# Vulnerabilities published in 2022


- [CVE-2022-41407](https://insights.sbomify.com/CVE-2022-41407/): SQL injection in online pet shop we app project:online pet shop we app (high 7.2)
- [CVE-2022-41406](https://insights.sbomify.com/CVE-2022-41406/): File upload in church management system project:church management system (high 7.2)
- [CVE-2022-41404](https://insights.sbomify.com/CVE-2022-41404/): org.ini4j allows attackers to cause a Denial of Service (DoS) (high 7.5)
- [CVE-2022-41403](https://insights.sbomify.com/CVE-2022-41403/): SQL injection in newsletter subscribe \(popup \+ regular module\) project:newsletter subscribe \(popup \+ regular module\) (critical 9.8)
- [CVE-2022-41401](https://insights.sbomify.com/CVE-2022-41401/): OpenRefine Server-Side Request Forgery vulnerability (medium 6.5)
- [CVE-2022-41400](https://insights.sbomify.com/CVE-2022-41400/): Hardcoded credentials in sage:sage 300 (critical 9.8)
- [CVE-2022-4140](https://insights.sbomify.com/CVE-2022-4140/): Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access (high 7.5)
- [CVE-2022-41399](https://insights.sbomify.com/CVE-2022-41399/): Hardcoded credentials in sage:sage 300 (high 7.5)
- [CVE-2022-41398](https://insights.sbomify.com/CVE-2022-41398/): Hardcoded credentials in sage:sage 300 (high 7.5)
- [CVE-2022-41397](https://insights.sbomify.com/CVE-2022-41397/): Hardcoded credentials in sage:sage 300 (critical 9.8)
- [CVE-2022-41396](https://insights.sbomify.com/CVE-2022-41396/): Command injection in tenda:w15e firmware (high 7.8)
- [CVE-2022-41395](https://insights.sbomify.com/CVE-2022-41395/): Command injection in tenda:w15e firmware (high 7.8)
- [CVE-2022-41392](https://insights.sbomify.com/CVE-2022-41392/): Cross-site scripting in totaljs:total.js (medium 5.4)
- [CVE-2022-41391](https://insights.sbomify.com/CVE-2022-41391/): SQL injection in ocomon project:ocomon (critical 9.8)
- [CVE-2022-41390](https://insights.sbomify.com/CVE-2022-41390/): SQL injection in ocomon project:ocomon (critical 9.8)
- [CVE-2022-4139](https://insights.sbomify.com/CVE-2022-4139/): Memory corruption in kernel (high 7.8)
- [CVE-2022-41387](https://insights.sbomify.com/CVE-2022-41387/): Supply chain in democritus:d8s-pdfs (critical 9.8)
- [CVE-2022-41386](https://insights.sbomify.com/CVE-2022-41386/): Supply chain in democritus:d8s-utility (critical 9.8)
- [CVE-2022-41385](https://insights.sbomify.com/CVE-2022-41385/): Supply chain in democritus:d8s-html (critical 9.8)
- [CVE-2022-41384](https://insights.sbomify.com/CVE-2022-41384/): Supply chain in democritus:d8s-domains (critical 9.8)
- [CVE-2022-41383](https://insights.sbomify.com/CVE-2022-41383/): Supply chain in democritus:d8s-archives (critical 9.8)
- [CVE-2022-41382](https://insights.sbomify.com/CVE-2022-41382/): Supply chain in democritus:d8s-json (critical 9.8)
- [CVE-2022-41381](https://insights.sbomify.com/CVE-2022-41381/): Supply chain in democritus:d8s-utility (critical 9.8)
- [CVE-2022-41380](https://insights.sbomify.com/CVE-2022-41380/): Supply chain in democritus:d8s-yaml (critical 9.8)
- [CVE-2022-4138](https://insights.sbomify.com/CVE-2022-4138/): Cross-site request forgery in GitLab (medium 6.4)
- [CVE-2022-41379](https://insights.sbomify.com/CVE-2022-41379/): File upload in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-41378](https://insights.sbomify.com/CVE-2022-41378/): SQL injection in online pet shop we app project:online pet shop we app (high 7.2)
- [CVE-2022-41377](https://insights.sbomify.com/CVE-2022-41377/): SQL injection in online pet shop we app project:online pet shop we app (high 7.2)
- [CVE-2022-41376](https://insights.sbomify.com/CVE-2022-41376/): Cross site scripting in Metro UI (medium 6.1)
- [CVE-2022-4137](https://insights.sbomify.com/CVE-2022-4137/): Keycloak: reflected xss attack (high 8.1)
- [CVE-2022-4136](https://insights.sbomify.com/CVE-2022-4136/): Exposed Dangerous Method or Function in qmpaas/leadshop (high 8.6)
- [CVE-2022-41358](https://insights.sbomify.com/CVE-2022-41358/): Cross-site scripting in garage management system project:garage management system (medium 5.4)
