# Vulnerabilities published in 2022


- [CVE-2022-42265](https://insights.sbomify.com/CVE-2022-42265/): Integer overflow in NVIDIA GPU Display Driver for Linux (medium 5.3)
- [CVE-2022-42264](https://insights.sbomify.com/CVE-2022-42264/): Memory corruption in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (high 7.1)
- [CVE-2022-42263](https://insights.sbomify.com/CVE-2022-42263/): Integer overflow in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (high 7.1)
- [CVE-2022-42262](https://insights.sbomify.com/CVE-2022-42262/): Memory corruption in vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (Virtual GPU Manager) (high 7.1)
- [CVE-2022-42261](https://insights.sbomify.com/CVE-2022-42261/): Memory corruption in vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (Virtual GPU Manager) (high 7.8)
- [CVE-2022-42260](https://insights.sbomify.com/CVE-2022-42260/): Misconfiguration in vGPU software (guest driver) - Linux, NVIDIA Cloud Gaming (guest driver) (high 7.8)
- [CVE-2022-4226](https://insights.sbomify.com/CVE-2022-4226/): Simple Basic Contact Form < 20221201 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-42259](https://insights.sbomify.com/CVE-2022-42259/): Integer overflow in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (medium 4.4)
- [CVE-2022-42258](https://insights.sbomify.com/CVE-2022-42258/): Integer overflow in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (medium 5.3)
- [CVE-2022-42257](https://insights.sbomify.com/CVE-2022-42257/): Integer overflow in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (medium 5.3)
- [CVE-2022-42256](https://insights.sbomify.com/CVE-2022-42256/): Integer overflow in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (medium 5.3)
- [CVE-2022-42255](https://insights.sbomify.com/CVE-2022-42255/): Memory corruption in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (medium 5.3)
- [CVE-2022-42254](https://insights.sbomify.com/CVE-2022-42254/): Memory corruption in vGPU software (guest driver) - Linux, vGPU software (Virtual GPU Manager), NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) (medium 5.3)
- [CVE-2022-42252](https://insights.sbomify.com/CVE-2022-42252/): Apache Tomcat request smuggling via malformed content-length (high 7.5)
- [CVE-2022-42250](https://insights.sbomify.com/CVE-2022-42250/): SQL injection in oretnom23:simple cold storage management system (high 7.2)
- [CVE-2022-42249](https://insights.sbomify.com/CVE-2022-42249/): SQL injection in oretnom23:simple cold storage management system (high 7.2)
- [CVE-2022-42248](https://insights.sbomify.com/CVE-2022-42248/): Cross-site scripting in qlik:qlikview (medium 5.4)
- [CVE-2022-42247](https://insights.sbomify.com/CVE-2022-42247/): Cross-site scripting in pfsense:pfsense (medium 6.1)
- [CVE-2022-42246](https://insights.sbomify.com/CVE-2022-42246/): Cross-site request forgery in duofoxtechnologies:duofox cms (high 8.8)
- [CVE-2022-42245](https://insights.sbomify.com/CVE-2022-42245/): SQL injection in dreamer cms project:dreamer cms (critical 9.8)
- [CVE-2022-42243](https://insights.sbomify.com/CVE-2022-42243/): SQL injection in oretnom23:simple cold storage management system (high 7.2)
- [CVE-2022-42242](https://insights.sbomify.com/CVE-2022-42242/): SQL injection in oretnom23:simple cold storage management system (high 7.2)
- [CVE-2022-42241](https://insights.sbomify.com/CVE-2022-42241/): SQL injection in oretnom23:simple cold storage management system (high 7.2)
- [CVE-2022-4224](https://insights.sbomify.com/CVE-2022-4224/): CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 (high 8.8)
- [CVE-2022-42238](https://insights.sbomify.com/CVE-2022-42238/): Privilege escalation in merchandise online store project:merchandise online store (high 8.8)
- [CVE-2022-42237](https://insights.sbomify.com/CVE-2022-42237/): SQL injection in merchandise online store project:merchandise online store (critical 9.8)
- [CVE-2022-42236](https://insights.sbomify.com/CVE-2022-42236/): Cross-site scripting in merchandise online store project:merchandise online store (medium 5.4)
- [CVE-2022-42235](https://insights.sbomify.com/CVE-2022-42235/): Cross-site scripting in student clearance system project:student clearance system (medium 5.4)
- [CVE-2022-42234](https://insights.sbomify.com/CVE-2022-42234/): Path traversal in ucms project:ucms (high 8.8)
- [CVE-2022-42233](https://insights.sbomify.com/CVE-2022-42233/): Auth bypass in tenda:11n firmware (critical 9.8)
