# Vulnerabilities published in 2022


- [CVE-2022-41882](https://insights.sbomify.com/CVE-2022-41882/): Nextcloud Desktop vulnerable to code injection via malicious link (medium 6.6)
- [CVE-2022-41881](https://insights.sbomify.com/CVE-2022-41881/): HAProxyMessageDecoder Stack Exhaustion DoS (medium 5.3)
- [CVE-2022-41880](https://insights.sbomify.com/CVE-2022-41880/): ThreadUnsafeUnigramCandidateSampler Heap out of bounds in Tensorflow (medium 6.8)
- [CVE-2022-4188](https://insights.sbomify.com/CVE-2022-4188/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41879](https://insights.sbomify.com/CVE-2022-41879/): Parse Server subject to Prototype pollution via Cloud Code Webhooks (high 7.2)
- [CVE-2022-41878](https://insights.sbomify.com/CVE-2022-41878/): Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers (high 7.2)
- [CVE-2022-41877](https://insights.sbomify.com/CVE-2022-41877/): Missing input length validation in `drive` channel in FreeRDP (medium 4.6)
- [CVE-2022-41876](https://insights.sbomify.com/CVE-2022-41876/): ezplatform-graphql GraphQL queries can expose password hashes (high 7.5)
- [CVE-2022-41875](https://insights.sbomify.com/CVE-2022-41875/): Remote Code Execution in Optica (critical 10.0)
- [CVE-2022-41874](https://insights.sbomify.com/CVE-2022-41874/): Tauri Filesystem Scope can be Partially Bypassed (low 2.6)
- [CVE-2022-41873](https://insights.sbomify.com/CVE-2022-41873/): Out-of-bounds read and write in BLE L2CAP module (medium 4.2)
- [CVE-2022-41871](https://insights.sbomify.com/CVE-2022-41871/): Command injection in SEPPmail (medium 6.0)
- [CVE-2022-41870](https://insights.sbomify.com/CVE-2022-41870/): Command injection in innovaphone:innovaphone firmware (high 7.2)
- [CVE-2022-4187](https://insights.sbomify.com/CVE-2022-4187/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-41862](https://insights.sbomify.com/CVE-2022-41862/): Information disclosure in postgresql (low 3.7)
- [CVE-2022-41861](https://insights.sbomify.com/CVE-2022-41861/): Denial of service in freeradius (medium 6.5)
- [CVE-2022-41860](https://insights.sbomify.com/CVE-2022-41860/): Null dereference in freeradius (high 7.5)
- [CVE-2022-4186](https://insights.sbomify.com/CVE-2022-4186/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41859](https://insights.sbomify.com/CVE-2022-41859/): Information disclosure in freeradius (high 7.5)
- [CVE-2022-41858](https://insights.sbomify.com/CVE-2022-41858/): Null dereference in Linux kernel (high 7.1)
- [CVE-2022-41854](https://insights.sbomify.com/CVE-2022-41854/): Stack Overflow in Snakeyaml (medium 5.8)
- [CVE-2022-41853](https://insights.sbomify.com/CVE-2022-41853/): Remote code execution in HyperSQL DataBase (high 8.0)
- [CVE-2022-41851](https://insights.sbomify.com/CVE-2022-41851/): Memory corruption in JTTK (high 7.8)
- [CVE-2022-41850](https://insights.sbomify.com/CVE-2022-41850/): Use after free in debian:debian linux (medium 4.7)
- [CVE-2022-4185](https://insights.sbomify.com/CVE-2022-4185/): Other in Chrome (medium 4.3)
- [CVE-2022-41849](https://insights.sbomify.com/CVE-2022-41849/): Use after free in debian:debian linux (medium 4.2)
- [CVE-2022-41848](https://insights.sbomify.com/CVE-2022-41848/): Use after free in linux:linux kernel (medium 4.2)
- [CVE-2022-41847](https://insights.sbomify.com/CVE-2022-41847/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-41846](https://insights.sbomify.com/CVE-2022-41846/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-41845](https://insights.sbomify.com/CVE-2022-41845/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-41844](https://insights.sbomify.com/CVE-2022-41844/): Memory corruption in xpdfreader:xpdf (medium 5.5)
- [CVE-2022-41843](https://insights.sbomify.com/CVE-2022-41843/): Null dereference in xpdfreader:xpdf (medium 5.5)
- [CVE-2022-41842](https://insights.sbomify.com/CVE-2022-41842/): Memory corruption in xpdfreader:xpdf (medium 5.5)
- [CVE-2022-41841](https://insights.sbomify.com/CVE-2022-41841/): Null dereference in axiosys:bento4 (medium 5.5)