- [CVE-2022-41355](https://insights.sbomify.com/CVE-2022-41355/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-41354](https://insights.sbomify.com/CVE-2022-41354/): Argo CD authenticated but unauthorized users may enumerate Application names via the API (medium 4.3)
- [CVE-2022-41352](https://insights.sbomify.com/CVE-2022-41352/): Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload (critical 9.8, exploited in the wild)
- [CVE-2022-41351](https://insights.sbomify.com/CVE-2022-41351/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2022-41350](https://insights.sbomify.com/CVE-2022-41350/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2022-4135](https://insights.sbomify.com/CVE-2022-4135/): Google Chromium GPU Heap Buffer Overflow (critical 9.6, exploited in the wild)
- [CVE-2022-41349](https://insights.sbomify.com/CVE-2022-41349/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2022-41348](https://insights.sbomify.com/CVE-2022-41348/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2022-41347](https://insights.sbomify.com/CVE-2022-41347/): Privilege escalation in zimbra:collaboration (high 7.8)
- [CVE-2022-41343](https://insights.sbomify.com/CVE-2022-41343/): Dompdf allows remote file inclusion because URI validation failure does not halt font registration (high 7.5)
- [CVE-2022-41342](https://insights.sbomify.com/CVE-2022-41342/): Memory corruption in Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits (medium 6.0)
- [CVE-2022-41340](https://insights.sbomify.com/CVE-2022-41340/): secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery (high 7.5)
- [CVE-2022-4134](https://insights.sbomify.com/CVE-2022-4134/): OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability (low 2.8)
- [CVE-2022-41339](https://insights.sbomify.com/CVE-2022-41339/): Privilege escalation in zohocorp:manageengine mobile device manager plus (high 7.8)
- [CVE-2022-41336](https://insights.sbomify.com/CVE-2022-41336/): Cross-site scripting in FortiPortal (medium 6.6)
- [CVE-2022-41335](https://insights.sbomify.com/CVE-2022-41335/): Path traversal in FortiOS (high 8.6)
- [CVE-2022-41334](https://insights.sbomify.com/CVE-2022-41334/): Cross-site scripting in FortiOS (high 8.6)
- [CVE-2022-41333](https://insights.sbomify.com/CVE-2022-41333/): Denial of service in FortiRecorder (medium 6.8)
- [CVE-2022-41331](https://insights.sbomify.com/CVE-2022-41331/): Auth bypass in FortiPresence (critical 9.3)
- [CVE-2022-41330](https://insights.sbomify.com/CVE-2022-41330/): Cross-site scripting in FortiOS (high 8.3)
- [CVE-2022-41329](https://insights.sbomify.com/CVE-2022-41329/): Information disclosure in FortiOS (medium 5.2)
- [CVE-2022-41328](https://insights.sbomify.com/CVE-2022-41328/): Fortinet FortiOS Path Traversal (medium 6.5, exploited in the wild)
- [CVE-2022-41327](https://insights.sbomify.com/CVE-2022-41327/): Information disclosure in FortiOS (high 7.6)
- [CVE-2022-41326](https://insights.sbomify.com/CVE-2022-41326/): Missing authorization in mitel:micollab (critical 9.8)
- [CVE-2022-41325](https://insights.sbomify.com/CVE-2022-41325/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2022-41324](https://insights.sbomify.com/CVE-2022-41324/): Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read acc (medium 6.5)
- [CVE-2022-41323](https://insights.sbomify.com/CVE-2022-41323/): Django denial-of-service vulnerability in internationalized URLs (high 7.5)
- [CVE-2022-41322](https://insights.sbomify.com/CVE-2022-41322/): Code injection in fedoraproject:fedora (high 7.8)
- [CVE-2022-41320](https://insights.sbomify.com/CVE-2022-41320/): Information disclosure in veritas:system recovery (medium 6.5)
- [CVE-2022-4132](https://insights.sbomify.com/CVE-2022-4132/): Memory leak on tls connections (medium 5.9)
- [CVE-2022-41319](https://insights.sbomify.com/CVE-2022-41319/): Cross-site scripting in veritas:desktop and laptop option (medium 6.1)
- [CVE-2022-41318](https://insights.sbomify.com/CVE-2022-41318/): Integer overflow in squid-cache:squid (high 8.6)
- [CVE-2022-41317](https://insights.sbomify.com/CVE-2022-41317/): Information disclosure in squid-cache:squid (medium 6.5)