- [CVE-2022-42232](https://insights.sbomify.com/CVE-2022-42232/): SQL injection in oretnom23:simple cold storage management system (high 7.2)
- [CVE-2022-42230](https://insights.sbomify.com/CVE-2022-42230/): SQL injection in simple cold storage management system project:simple cold storage managment system (high 7.2)
- [CVE-2022-4223](https://insights.sbomify.com/CVE-2022-4223/): pgadmin4 vulnerable to Code Injection (high 8.8)
- [CVE-2022-42229](https://insights.sbomify.com/CVE-2022-42229/): File upload in wedding planner project:wedding planner (high 8.8)
- [CVE-2022-42227](https://insights.sbomify.com/CVE-2022-42227/): Memory corruption in jsonlint project:jsonlint c\+\+ (high 7.5)
- [CVE-2022-42225](https://insights.sbomify.com/CVE-2022-42225/): Cross-site scripting in fit2cloud:lina (medium 5.4)
- [CVE-2022-42221](https://insights.sbomify.com/CVE-2022-42221/): Command injection in netgear:r6220 firmware (high 8.8)
- [CVE-2022-4222](https://insights.sbomify.com/CVE-2022-4222/): SourceCodester Canteen Management System POST Request ajax_invoice.php query sql injection (medium 5.0)
- [CVE-2022-42218](https://insights.sbomify.com/CVE-2022-42218/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-4221](https://insights.sbomify.com/CVE-2022-4221/): OS command injection in ASUS M25 NAS (critical 9.8)
- [CVE-2022-42206](https://insights.sbomify.com/CVE-2022-42206/): Cross-site scripting in phpgurukul:hospital management system (medium 5.4)
- [CVE-2022-42205](https://insights.sbomify.com/CVE-2022-42205/): Cross-site scripting in phpgurukul:hospital management system (medium 5.4)
- [CVE-2022-42202](https://insights.sbomify.com/CVE-2022-42202/): Cross-site scripting in tp-link:tl-wr841n firmware (medium 6.1)
- [CVE-2022-42201](https://insights.sbomify.com/CVE-2022-42201/): File upload in simple exam reviewer management system project:simple exam reviewer management system (high 7.2)
- [CVE-2022-42200](https://insights.sbomify.com/CVE-2022-42200/): Cross-site scripting in simple exam reviewer management system project:simple exam reviewer management system (medium 5.4)
- [CVE-2022-4220](https://insights.sbomify.com/CVE-2022-4220/): Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion (medium 5.4)
- [CVE-2022-42199](https://insights.sbomify.com/CVE-2022-42199/): Cross-site request forgery in simple exam reviewer management system project:simple exam reviewer management system (high 8.8)
- [CVE-2022-42198](https://insights.sbomify.com/CVE-2022-42198/): File upload in simple exam reviewer management system project:simple exam reviewer management system (high 8.8)
- [CVE-2022-42197](https://insights.sbomify.com/CVE-2022-42197/): Privilege escalation in simple exam reviewer management system project:simple exam reviewer management system (medium 6.5)
- [CVE-2022-4219](https://insights.sbomify.com/CVE-2022-4219/): Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion (medium 5.4)
- [CVE-2022-42189](https://insights.sbomify.com/CVE-2022-42189/): File upload in emlog:emlog (high 7.2)
- [CVE-2022-42188](https://insights.sbomify.com/CVE-2022-42188/): Lavalite vulnerable to Arbitrary File Read via Directory Traversal (high 7.5)
- [CVE-2022-42187](https://insights.sbomify.com/CVE-2022-42187/): Cross-site scripting in hustoj:hustoj (medium 6.1)
- [CVE-2022-42183](https://insights.sbomify.com/CVE-2022-42183/): Server-side request forgery in precisely:spectrum spatial analyst (critical 9.1)
- [CVE-2022-42182](https://insights.sbomify.com/CVE-2022-42182/): Path traversal in precisely:spectrum spatial analyst (medium 5.3)
- [CVE-2022-4218](https://insights.sbomify.com/CVE-2022-4218/): Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying (medium 5.4)
- [CVE-2022-42176](https://insights.sbomify.com/CVE-2022-42176/): Hardcoded credentials in pctechsoft:pcsecure (high 7.8)
- [CVE-2022-42175](https://insights.sbomify.com/CVE-2022-42175/): Missing authorization in soluslabs:solusvm (high 8.8)
- [CVE-2022-42171](https://insights.sbomify.com/CVE-2022-42171/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42170](https://insights.sbomify.com/CVE-2022-42170/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-4217](https://insights.sbomify.com/CVE-2022-4217/): Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key (medium 5.5)
