# Vulnerabilities published in 2022


- [CVE-2022-42711](https://insights.sbomify.com/CVE-2022-42711/): Cross-site scripting in progress:whatsup gold (critical 9.6)
- [CVE-2022-42710](https://insights.sbomify.com/CVE-2022-42710/): Cross-site scripting in niceforyou:linear emerge e3 access control firmware (medium 5.4)
- [CVE-2022-4271](https://insights.sbomify.com/CVE-2022-4271/): Cross-site Scripting (XSS) - Reflected in osticket/osticket (high 8.0)
- [CVE-2022-42707](https://insights.sbomify.com/CVE-2022-42707/): Missing authorization in mahara:mahara (high 7.5)
- [CVE-2022-42706](https://insights.sbomify.com/CVE-2022-42706/): Path traversal in sangoma:asterisk (medium 4.9)
- [CVE-2022-42705](https://insights.sbomify.com/CVE-2022-42705/): Use after free in sangoma:asterisk (medium 6.5)
- [CVE-2022-42704](https://insights.sbomify.com/CVE-2022-42704/): Cross-site scripting in servicenow:servicenow (medium 5.4)
- [CVE-2022-42703](https://insights.sbomify.com/CVE-2022-42703/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2022-4270](https://insights.sbomify.com/CVE-2022-4270/): Incorrect privilege assignment in M-Files Web Server (low 2.0)
- [CVE-2022-42699](https://insights.sbomify.com/CVE-2022-42699/): WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE) (critical 9.1)
- [CVE-2022-42698](https://insights.sbomify.com/CVE-2022-42698/): WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability (critical 9.8)
- [CVE-2022-4269](https://insights.sbomify.com/CVE-2022-4269/): Denial of service in Linux kernel (TC subsystem) (medium 5.5)
- [CVE-2022-4268](https://insights.sbomify.com/CVE-2022-4268/): Plugin Logic < 1.0.8 - Admin+ SQLi (high 7.2)
- [CVE-2022-4267](https://insights.sbomify.com/CVE-2022-4267/): Bulk Delete Users by Email <= 1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-4266](https://insights.sbomify.com/CVE-2022-4266/): Bulk Delete Users by Email <= 1.2 - User Deletion via CSRF (medium 6.5)
- [CVE-2022-4265](https://insights.sbomify.com/CVE-2022-4265/): Replyable < 2.2.10 - Subscriber+ PHP Object Injection (high 8.8)
- [CVE-2022-4264](https://insights.sbomify.com/CVE-2022-4264/): Incorrect privilege assignment in M-Files Web Server (medium 6.5)
- [CVE-2022-4262](https://insights.sbomify.com/CVE-2022-4262/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2022-4261](https://insights.sbomify.com/CVE-2022-4261/): Rapid7 Nexpose Update Validation Issue (medium 4.4)
- [CVE-2022-4260](https://insights.sbomify.com/CVE-2022-4260/): WP-Ban < 1.69.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-4259](https://insights.sbomify.com/CVE-2022-4259/): Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 (high 8.7)
- [CVE-2022-4258](https://insights.sbomify.com/CVE-2022-4258/): Hima: Unquoted path vulnerabilities in HIMA PC based Software (high 7.8)
- [CVE-2022-4257](https://insights.sbomify.com/CVE-2022-4257/): C-DATA Web Management System GET Parameter jumpto.php argument injection (medium 6.3)
- [CVE-2022-4256](https://insights.sbomify.com/CVE-2022-4256/): All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-4255](https://insights.sbomify.com/CVE-2022-4255/): Information disclosure in GitLab (medium 4.3)
- [CVE-2022-42544](https://insights.sbomify.com/CVE-2022-42544/): Other in Android (high 7.8)
- [CVE-2022-42543](https://insights.sbomify.com/CVE-2022-42543/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42542](https://insights.sbomify.com/CVE-2022-42542/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42541](https://insights.sbomify.com/CVE-2022-42541/): Remote code execution (critical 9.8)
- [CVE-2022-42540](https://insights.sbomify.com/CVE-2022-42540/): Elevation of privilege (critical 9.8)
- [CVE-2022-4254](https://insights.sbomify.com/CVE-2022-4254/): Other in SSSD (high 8.8)
- [CVE-2022-42539](https://insights.sbomify.com/CVE-2022-42539/): Information disclosure (high 7.5)