- [CVE-2022-41840](https://insights.sbomify.com/CVE-2022-41840/): WordPress Welcart eCommerce plugin <= 2.7.7 - Unauth. Directory Traversal vulnerability (high 7.5)
- [CVE-2022-4184](https://insights.sbomify.com/CVE-2022-4184/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41839](https://insights.sbomify.com/CVE-2022-41839/): WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2022-41838](https://insights.sbomify.com/CVE-2022-41838/): Memory corruption in OpenImageIO (critical 9.8)
- [CVE-2022-41837](https://insights.sbomify.com/CVE-2022-41837/): Memory corruption in OpenImageIO (critical 9.8)
- [CVE-2022-41836](https://insights.sbomify.com/CVE-2022-41836/): BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836 (high 7.5)
- [CVE-2022-41835](https://insights.sbomify.com/CVE-2022-41835/): F5OS vulnerability CVE-2022-41835 (high 7.3)
- [CVE-2022-41833](https://insights.sbomify.com/CVE-2022-41833/): BIG-IP iRule vulnerability CVE-2022-41833 (high 7.5)
- [CVE-2022-41832](https://insights.sbomify.com/CVE-2022-41832/): BIG-IP SIP vulnerability CVE-2022-41832 (high 7.5)
- [CVE-2022-41831](https://insights.sbomify.com/CVE-2022-41831/): WordPress Glossary Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-41830](https://insights.sbomify.com/CVE-2022-41830/): Cross-site scripting in Kyocera Document Solutions MFPs and printers (medium 4.8)
- [CVE-2022-4183](https://insights.sbomify.com/CVE-2022-4183/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41828](https://insights.sbomify.com/CVE-2022-41828/): com.amazon.redshift:redshift-jdbc42 vulnerable to remote command execution (high 8.8)
- [CVE-2022-4182](https://insights.sbomify.com/CVE-2022-4182/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41814](https://insights.sbomify.com/CVE-2022-41814/): Potential XSS in history view (low 3.3)
- [CVE-2022-41813](https://insights.sbomify.com/CVE-2022-41813/): BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813 (medium 6.5)
- [CVE-2022-4181](https://insights.sbomify.com/CVE-2022-4181/): Use after free in Chrome (high 8.8)
- [CVE-2022-41808](https://insights.sbomify.com/CVE-2022-41808/): Memory corruption in Intel QAT Driver for Linux (low 3.3)
- [CVE-2022-41807](https://insights.sbomify.com/CVE-2022-41807/): Missing authorization in Kyocera Document Solutions MFPs and printers (medium 6.5)
- [CVE-2022-41806](https://insights.sbomify.com/CVE-2022-41806/): BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806 (high 7.5)
- [CVE-2022-41805](https://insights.sbomify.com/CVE-2022-41805/): WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-41804](https://insights.sbomify.com/CVE-2022-41804/): Privilege escalation in Intel(R) Xeon(R) Processors (high 7.2)
- [CVE-2022-41802](https://insights.sbomify.com/CVE-2022-41802/): Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. (medium 4.0)
- [CVE-2022-41801](https://insights.sbomify.com/CVE-2022-41801/): Denial of service in Intel(R) Connect M Android application (medium 5.0)
- [CVE-2022-41800](https://insights.sbomify.com/CVE-2022-41800/): Appliance mode iControl REST vulnerability (high 8.7)
- [CVE-2022-4180](https://insights.sbomify.com/CVE-2022-4180/): Use after free in Chrome (high 8.8)
- [CVE-2022-41799](https://insights.sbomify.com/CVE-2022-41799/): Missing authorization in GROWI v5 series and v4 series (medium 6.5)
- [CVE-2022-41798](https://insights.sbomify.com/CVE-2022-41798/): Auth bypass in Kyocera Document Solutions MFPs and printers (medium 6.5)
- [CVE-2022-41797](https://insights.sbomify.com/CVE-2022-41797/): Open redirect in Lemon8 App for Android and Lemon8 App for iOS (medium 6.5)
- [CVE-2022-41796](https://insights.sbomify.com/CVE-2022-41796/): Other in Content Transfer (for Windows) (high 7.8)
- [CVE-2022-41794](https://insights.sbomify.com/CVE-2022-41794/): Memory corruption in OpenImageIO (critical 9.8)
- [CVE-2022-41793](https://insights.sbomify.com/CVE-2022-41793/): Open Babel has out-of-bounds write in CSR PadString (title field) (critical 9.8)
- [CVE-2022-41791](https://insights.sbomify.com/CVE-2022-41791/): WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability (medium 6.8)