- [CVE-2022-41316](https://insights.sbomify.com/CVE-2022-41316/): HashiCorp Vault's revocation list not respected (medium 5.3)
- [CVE-2022-41315](https://insights.sbomify.com/CVE-2022-41315/): WordPress Ezoic plugin <= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-41314](https://insights.sbomify.com/CVE-2022-41314/): Privilege escalation in Intel(R) Network Adapter installer software (medium 6.7)
- [CVE-2022-41313](https://insights.sbomify.com/CVE-2022-41313/): Cross-site scripting in SDS-3008 Series Industrial Ethernet Switch (medium 4.3)
- [CVE-2022-41312](https://insights.sbomify.com/CVE-2022-41312/): Cross-site scripting in SDS-3008 Series Industrial Ethernet Switch (medium 4.3)
- [CVE-2022-41311](https://insights.sbomify.com/CVE-2022-41311/): Cross-site scripting in SDS-3008 Series Industrial Ethernet Switch (medium 4.3)
- [CVE-2022-41310](https://insights.sbomify.com/CVE-2022-41310/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-4131](https://insights.sbomify.com/CVE-2022-4131/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-41309](https://insights.sbomify.com/CVE-2022-41309/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-41308](https://insights.sbomify.com/CVE-2022-41308/): Memory corruption in Subassembly Composer (high 7.8)
- [CVE-2022-41307](https://insights.sbomify.com/CVE-2022-41307/): Memory corruption in Subassembly Composer (high 7.8)
- [CVE-2022-41306](https://insights.sbomify.com/CVE-2022-41306/): Memory corruption in Autodesk® Design Review (high 7.8)
- [CVE-2022-41305](https://insights.sbomify.com/CVE-2022-41305/): Memory corruption in Subassembly Composer (high 7.8)
- [CVE-2022-41304](https://insights.sbomify.com/CVE-2022-41304/): Memory corruption in FBX SDK (high 7.8)
- [CVE-2022-41303](https://insights.sbomify.com/CVE-2022-41303/): Use after free in FBX SDK (high 7.8)
- [CVE-2022-41302](https://insights.sbomify.com/CVE-2022-41302/): Memory corruption in FBX SDK (high 7.8)
- [CVE-2022-41301](https://insights.sbomify.com/CVE-2022-41301/): Memory corruption in Subassembly Composer (high 7.8)
- [CVE-2022-4130](https://insights.sbomify.com/CVE-2022-4130/): Server-side request forgery in Satellite Server (medium 4.5)
- [CVE-2022-41299](https://insights.sbomify.com/CVE-2022-41299/): IBM Cloud Transformation Advisor cross-site scripting (medium 4.4)
- [CVE-2022-41297](https://insights.sbomify.com/CVE-2022-41297/): IBM Db2U cross-site request forgery (medium 4.3)
- [CVE-2022-41296](https://insights.sbomify.com/CVE-2022-41296/): IBM Db2U cross-site respect forgery (medium 6.5)
- [CVE-2022-41294](https://insights.sbomify.com/CVE-2022-41294/): Misconfiguration in Robotic Process Automation (medium 6.5)
- [CVE-2022-41291](https://insights.sbomify.com/CVE-2022-41291/): Auth bypass in InfoSphere Information Server (medium 6.3)
- [CVE-2022-41290](https://insights.sbomify.com/CVE-2022-41290/): IBM AIX privilege escalation (high 8.4)
- [CVE-2022-4129](https://insights.sbomify.com/CVE-2022-4129/): Race condition in Linux kernel (l2tp) (medium 5.5)
- [CVE-2022-41288](https://insights.sbomify.com/CVE-2022-41288/): Denial of service in JT2Go (low 3.3)
- [CVE-2022-41287](https://insights.sbomify.com/CVE-2022-41287/): Denial of service in JT2Go (low 3.3)
- [CVE-2022-41286](https://insights.sbomify.com/CVE-2022-41286/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41285](https://insights.sbomify.com/CVE-2022-41285/): Use after free in JT2Go (high 7.8)
- [CVE-2022-41284](https://insights.sbomify.com/CVE-2022-41284/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41283](https://insights.sbomify.com/CVE-2022-41283/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41282](https://insights.sbomify.com/CVE-2022-41282/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41281](https://insights.sbomify.com/CVE-2022-41281/): Memory corruption in JT2Go (high 7.8)
- [CVE-2022-41280](https://insights.sbomify.com/CVE-2022-41280/): Null dereference in JT2Go (low 3.3)
- [CVE-2022-4128](https://insights.sbomify.com/CVE-2022-4128/): Null dereference in Linux kernel (mptcp) (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/243/