- [CVE-2022-42538](https://insights.sbomify.com/CVE-2022-42538/): Elevation of privilege (critical 9.8)
- [CVE-2022-42537](https://insights.sbomify.com/CVE-2022-42537/): Remote code execution (critical 9.8)
- [CVE-2022-42536](https://insights.sbomify.com/CVE-2022-42536/): Remote code execution (critical 9.8)
- [CVE-2022-42535](https://insights.sbomify.com/CVE-2022-42535/): SQL injection in Android (medium 5.5)
- [CVE-2022-42534](https://insights.sbomify.com/CVE-2022-42534/): Privilege escalation in Android (high 7.8)
- [CVE-2022-42533](https://insights.sbomify.com/CVE-2022-42533/): Integer overflow in Android (high 7.8)
- [CVE-2022-42532](https://insights.sbomify.com/CVE-2022-42532/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42531](https://insights.sbomify.com/CVE-2022-42531/): Privilege escalation in Android (high 7.8)
- [CVE-2022-42530](https://insights.sbomify.com/CVE-2022-42530/): Memory corruption in Android (medium 4.4)
- [CVE-2022-4253](https://insights.sbomify.com/CVE-2022-4253/): SourceCodester Canteen Management System customer.php builtin_echo cross site scripting (low 3.5)
- [CVE-2022-42529](https://insights.sbomify.com/CVE-2022-42529/): Memory corruption in Android (critical 9.8)
- [CVE-2022-42528](https://insights.sbomify.com/CVE-2022-42528/): Information disclosure in Android (medium 5.5)
- [CVE-2022-42527](https://insights.sbomify.com/CVE-2022-42527/): Null dereference in Android (high 7.5)
- [CVE-2022-42526](https://insights.sbomify.com/CVE-2022-42526/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42525](https://insights.sbomify.com/CVE-2022-42525/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42524](https://insights.sbomify.com/CVE-2022-42524/): Memory corruption in Android (high 7.5)
- [CVE-2022-42523](https://insights.sbomify.com/CVE-2022-42523/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42522](https://insights.sbomify.com/CVE-2022-42522/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42521](https://insights.sbomify.com/CVE-2022-42521/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42520](https://insights.sbomify.com/CVE-2022-42520/): Use after free in Android (medium 6.7)
- [CVE-2022-4252](https://insights.sbomify.com/CVE-2022-4252/): SourceCodester Canteen Management System categories.php builtin_echo cross site scripting (low 3.5)
- [CVE-2022-42519](https://insights.sbomify.com/CVE-2022-42519/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42518](https://insights.sbomify.com/CVE-2022-42518/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42517](https://insights.sbomify.com/CVE-2022-42517/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42516](https://insights.sbomify.com/CVE-2022-42516/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42515](https://insights.sbomify.com/CVE-2022-42515/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42514](https://insights.sbomify.com/CVE-2022-42514/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42513](https://insights.sbomify.com/CVE-2022-42513/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42512](https://insights.sbomify.com/CVE-2022-42512/): Memory corruption in Android (medium 4.4)
- [CVE-2022-42511](https://insights.sbomify.com/CVE-2022-42511/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42510](https://insights.sbomify.com/CVE-2022-42510/): Memory corruption in Android (medium 6.7)
- [CVE-2022-4251](https://insights.sbomify.com/CVE-2022-4251/): Movie Ticket Booking System editBooking.php cross site scripting (low 2.4)
