# Vulnerabilities published in 2022


- [CVE-2022-4175](https://insights.sbomify.com/CVE-2022-4175/): Use after free in Chrome (high 8.8)
- [CVE-2022-41749](https://insights.sbomify.com/CVE-2022-41749/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-41748](https://insights.sbomify.com/CVE-2022-41748/): Misconfiguration in Trend Micro Apex One (medium 6.7)
- [CVE-2022-41747](https://insights.sbomify.com/CVE-2022-41747/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-41746](https://insights.sbomify.com/CVE-2022-41746/): Privilege escalation in Trend Micro Apex One (critical 9.1)
- [CVE-2022-41745](https://insights.sbomify.com/CVE-2022-41745/): Memory corruption in Trend Micro Apex One (high 7.0)
- [CVE-2022-41744](https://insights.sbomify.com/CVE-2022-41744/): Race condition in Trend Micro Apex One (high 7.0)
- [CVE-2022-41743](https://insights.sbomify.com/CVE-2022-41743/): NGINX ngx_http_hls_module vulnerability CVE-2022-41743 (high 7.0)
- [CVE-2022-41742](https://insights.sbomify.com/CVE-2022-41742/): NGINX ngx_http_mp4_module vulnerability CVE-2022-41742 (high 7.1)
- [CVE-2022-41741](https://insights.sbomify.com/CVE-2022-41741/): NGINX ngx_http_mp4_module vulnerability CVE-2022-41741 (high 7.0)
- [CVE-2022-41740](https://insights.sbomify.com/CVE-2022-41740/): IBM Robotic Process Automation information disclosure (medium 4.6)
- [CVE-2022-4174](https://insights.sbomify.com/CVE-2022-4174/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-41739](https://insights.sbomify.com/CVE-2022-41739/): IBM Spectrum Scale privilege escalation (high 7.9)
- [CVE-2022-41738](https://insights.sbomify.com/CVE-2022-41738/): IBM Spectrum Scale security bypass (high 7.5)
- [CVE-2022-41737](https://insights.sbomify.com/CVE-2022-41737/): IBM Spectrum Scale security bypass (high 7.1)
- [CVE-2022-41736](https://insights.sbomify.com/CVE-2022-41736/): IBM Spectrum Scale Container Native Storage Access privilege escalation (high 8.4)
- [CVE-2022-41735](https://insights.sbomify.com/CVE-2022-41735/): IBM Business Process Manager cross-site scripting (medium 5.4)
- [CVE-2022-41734](https://insights.sbomify.com/CVE-2022-41734/): IBM Maximo Asset Management information disclosure (medium 5.3)
- [CVE-2022-41733](https://insights.sbomify.com/CVE-2022-41733/): IBM InfoSphere Information Server denial of service (medium 5.3)
- [CVE-2022-41732](https://insights.sbomify.com/CVE-2022-41732/): IBM Maximo information disclosure (medium 6.2)
- [CVE-2022-41731](https://insights.sbomify.com/CVE-2022-41731/): IBM Watson Knowledge Catalog on Cloud Pak SQL injection (high 8.6)
- [CVE-2022-4173](https://insights.sbomify.com/CVE-2022-4173/): Avast and AVG Antivirus for Windows vulnerable to Privilege Escalation (high 7.3)
- [CVE-2022-41727](https://insights.sbomify.com/CVE-2022-41727/): Denial of service via crafted TIFF image in golang.org/x/image/tiff (medium 5.5)
- [CVE-2022-41725](https://insights.sbomify.com/CVE-2022-41725/): Excessive resource consumption in mime/multipart (high 7.5)
- [CVE-2022-41724](https://insights.sbomify.com/CVE-2022-41724/): Panic on large handshake records in crypto/tls (high 7.5)
- [CVE-2022-41723](https://insights.sbomify.com/CVE-2022-41723/): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net (high 7.5)
- [CVE-2022-41722](https://insights.sbomify.com/CVE-2022-41722/): Path traversal on Windows in path/filepath (high 7.5)
- [CVE-2022-41721](https://insights.sbomify.com/CVE-2022-41721/): Request smuggling due to improper request handling in golang.org/x/net/http2/h2c (high 7.5)
- [CVE-2022-41720](https://insights.sbomify.com/CVE-2022-41720/): Restricted file access on Windows in os and net/http (high 7.5)
- [CVE-2022-4172](https://insights.sbomify.com/CVE-2022-4172/): Integer overflow in QEMU (ACPI ERST) (medium 6.5)
- [CVE-2022-41719](https://insights.sbomify.com/CVE-2022-41719/): Panic in github.com/shamaton/msgpack/v2 (high 7.5)
- [CVE-2022-41717](https://insights.sbomify.com/CVE-2022-41717/): Excessive memory growth in net/http and golang.org/x/net/http2 (medium 5.3)
- [CVE-2022-41716](https://insights.sbomify.com/CVE-2022-41716/): Unsanitized NUL in environment variables on Windows in syscall and os/exec (medium 6.3)
- [CVE-2022-41715](https://insights.sbomify.com/CVE-2022-41715/): Memory exhaustion when compiling regular expressions in regexp/syntax (high 7.5)
