# Vulnerabilities published in 2022


- [CVE-2022-42119](https://insights.sbomify.com/CVE-2022-42119/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module (medium 5.4)
- [CVE-2022-42118](https://insights.sbomify.com/CVE-2022-42118/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module (medium 6.1)
- [CVE-2022-42117](https://insights.sbomify.com/CVE-2022-42117/): Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module (medium 6.1)
- [CVE-2022-42116](https://insights.sbomify.com/CVE-2022-42116/): Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module (medium 6.1)
- [CVE-2022-42115](https://insights.sbomify.com/CVE-2022-42115/): Liferay Portal Vulnerable to XSS in the Object Module (medium 5.4)
- [CVE-2022-42114](https://insights.sbomify.com/CVE-2022-42114/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Role Module (medium 5.4)
- [CVE-2022-42113](https://insights.sbomify.com/CVE-2022-42113/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module (medium 6.1)
- [CVE-2022-42112](https://insights.sbomify.com/CVE-2022-42112/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module (medium 5.4)
- [CVE-2022-42111](https://insights.sbomify.com/CVE-2022-42111/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module (medium 5.4)
- [CVE-2022-42110](https://insights.sbomify.com/CVE-2022-42110/): Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module (medium 6.1)
- [CVE-2022-4211](https://insights.sbomify.com/CVE-2022-4211/): Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf (medium 6.1)
- [CVE-2022-42109](https://insights.sbomify.com/CVE-2022-42109/): SQL injection in online-shopping-system-advanced project:online-shopping-system-advanced (critical 9.8)
- [CVE-2022-42100](https://insights.sbomify.com/CVE-2022-42100/): Cross-site scripting in klik project:klik (medium 5.4)
- [CVE-2022-4210](https://insights.sbomify.com/CVE-2022-4210/): Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf (medium 6.1)
- [CVE-2022-42099](https://insights.sbomify.com/CVE-2022-42099/): Cross-site scripting in klik project:klik (medium 5.4)
- [CVE-2022-42098](https://insights.sbomify.com/CVE-2022-42098/): SQL injection in klik-socialmediawebsite project:klik-socialmediawebsite (high 8.8)
- [CVE-2022-42097](https://insights.sbomify.com/CVE-2022-42097/): Cross-site Scripting in Backdrop CMS (medium 4.8)
- [CVE-2022-42096](https://insights.sbomify.com/CVE-2022-42096/): Cross-site Scripting in Backdrop CMS (medium 4.8)
- [CVE-2022-42095](https://insights.sbomify.com/CVE-2022-42095/): Cross-site Scripting in Backdrop CMS (medium 4.8)
- [CVE-2022-42094](https://insights.sbomify.com/CVE-2022-42094/): Cross-site Scripting in Backdrop CMS (medium 4.8)
- [CVE-2022-42092](https://insights.sbomify.com/CVE-2022-42092/): Backdrop CMS Unrestricted File Upload vulnerability (high 7.2)
- [CVE-2022-4209](https://insights.sbomify.com/CVE-2022-4209/): Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf (medium 6.1)
- [CVE-2022-42087](https://insights.sbomify.com/CVE-2022-42087/): Cross-site request forgery in tenda:ax1803 firmware (medium 6.5)
- [CVE-2022-42086](https://insights.sbomify.com/CVE-2022-42086/): Cross-site request forgery in tenda:ax1803 firmware (medium 6.5)
- [CVE-2022-42081](https://insights.sbomify.com/CVE-2022-42081/): Memory corruption in tenda:ac1206 firmware (high 7.5)
- [CVE-2022-42080](https://insights.sbomify.com/CVE-2022-42080/): Memory corruption in tenda:ac1206 firmware (high 7.5)
- [CVE-2022-4208](https://insights.sbomify.com/CVE-2022-4208/): Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef (medium 6.1)
- [CVE-2022-42079](https://insights.sbomify.com/CVE-2022-42079/): Memory corruption in tenda:ac1206 firmware (high 7.5)
- [CVE-2022-42078](https://insights.sbomify.com/CVE-2022-42078/): Cross-site request forgery in tenda:ac1206 firmware (medium 6.5)
- [CVE-2022-42077](https://insights.sbomify.com/CVE-2022-42077/): Cross-site request forgery in tenda:ac1206 firmware (medium 6.5)
- [CVE-2022-42075](https://insights.sbomify.com/CVE-2022-42075/): Code injection in wedding planner project:wedding planner (critical 9.8)
