)
- [CVE-2022-43424](https://insights.sbomify.com/CVE-2022-43424/): Agent-to-controller security bypass vulnerability in Jenkins Compuware Xpediter Code Coverage Plugin (medium 5.3)
- [CVE-2022-43423](https://insights.sbomify.com/CVE-2022-43423/): Agent-to-controller security bypass vulnerability in Jenkins BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin (medium 5.3)
- [CVE-2022-43422](https://insights.sbomify.com/CVE-2022-43422/): Agent-to-controller security bypass vulnerability in Jenkins Compuware Topaz Utilities Plugin (medium 5.3)
- [CVE-2022-43421](https://insights.sbomify.com/CVE-2022-43421/): Jenkins Tuleap Git Branch Source Plugin allows unauthenticated attackers to trigger Tuleap projects whose configured repo matches attacker-specified value (medium 5.3)
- [CVE-2022-43420](https://insights.sbomify.com/CVE-2022-43420/): Stored XSS vulnerability in Jenkins Contrast Continuous Application Security Plugin (medium 5.4)
- [CVE-2022-4342](https://insights.sbomify.com/CVE-2022-4342/): Information disclosure in GitLab (medium 5.5)
- [CVE-2022-43419](https://insights.sbomify.com/CVE-2022-43419/): API keys stored in plain text by Jenkins Katalon Plugin (medium 6.5)
- [CVE-2022-43418](https://insights.sbomify.com/CVE-2022-43418/): CSRF vulnerability in Jenkins Katalon Plugin allows capturing credentials (medium 4.3)
- [CVE-2022-43417](https://insights.sbomify.com/CVE-2022-43417/): Missing permission checks in Jenkins Katalon Plugin allow capturing credentials (medium 4.3)
- [CVE-2022-43416](https://insights.sbomify.com/CVE-2022-43416/): Jenkins Katalon Plugin vulnerable to Protection Mechanism Failure (high 8.8)
- [CVE-2022-43415](https://insights.sbomify.com/CVE-2022-43415/): XXE vulnerability in Jenkins REPO Plugin (high 7.5)
- [CVE-2022-43414](https://insights.sbomify.com/CVE-2022-43414/): Jenkins NUnit Plugin vulnerable to Protection Mechanism Failure (medium 5.3)
- [CVE-2022-43413](https://insights.sbomify.com/CVE-2022-43413/): Jenkins Job Import Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins (medium 4.3)
- [CVE-2022-43412](https://insights.sbomify.com/CVE-2022-43412/): Non-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin (medium 5.3)
- [CVE-2022-43411](https://insights.sbomify.com/CVE-2022-43411/): Non-constant time webhook token comparison in Jenkins GitLab Plugin (medium 5.3)
- [CVE-2022-43410](https://insights.sbomify.com/CVE-2022-43410/): Webhook endpoint discloses job names to unauthorized users in Jenkins Mercurial Plugin (medium 5.3)
- [CVE-2022-4341](https://insights.sbomify.com/CVE-2022-4341/): csliuwy coder-chain_gdut cross site scripting (low 3.5)
- [CVE-2022-43409](https://insights.sbomify.com/CVE-2022-43409/): Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin (medium 5.4)
- [CVE-2022-43408](https://insights.sbomify.com/CVE-2022-43408/): Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins (medium 6.5)
- [CVE-2022-43407](https://insights.sbomify.com/CVE-2022-43407/): CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin (high 8.8)
- [CVE-2022-43406](https://insights.sbomify.com/CVE-2022-43406/): Sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin (critical 9.9)
- [CVE-2022-43405](https://insights.sbomify.com/CVE-2022-43405/): Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin (critical 9.9)
- [CVE-2022-43404](https://insights.sbomify.com/CVE-2022-43404/): Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin (critical 9.9)
- [CVE-2022-43403](https://insights.sbomify.com/CVE-2022-43403/): Jenkins Script Security Plugin sandbox bypass vulnerability (critical 9.9)
- [CVE-2022-43402](https://insights.sbomify.com/CVE-2022-43402/): Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution (critical 9.9)
- [CVE-2022-43401](https://insights.sbomify.com/CVE-2022-43401/): Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin (critical 9.9)
- [CVE-2022-43400](https://insights.sbomify.com/CVE-2022-43400/): Auth bypass in Siveillance Video Mobile Server V2022 R2 (critical 9.8)
- [CVE-2022-4340](https://insights.sbomify.com/CVE-2022-4340/): BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id (medium 5.3)
- [CVE-2022-43398](https://insights.sbomify.com/CVE-2022-43398/): Auth bypass in POWER METER SICAM Q100 (high 7.5)
- [CVE-2022-43397](https://insights.sbomify.com/CVE-2022-43397/): Memory corruption in Parasolid V34.0 (high 7.8)
- [CVE-2022-43396](https://insights.sbomify.com/CVE-2022-43396/): Apache Kylin: Command injection by Useless configuration (high 8.8)
- [CVE-2022-43393](https://insights.sbomify.com/CVE-2022-43393/): Denial of service in GS1920-24v2 firmware (high 8.2)
- [CVE-2022-43392](https://insights.sbomify.com/CVE-2022-43392/): Memory corruption in NR7101 firmware (medium 6.5)
- [CVE-2022-43391](https://insights.sbomify.com/CVE-2022-43391/): Memory corruption in NR7101 firmware (medium 6.5)
- [CVE-2022-43390](https://insights.sbomify.com/CVE-2022-43390/): Command injection in NR7101 firmware (medium 5.4)
- [CVE-2022-43389](https://insights.sbomify.com/CVE-2022-43389/): Memory corruption in NR7101 firmware (high 8.6)
- [CVE-2022-43384](https://insights.sbomify.com/CVE-2022-43384/): IBM Aspera Console cross-site scripting (medium 4.6)
- [CVE-2022-43382](https://insights.sbomify.com/CVE-2022-43382/): IBM AIX denial of service (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/227/