- [CVE-2022-41714](https://insights.sbomify.com/CVE-2022-41714/): fastest-json-copy 1.0.1 - Prototype Pollution (medium 5.3)
- [CVE-2022-41713](https://insights.sbomify.com/CVE-2022-41713/): deep-object-diff 1.1.0 - Prototype Pollution (medium 5.3)
- [CVE-2022-41712](https://insights.sbomify.com/CVE-2022-41712/): Path traversal in Frappe (medium 6.5)
- [CVE-2022-41711](https://insights.sbomify.com/CVE-2022-41711/): Badaso vulnerable to Remote Code Execution via malicious file upload (critical 9.8)
- [CVE-2022-41710](https://insights.sbomify.com/CVE-2022-41710/): Markdownify has Files or Directories Accessible to External Parties (medium 5.5)
- [CVE-2022-4171](https://insights.sbomify.com/CVE-2022-4171/): demon image annotation <= 5.0 - Improper Input Restriction Validation (medium 6.5)
- [CVE-2022-41709](https://insights.sbomify.com/CVE-2022-41709/): Markdownify subject to Remote Code Execution via malicious markdown file (high 7.8)
- [CVE-2022-41708](https://insights.sbomify.com/CVE-2022-41708/): Missing authorization in relatedcode/Messenger (medium 4.3)
- [CVE-2022-41707](https://insights.sbomify.com/CVE-2022-41707/): Information disclosure in relatedcode/Messenger (medium 6.5)
- [CVE-2022-41706](https://insights.sbomify.com/CVE-2022-41706/): Browsershot 3.57.2 - Server Side XSS to LFR via URL (high 8.2)
- [CVE-2022-41705](https://insights.sbomify.com/CVE-2022-41705/): Badaso vulnerable to Remote Code Execution (RCE) (critical 9.8)
- [CVE-2022-41704](https://insights.sbomify.com/CVE-2022-41704/): Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input (high 7.5)
- [CVE-2022-41703](https://insights.sbomify.com/CVE-2022-41703/): Apache Superset: SQL injection vulnerability in adhoc clauses (medium 5.4)
- [CVE-2022-41702](https://insights.sbomify.com/CVE-2022-41702/): Delta Electronics DIAEnergie (high 8.7)
- [CVE-2022-41701](https://insights.sbomify.com/CVE-2022-41701/): Delta Electronics DIAEnergie (high 8.7)
- [CVE-2022-41700](https://insights.sbomify.com/CVE-2022-41700/): Privilege escalation in Intel(R) NUC Pro Software Suite installation software (medium 6.7)
- [CVE-2022-4170](https://insights.sbomify.com/CVE-2022-4170/): Code injection in rxvt-unicode (critical 9.8)
- [CVE-2022-41699](https://insights.sbomify.com/CVE-2022-41699/): Privilege escalation in Intel(R) QAT drivers for Windows (high 8.2)
- [CVE-2022-41698](https://insights.sbomify.com/CVE-2022-41698/): WordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access Control (medium 6.5)
- [CVE-2022-41697](https://insights.sbomify.com/CVE-2022-41697/): Information disclosure in Ghost (medium 5.3)
- [CVE-2022-41696](https://insights.sbomify.com/CVE-2022-41696/): CVE-2022-41696 (medium 5.5)
- [CVE-2022-41695](https://insights.sbomify.com/CVE-2022-41695/): WordPress Traffic Manager Plugin <= 1.4.5 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2022-41694](https://insights.sbomify.com/CVE-2022-41694/): BIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694 (medium 4.9)
- [CVE-2022-41693](https://insights.sbomify.com/CVE-2022-41693/): Privilege escalation in Intel(R) Quartus(R) Prime Pro edition software (medium 6.7)
- [CVE-2022-41692](https://insights.sbomify.com/CVE-2022-41692/): WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-41691](https://insights.sbomify.com/CVE-2022-41691/): BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691 (high 7.5)
- [CVE-2022-41690](https://insights.sbomify.com/CVE-2022-41690/): Privilege escalation in Intel(R) Retail Edge Mobile iOS application (high 7.1)
- [CVE-2022-4169](https://insights.sbomify.com/CVE-2022-4169/): Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization (medium 6.5)
- [CVE-2022-41689](https://insights.sbomify.com/CVE-2022-41689/): Privilege escalation in Intel In-Band Manageability software (high 7.3)
- [CVE-2022-41688](https://insights.sbomify.com/CVE-2022-41688/): Auth bypass in InfraSuite Device Master (critical 9.8)
- [CVE-2022-41687](https://insights.sbomify.com/CVE-2022-41687/): Privilege escalation in Intel(R) NUC P14E Laptop Element software for Windows 10 (medium 6.7)
- [CVE-2022-41686](https://insights.sbomify.com/CVE-2022-41686/): Memory corruption in OpenHarmony (medium 5.1)