- [CVE-2022-42074](https://insights.sbomify.com/CVE-2022-42074/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-42073](https://insights.sbomify.com/CVE-2022-42073/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-42071](https://insights.sbomify.com/CVE-2022-42071/): Cross-site scripting in oretnom23:online birth certificate management system (medium 6.1)
- [CVE-2022-42070](https://insights.sbomify.com/CVE-2022-42070/): Cross-site request forgery in oretnom23:online birth certificate management system (high 8.8)
- [CVE-2022-4207](https://insights.sbomify.com/CVE-2022-4207/): Cross-site scripting in Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) (medium 5.5)
- [CVE-2022-42069](https://insights.sbomify.com/CVE-2022-42069/): Cross-site scripting in oretnom23:online birth certificate management system (medium 5.4)
- [CVE-2022-42067](https://insights.sbomify.com/CVE-2022-42067/): Missing authorization in oretnom23:online birth certificate management system (medium 4.3)
- [CVE-2022-42066](https://insights.sbomify.com/CVE-2022-42066/): Cross-site scripting in projectworlds:online examination system (medium 6.1)
- [CVE-2022-42064](https://insights.sbomify.com/CVE-2022-42064/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (critical 9.8)
- [CVE-2022-42060](https://insights.sbomify.com/CVE-2022-42060/): Memory corruption in tenda:w15e firmware (high 7.5)
- [CVE-2022-4206](https://insights.sbomify.com/CVE-2022-4206/): Information disclosure in DAST API scanner (medium 5.0)
- [CVE-2022-42058](https://insights.sbomify.com/CVE-2022-42058/): Memory corruption in tenda:w15e firmware (critical 9.8)
- [CVE-2022-42055](https://insights.sbomify.com/CVE-2022-42055/): Command injection in gl-inet:goodcloud (medium 6.5)
- [CVE-2022-42054](https://insights.sbomify.com/CVE-2022-42054/): Cross-site scripting in gl-inet:goodcloud (medium 5.4)
- [CVE-2022-42053](https://insights.sbomify.com/CVE-2022-42053/): Command injection in tenda:w15e firmware (high 7.8)
- [CVE-2022-4205](https://insights.sbomify.com/CVE-2022-4205/): Business logic in GitLab (medium 6.3)
- [CVE-2022-42046](https://insights.sbomify.com/CVE-2022-42046/): Privilege escalation in wfs:heaven burns red (high 7.8)
- [CVE-2022-42045](https://insights.sbomify.com/CVE-2022-42045/): Code injection in watchdog:anti-virus (medium 6.7)
- [CVE-2022-42044](https://insights.sbomify.com/CVE-2022-42044/): Supply chain in democritus:d8s-asns (critical 9.8)
- [CVE-2022-42043](https://insights.sbomify.com/CVE-2022-42043/): Supply chain in democritus:d8s-xml (critical 9.8)
- [CVE-2022-42042](https://insights.sbomify.com/CVE-2022-42042/): Supply chain in democritus:d8s-networking (critical 9.8)
- [CVE-2022-42041](https://insights.sbomify.com/CVE-2022-42041/): Supply chain in democritus:d8s-file-system (critical 9.8)
- [CVE-2022-42040](https://insights.sbomify.com/CVE-2022-42040/): Supply chain in democritus:d8s-algorithms (critical 9.8)
- [CVE-2022-42039](https://insights.sbomify.com/CVE-2022-42039/): Supply chain in democritus:d8s-lists (critical 9.8)
- [CVE-2022-42038](https://insights.sbomify.com/CVE-2022-42038/): Supply chain in democritus:d8s-ip-addresses (critical 9.8)
- [CVE-2022-42037](https://insights.sbomify.com/CVE-2022-42037/): Supply chain in democritus:d8s-asns (critical 9.8)
- [CVE-2022-42036](https://insights.sbomify.com/CVE-2022-42036/): Supply chain in democritus:d8s-urls (critical 9.8)
- [CVE-2022-42034](https://insights.sbomify.com/CVE-2022-42034/): File upload in wedding planner project:wedding planner (high 8.8)
- [CVE-2022-4203](https://insights.sbomify.com/CVE-2022-4203/): X.509 Name Constraints Read Buffer Overflow (medium 4.9)
- [CVE-2022-42029](https://insights.sbomify.com/CVE-2022-42029/): Path traversal in chamilo:chamilo (high 8.8)
- [CVE-2022-42021](https://insights.sbomify.com/CVE-2022-42021/): SQL injection in best student result management system project:best student result management system (critical 9.8)
- [CVE-2022-4202](https://insights.sbomify.com/CVE-2022-4202/): GPAC lsr_dec.c lsr_translate_coords integer overflow (medium 6.3)
- [CVE-2022-42012](https://insights.sbomify.com/CVE-2022-42012/): Denial of service in fedoraproject:fedora (medium 6.5)
- [CVE-2022-42011](https://insights.sbomify.com/CVE-2022-42011/): Denial of service in fedoraproject:fedora (medium 6.5)
- [CVE-2022-42010](https://insights.sbomify.com/CVE-2022-42010/): Denial of service in fedoraproject:fedora (medium 6.5)