- [CVE-2022-41790](https://insights.sbomify.com/CVE-2022-41790/): WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2022-4179](https://insights.sbomify.com/CVE-2022-4179/): Use after free in Chrome (high 8.8)
- [CVE-2022-41789](https://insights.sbomify.com/CVE-2022-41789/): Potential XSS on default page header (low 3.3)
- [CVE-2022-41788](https://insights.sbomify.com/CVE-2022-41788/): WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-41787](https://insights.sbomify.com/CVE-2022-41787/): BIG-IP DNS Express vulnerability CVE-2022-41787 (high 7.5)
- [CVE-2022-41786](https://insights.sbomify.com/CVE-2022-41786/): WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2022-41785](https://insights.sbomify.com/CVE-2022-41785/): WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-41784](https://insights.sbomify.com/CVE-2022-41784/): Privilege escalation in Intel(R) OFU software (high 8.8)
- [CVE-2022-41783](https://insights.sbomify.com/CVE-2022-41783/): Denial of service in TP-Link RE300 V1 (medium 5.5)
- [CVE-2022-41781](https://insights.sbomify.com/CVE-2022-41781/): WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2022-41780](https://insights.sbomify.com/CVE-2022-41780/): F5OS CLI vulnerability CVE-2022-41780 (medium 5.5)
- [CVE-2022-4178](https://insights.sbomify.com/CVE-2022-4178/): Use after free in Chrome (high 8.8)
- [CVE-2022-41779](https://insights.sbomify.com/CVE-2022-41779/): Deserialization in InfraSuite Device Master (high 8.8)
- [CVE-2022-41778](https://insights.sbomify.com/CVE-2022-41778/): Deserialization in InfraSuite Device Master (critical 9.8)
- [CVE-2022-41777](https://insights.sbomify.com/CVE-2022-41777/): nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit (high 7.5)
- [CVE-2022-41776](https://insights.sbomify.com/CVE-2022-41776/): Missing authorization in InfraSuite Device Master (high 7.5)
- [CVE-2022-41775](https://insights.sbomify.com/CVE-2022-41775/): Delta Electronics DIAEnergie SQL Injection (high 8.8)
- [CVE-2022-41773](https://insights.sbomify.com/CVE-2022-41773/): Delta Electronics DIAEnergie (high 8.8)
- [CVE-2022-41772](https://insights.sbomify.com/CVE-2022-41772/): Path traversal in InfraSuite Device Master (critical 9.8)
- [CVE-2022-41771](https://insights.sbomify.com/CVE-2022-41771/): Misconfiguration in Intel(R) QAT drivers for Windows (medium 6.5)
- [CVE-2022-41770](https://insights.sbomify.com/CVE-2022-41770/): BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770 (medium 6.5)
- [CVE-2022-4177](https://insights.sbomify.com/CVE-2022-4177/): Use after free in Chrome (high 8.8)
- [CVE-2022-41769](https://insights.sbomify.com/CVE-2022-41769/): Privilege escalation in Intel(R) Connect M Android application (medium 4.8)
- [CVE-2022-41767](https://insights.sbomify.com/CVE-2022-41767/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2022-41766](https://insights.sbomify.com/CVE-2022-41766/): Information disclosure in mediawiki:mediawiki (medium 4.3)
- [CVE-2022-41765](https://insights.sbomify.com/CVE-2022-41765/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2022-41763](https://insights.sbomify.com/CVE-2022-41763/): Code injection in nokia:access management system (high 8.8)
- [CVE-2022-41762](https://insights.sbomify.com/CVE-2022-41762/): Cross-site scripting in nokia:network functions manager for transport (medium 6.1)
- [CVE-2022-41761](https://insights.sbomify.com/CVE-2022-41761/): Path traversal in nokia:network functions manager for transport (medium 6.5)
- [CVE-2022-41760](https://insights.sbomify.com/CVE-2022-41760/): Path traversal in nokia:network functions manager for transport (medium 6.5)
- [CVE-2022-4176](https://insights.sbomify.com/CVE-2022-4176/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-41757](https://insights.sbomify.com/CVE-2022-41757/): Use after free in arm:valhall gpu kernel driver (high 8.8)
- [CVE-2022-41751](https://insights.sbomify.com/CVE-2022-41751/): Command injection in debian:debian linux (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/239/