- [CVE-2022-41685](https://insights.sbomify.com/CVE-2022-41685/): Cross-site request forgery in Csomagpontok és szállítási címkék WooCommerce-hez (WordPress plugin) (medium 5.4)
- [CVE-2022-41684](https://insights.sbomify.com/CVE-2022-41684/): Memory corruption in OpenImageIO (high 7.5)
- [CVE-2022-41681](https://insights.sbomify.com/CVE-2022-41681/): File Upload vulnerability in Forma LMS (critical 9.9)
- [CVE-2022-41680](https://insights.sbomify.com/CVE-2022-41680/): SQL Injection in Forma LMS (high 7.6)
- [CVE-2022-41679](https://insights.sbomify.com/CVE-2022-41679/): Cross-site scripting in Forma LMS version (medium 4.7)
- [CVE-2022-41678](https://insights.sbomify.com/CVE-2022-41678/): Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE (high 8.8)
- [CVE-2022-41677](https://insights.sbomify.com/CVE-2022-41677/): Information disclosure in Camera Firmware (medium 5.3)
- [CVE-2022-41676](https://insights.sbomify.com/CVE-2022-41676/): TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Cross-Site Scripting (medium 5.4)
- [CVE-2022-41675](https://insights.sbomify.com/CVE-2022-41675/): TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Formula Injection (high 8.0)
- [CVE-2022-41674](https://insights.sbomify.com/CVE-2022-41674/): Memory corruption in debian:debian linux (high 8.1)
- [CVE-2022-41672](https://insights.sbomify.com/CVE-2022-41672/): Session still functional after user is deactivated (high 8.1)
- [CVE-2022-41671](https://insights.sbomify.com/CVE-2022-41671/): SQL injection in EcoStruxure Operator Terminal Expert (high 7.0)
- [CVE-2022-41670](https://insights.sbomify.com/CVE-2022-41670/): Path traversal in EcoStruxure Operator Terminal Expert (high 7.0)
- [CVE-2022-4167](https://insights.sbomify.com/CVE-2022-4167/): Missing authorization in GitLab (medium 5.3)
- [CVE-2022-41669](https://insights.sbomify.com/CVE-2022-41669/): Security feature bypass in EcoStruxure Operator Terminal Expert (high 7.0)
- [CVE-2022-41668](https://insights.sbomify.com/CVE-2022-41668/): Code injection in EcoStruxure Operator Terminal Expert (high 7.0)
- [CVE-2022-41667](https://insights.sbomify.com/CVE-2022-41667/): Path traversal in EcoStruxure Operator Terminal Expert (high 7.0)
- [CVE-2022-41666](https://insights.sbomify.com/CVE-2022-41666/): Security feature bypass in EcoStruxure Operator Terminal Expert (high 7.0)
- [CVE-2022-41665](https://insights.sbomify.com/CVE-2022-41665/): Other in SICAM P850 (critical 9.8)
- [CVE-2022-41664](https://insights.sbomify.com/CVE-2022-41664/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41663](https://insights.sbomify.com/CVE-2022-41663/): Use after free in JT2Go (high 7.8)
- [CVE-2022-41662](https://insights.sbomify.com/CVE-2022-41662/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41661](https://insights.sbomify.com/CVE-2022-41661/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41660](https://insights.sbomify.com/CVE-2022-41660/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-4166](https://insights.sbomify.com/CVE-2022-4166/): Contest Gallery < 19.1.5 - Author+ SQL Injection (medium 6.5)
- [CVE-2022-41659](https://insights.sbomify.com/CVE-2022-41659/): Missing authorization in Intel Unison software (low 1.9)
- [CVE-2022-41658](https://insights.sbomify.com/CVE-2022-41658/): Privilege escalation in Intel(R) VTune(TM) Profiler software (medium 6.7)
- [CVE-2022-41657](https://insights.sbomify.com/CVE-2022-41657/): Path traversal in InfraSuite Device Master (critical 9.8)
- [CVE-2022-41656](https://insights.sbomify.com/CVE-2022-41656/): WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-41655](https://insights.sbomify.com/CVE-2022-41655/): WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2022-41654](https://insights.sbomify.com/CVE-2022-41654/): ghost vulnerable to unauthorized newsletter modification via improper access controls (critical 9.6)
- [CVE-2022-41653](https://insights.sbomify.com/CVE-2022-41653/): Hardcoded credentials in SVMPC1 (critical 9.8)
- [CVE-2022-41652](https://insights.sbomify.com/CVE-2022-41652/): WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability (medium 6.5)
- [CVE-2022-41651](https://insights.sbomify.com/CVE-2022-41651/): Delta Electronics DIAEnergie (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/240/