- [CVE-2022-4201](https://insights.sbomify.com/CVE-2022-4201/): Server-side request forgery in GitLab (low 3.5)
- [CVE-2022-42009](https://insights.sbomify.com/CVE-2022-42009/): Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application. (high 8.0)
- [CVE-2022-42004](https://insights.sbomify.com/CVE-2022-42004/): Uncontrolled Resource Consumption in FasterXML jackson-databind (high 7.5)
- [CVE-2022-42003](https://insights.sbomify.com/CVE-2022-42003/): Uncontrolled Resource Consumption in Jackson-databind (high 7.5)
- [CVE-2022-42002](https://insights.sbomify.com/CVE-2022-42002/): Missing authorization in sonicjs:sonicjs (critical 9.1)
- [CVE-2022-42001](https://insights.sbomify.com/CVE-2022-42001/): Potential XSS in book navigation (low 3.3)
- [CVE-2022-42000](https://insights.sbomify.com/CVE-2022-42000/): Potential XSS in comment section (low 3.3)
- [CVE-2022-4200](https://insights.sbomify.com/CVE-2022-4200/): Login with Cognito <= 1.4.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41999](https://insights.sbomify.com/CVE-2022-41999/): Null dereference in OpenImageIO (high 7.5)
- [CVE-2022-41998](https://insights.sbomify.com/CVE-2022-41998/): Privilege escalation in Intel(R) DCM software (medium 6.7)
- [CVE-2022-41996](https://insights.sbomify.com/CVE-2022-41996/): WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2022-41995](https://insights.sbomify.com/CVE-2022-41995/): WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2022-41994](https://insights.sbomify.com/CVE-2022-41994/): baserCMS vulnerable to stored Cross-site Scripting (medium 4.8)
- [CVE-2022-41993](https://insights.sbomify.com/CVE-2022-41993/): Cross-site scripting in DENSHI NYUSATSU CORE SYSTEM (medium 6.1)
- [CVE-2022-41992](https://insights.sbomify.com/CVE-2022-41992/): Memory corruption in PowerISO (high 7.8)
- [CVE-2022-41991](https://insights.sbomify.com/CVE-2022-41991/): Memory corruption in QUARTZ-GOLD (critical 9.8)
- [CVE-2022-41990](https://insights.sbomify.com/CVE-2022-41990/): WordPress 3D Tag Cloud Plugin <= 3.8 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2022-4199](https://insights.sbomify.com/CVE-2022-4199/): Link Library < 7.4.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41989](https://insights.sbomify.com/CVE-2022-41989/): CVE-2022-41989 (critical 9.0)
- [CVE-2022-41988](https://insights.sbomify.com/CVE-2022-41988/): Information disclosure in OpenImageIO (medium 5.3)
- [CVE-2022-41987](https://insights.sbomify.com/CVE-2022-41987/): WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 6.3)
- [CVE-2022-41986](https://insights.sbomify.com/CVE-2022-41986/): Information disclosure in IIJ SmartKey (high 7.5)
- [CVE-2022-41985](https://insights.sbomify.com/CVE-2022-41985/): Auth bypass in uC-FTPs (high 8.6)
- [CVE-2022-41984](https://insights.sbomify.com/CVE-2022-41984/): Security feature bypass in Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition (medium 4.4)
- [CVE-2022-41983](https://insights.sbomify.com/CVE-2022-41983/): BIG-IP TMM Vulnerability CVE-2022-41983 (low 3.7)
- [CVE-2022-41982](https://insights.sbomify.com/CVE-2022-41982/): Privilege escalation in Intel(R) VTune(TM) Profiler software (medium 6.7)
- [CVE-2022-41981](https://insights.sbomify.com/CVE-2022-41981/): Memory corruption in OpenImageIO (high 8.1)
- [CVE-2022-41980](https://insights.sbomify.com/CVE-2022-41980/): WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-4198](https://insights.sbomify.com/CVE-2022-4198/): WP Social Sharing <= 2.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41979](https://insights.sbomify.com/CVE-2022-41979/): Security feature bypass in Intel(R) DCM software (medium 5.4)
- [CVE-2022-41978](https://insights.sbomify.com/CVE-2022-41978/): WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability (high 8.8)
- [CVE-2022-41977](https://insights.sbomify.com/CVE-2022-41977/): Memory corruption in OpenImageIO (medium 5.3)
- [CVE-2022-41976](https://insights.sbomify.com/CVE-2022-41976/): Privilege escalation in scada-lts:scada-lts (critical 9.9)
- [CVE-2022-41975](https://insights.sbomify.com/CVE-2022-41975/): Privilege escalation in realvnc:vnc server (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/237/