- [CVE-2022-42169](https://insights.sbomify.com/CVE-2022-42169/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42168](https://insights.sbomify.com/CVE-2022-42168/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42167](https://insights.sbomify.com/CVE-2022-42167/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42166](https://insights.sbomify.com/CVE-2022-42166/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42165](https://insights.sbomify.com/CVE-2022-42165/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42164](https://insights.sbomify.com/CVE-2022-42164/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42163](https://insights.sbomify.com/CVE-2022-42163/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2022-42161](https://insights.sbomify.com/CVE-2022-42161/): Command injection in dlink:covr 1200 firmware (high 8.8)
- [CVE-2022-42160](https://insights.sbomify.com/CVE-2022-42160/): Command injection in dlink:covr 1200 firmware (high 8.8)
- [CVE-2022-4216](https://insights.sbomify.com/CVE-2022-4216/): Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID (medium 5.5)
- [CVE-2022-42159](https://insights.sbomify.com/CVE-2022-42159/): Weak cryptography in dlink:covr 1200 firmware (medium 4.3)
- [CVE-2022-42156](https://insights.sbomify.com/CVE-2022-42156/): Command injection in dlink:covr 1200 firmware (high 8.8)
- [CVE-2022-42154](https://insights.sbomify.com/CVE-2022-42154/): File upload in 74cms:74cmsse (critical 9.8)
- [CVE-2022-42150](https://insights.sbomify.com/CVE-2022-42150/): Misconfiguration in tinylab:cloud lab (critical 10.0)
- [CVE-2022-4215](https://insights.sbomify.com/CVE-2022-4215/): Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via date (medium 6.1)
- [CVE-2022-42149](https://insights.sbomify.com/CVE-2022-42149/): Server-side request forgery in keking:kkfileview (critical 9.8)
- [CVE-2022-42147](https://insights.sbomify.com/CVE-2022-42147/): Cross-site scripting in keking:kkfileview (medium 6.1)
- [CVE-2022-42143](https://insights.sbomify.com/CVE-2022-42143/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-42142](https://insights.sbomify.com/CVE-2022-42142/): Code injection in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-42141](https://insights.sbomify.com/CVE-2022-42141/): Cross-site scripting in deltaww:dx-2100-l1-cn firmware (medium 5.4)
- [CVE-2022-42140](https://insights.sbomify.com/CVE-2022-42140/): Command injection in deltaww:dx-2100-l1-cn firmware (high 7.2)
- [CVE-2022-4214](https://insights.sbomify.com/CVE-2022-4214/): Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip (medium 6.1)
- [CVE-2022-42139](https://insights.sbomify.com/CVE-2022-42139/): Command injection in deltaww:dvw-w02w2-e2 firmware (high 8.8)
- [CVE-2022-42136](https://insights.sbomify.com/CVE-2022-42136/): Path traversal in mailenable:mailenable (high 8.8)
- [CVE-2022-42132](https://insights.sbomify.com/CVE-2022-42132/): Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL (medium 5.9)
- [CVE-2022-42131](https://insights.sbomify.com/CVE-2022-42131/): Improper Certificate Validation in Liferay Portal (medium 4.8)
- [CVE-2022-42130](https://insights.sbomify.com/CVE-2022-42130/): Incorrect Default Permissions in Liferay Portal (medium 4.3)
- [CVE-2022-4213](https://insights.sbomify.com/CVE-2022-4213/): Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dn (medium 6.1)
- [CVE-2022-42129](https://insights.sbomify.com/CVE-2022-42129/): Authorization Bypass in Liferay Portal (medium 4.3)
- [CVE-2022-42128](https://insights.sbomify.com/CVE-2022-42128/): Incorrect Default Permissions in Liferay Portal (medium 5.3)
- [CVE-2022-42127](https://insights.sbomify.com/CVE-2022-42127/): Incorrect Default Permissions in Liferay Portal (medium 5.3)
- [CVE-2022-42126](https://insights.sbomify.com/CVE-2022-42126/): Missing permissions check in Liferay Portal (medium 4.3)
- [CVE-2022-42125](https://insights.sbomify.com/CVE-2022-42125/): Path Traversal in Liferay Portal (high 7.5)
- [CVE-2022-42124](https://insights.sbomify.com/CVE-2022-42124/): Inefficient Regular Expression Complexity in Liferay Portal (high 7.5)
- [CVE-2022-42123](https://insights.sbomify.com/CVE-2022-42123/): Path Traversal in Liferay Portal (high 7.5)
- [CVE-2022-42122](https://insights.sbomify.com/CVE-2022-42122/): Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module (critical 9.8)
- [CVE-2022-42121](https://insights.sbomify.com/CVE-2022-42121/): Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module (high 8.8)
- [CVE-2022-42120](https://insights.sbomify.com/CVE-2022-42120/): Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module (critical 9.8)
- [CVE-2022-4212](https://insights.sbomify.com/CVE-2022-4212/): Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/236/