- [CVE-2022-42509](https://insights.sbomify.com/CVE-2022-42509/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42508](https://insights.sbomify.com/CVE-2022-42508/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42507](https://insights.sbomify.com/CVE-2022-42507/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42506](https://insights.sbomify.com/CVE-2022-42506/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42505](https://insights.sbomify.com/CVE-2022-42505/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42504](https://insights.sbomify.com/CVE-2022-42504/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42503](https://insights.sbomify.com/CVE-2022-42503/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42502](https://insights.sbomify.com/CVE-2022-42502/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42501](https://insights.sbomify.com/CVE-2022-42501/): Memory corruption in Android (medium 6.7)
- [CVE-2022-42500](https://insights.sbomify.com/CVE-2022-42500/): Command injection in Android (medium 6.7)
- [CVE-2022-4250](https://insights.sbomify.com/CVE-2022-4250/): Movie Ticket Booking System booking.php cross site scripting (low 3.5)
- [CVE-2022-42499](https://insights.sbomify.com/CVE-2022-42499/): Memory corruption in Android (critical 9.8)
- [CVE-2022-42498](https://insights.sbomify.com/CVE-2022-42498/): Memory corruption in Android (critical 9.8)
- [CVE-2022-42497](https://insights.sbomify.com/CVE-2022-42497/): WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary Code Execution vulnerability (critical 10.0)
- [CVE-2022-42496](https://insights.sbomify.com/CVE-2022-42496/): nadesiko3 vulnerable to OS Command Injection (critical 9.8)
- [CVE-2022-42494](https://insights.sbomify.com/CVE-2022-42494/): WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability (low 3.0)
- [CVE-2022-42493](https://insights.sbomify.com/CVE-2022-42493/): Command injection in QUARTZ-GOLD (critical 9.8)
- [CVE-2022-42492](https://insights.sbomify.com/CVE-2022-42492/): Command injection in QUARTZ-GOLD (critical 9.8)
- [CVE-2022-42491](https://insights.sbomify.com/CVE-2022-42491/): Command injection in QUARTZ-GOLD (critical 9.8)
- [CVE-2022-42490](https://insights.sbomify.com/CVE-2022-42490/): Command injection in QUARTZ-GOLD (critical 9.8)
- [CVE-2022-4249](https://insights.sbomify.com/CVE-2022-4249/): Movie Ticket Booking System POST Request cross site scripting (low 3.5)
- [CVE-2022-42488](https://insights.sbomify.com/CVE-2022-42488/): Missing authorization in OpenHarmony (high 8.4)
- [CVE-2022-42486](https://insights.sbomify.com/CVE-2022-42486/): baserCMS vulnerable to stored Cross-site Scripting (medium 4.8)
- [CVE-2022-42485](https://insights.sbomify.com/CVE-2022-42485/): WordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-42484](https://insights.sbomify.com/CVE-2022-42484/): Command injection in FreshTomato (critical 9.1)
- [CVE-2022-4248](https://insights.sbomify.com/CVE-2022-4248/): Movie Ticket Booking System editBooking.php sql injection (medium 5.0)
- [CVE-2022-42479](https://insights.sbomify.com/CVE-2022-42479/): WordPress Soledad premium theme <= 8.2.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-42478](https://insights.sbomify.com/CVE-2022-42478/): Auth bypass in FortiSIEM (high 8.1)
- [CVE-2022-42477](https://insights.sbomify.com/CVE-2022-42477/): Information disclosure in FortiAnalyzer (medium 6.5)
- [CVE-2022-42476](https://insights.sbomify.com/CVE-2022-42476/): Path traversal in FortiOS (high 7.8)
- [CVE-2022-42475](https://insights.sbomify.com/CVE-2022-42475/): Fortinet FortiOS Heap-Based Buffer Overflow (critical 9.3, exploited in the wild)
- [CVE-2022-42474](https://insights.sbomify.com/CVE-2022-42474/): Path traversal in FortiOS (medium 6.2)
- [CVE-2022-42473](https://insights.sbomify.com/CVE-2022-42473/): Auth bypass in Fortinet FortiSOAR (medium 5.3)
- [CVE-2022-42472](https://insights.sbomify.com/CVE-2022-42472/): Other in FortiOS (medium 4.0)
- [CVE-2022-42471](https://insights.sbomify.com/CVE-2022-42471/): Other in FortiWeb (medium 5.3)
- [CVE-2022-42470](https://insights.sbomify.com/CVE-2022-42470/): Path traversal in FortiClientWindows (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/233/