# Vulnerabilities published in 2022


- [CVE-2022-41279](https://insights.sbomify.com/CVE-2022-41279/): Null dereference in JT2Go (low 3.3)
- [CVE-2022-41278](https://insights.sbomify.com/CVE-2022-41278/): Null dereference in JT2Go (low 3.3)
- [CVE-2022-41275](https://insights.sbomify.com/CVE-2022-41275/): Open redirect in Solution Manager (Enterprise Search) (medium 6.1)
- [CVE-2022-41274](https://insights.sbomify.com/CVE-2022-41274/): Missing authorization in Disclosure Management (medium 6.5)
- [CVE-2022-41273](https://insights.sbomify.com/CVE-2022-41273/): Open redirect in Sourcing and SAP Contract Lifecycle Management (medium 4.3)
- [CVE-2022-41272](https://insights.sbomify.com/CVE-2022-41272/): Missing authorization in NetWeaver Process Integration (critical 9.9)
- [CVE-2022-41271](https://insights.sbomify.com/CVE-2022-41271/): Missing authorization in NetWeaver Process Integration (critical 9.4)
- [CVE-2022-4127](https://insights.sbomify.com/CVE-2022-4127/): Null dereference in Linux kernel (io uring) (medium 5.5)
- [CVE-2022-41268](https://insights.sbomify.com/CVE-2022-41268/): Privilege escalation in Business Planning and Consolidation (high 8.5)
- [CVE-2022-41267](https://insights.sbomify.com/CVE-2022-41267/): File upload in BusinessObjects Business Intelligence Platform (critical 9.9)
- [CVE-2022-41266](https://insights.sbomify.com/CVE-2022-41266/): Cross-site scripting in Commerce Webservices 2.0 (Swagger UI) (high 8.0)
- [CVE-2022-41264](https://insights.sbomify.com/CVE-2022-41264/): Code injection in BASIS (high 8.8)
- [CVE-2022-41263](https://insights.sbomify.com/CVE-2022-41263/): Missing authorization in Business Objects Business Intelligence Platform (Web intelligence) (medium 4.3)
- [CVE-2022-41262](https://insights.sbomify.com/CVE-2022-41262/): Cross-site scripting in NetWeaver AS for Java (Http Provider Service) (medium 6.1)
- [CVE-2022-41261](https://insights.sbomify.com/CVE-2022-41261/): Information disclosure in Solution Manager (Diagnostic Agent) (medium 6.0)
- [CVE-2022-41260](https://insights.sbomify.com/CVE-2022-41260/): Cross-site scripting in SAP Financial Consolidation (medium 6.1)
- [CVE-2022-4126](https://insights.sbomify.com/CVE-2022-4126/): Use of Default Password (critical 9.6)
- [CVE-2022-41259](https://insights.sbomify.com/CVE-2022-41259/): Denial of service in SAP SQL Anywhere (medium 6.5)
- [CVE-2022-41258](https://insights.sbomify.com/CVE-2022-41258/): Cross-site scripting in SAP Financial Consolidation (medium 6.5)
- [CVE-2022-41255](https://insights.sbomify.com/CVE-2022-41255/): API token stored in plain text by Jenkins CONS3RT Plugin (medium 6.5)
- [CVE-2022-41254](https://insights.sbomify.com/CVE-2022-41254/): Missing permission checks in Jenkins CONS3RT Plugin allow capturing credentials (medium 6.5)
- [CVE-2022-41253](https://insights.sbomify.com/CVE-2022-41253/): CSRF vulnerability in Jenkins CONS3RT Plugin allow capturing credentials (high 8.8)
- [CVE-2022-41252](https://insights.sbomify.com/CVE-2022-41252/): Missing permission checks in Jenkins CONS3RT Plugin allow enumerating credentials IDs (medium 4.3)
- [CVE-2022-41251](https://insights.sbomify.com/CVE-2022-41251/): Jenkins Apprenda Plugin has Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-41250](https://insights.sbomify.com/CVE-2022-41250/): Missing permission check in Jenkins SCM HttpClient Plugin allow capturing credentials (medium 6.5)
- [CVE-2022-4125](https://insights.sbomify.com/CVE-2022-4125/): Popup Manager <= 1.6.6 - Unauthenticated Stored XSS (medium 4.3)
- [CVE-2022-41249](https://insights.sbomify.com/CVE-2022-41249/): Jenkins SCM HttpClient Plugin vulnerable to Cross-Site Request Forgery (high 8.8)
- [CVE-2022-41248](https://insights.sbomify.com/CVE-2022-41248/): Jenkins BigPanda Notifier Plugin Missing Password Field Masking (medium 5.3)
- [CVE-2022-41247](https://insights.sbomify.com/CVE-2022-41247/): Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted (medium 4.3)
- [CVE-2022-41246](https://insights.sbomify.com/CVE-2022-41246/): CSRF vulnerability and mM (medium 6.5)
- [CVE-2022-41245](https://insights.sbomify.com/CVE-2022-41245/): CSRF vulnerability in Jenkins Worksoft Execution Manager Plugin allows capturing credentials (high 8.8)
- [CVE-2022-41244](https://insights.sbomify.com/CVE-2022-41244/): Missing hostname validation in Jenkins View26 Test-Reporting Plugin (high 8.1)
- [CVE-2022-41243](https://insights.sbomify.com/CVE-2022-41243/): Jenkins SmallTest Plugin missing hostname validation (high 8.1)
- [CVE-2022-41242](https://insights.sbomify.com/CVE-2022-41242/): Jenkins extreme-feedback Plugin vulnerable to Missing Authorization (medium 5.4)
- [CVE-2022-41241](https://insights.sbomify.com/CVE-2022-41241/): Jenkins RQM Plugin vulnerable to Improper Restriction of XML External Entity Reference (critical 9.8)
- [CVE-2022-41240](https://insights.sbomify.com/CVE-2022-41240/): Stored XSS vulnerability in Jenkins Walti plugin (medium 5.4)
- [CVE-2022-4124](https://insights.sbomify.com/CVE-2022-4124/): Popup Manager <= 1.6.6 - Unauthenticated Arbitrary Popup Deletion (medium 4.3)
- [CVE-2022-41239](https://insights.sbomify.com/CVE-2022-41239/): Stored XSS vulnerability in Jenkins DotCi Plugin (medium 5.4)
- [CVE-2022-41238](https://insights.sbomify.com/CVE-2022-41238/): Lack of authentication mechanism in Jenkins DotCi Plugin webhook (critical 9.8)
- [CVE-2022-41237](https://insights.sbomify.com/CVE-2022-41237/): RCE vulnerability in Jenkins DotCi Plugin (critical 9.8)
- [CVE-2022-41236](https://insights.sbomify.com/CVE-2022-41236/): CSRF vulnerability in Jenkins Security Inspector plugin (high 8.8)
- [CVE-2022-41235](https://insights.sbomify.com/CVE-2022-41235/): Jenkins WildFly Deployer Plugin vulnerable to path traversal (medium 5.3)
- [CVE-2022-41234](https://insights.sbomify.com/CVE-2022-41234/): Missing webhook endpoint authorization in Jenkins Rundeck Plugin (high 8.8)
- [CVE-2022-41233](https://insights.sbomify.com/CVE-2022-41233/): Jenkins Rundeck Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-41232](https://insights.sbomify.com/CVE-2022-41232/): Jenkins build-publisher plugin vulnerable to cross-site request forgery (high 8.0)
- [CVE-2022-41231](https://insights.sbomify.com/CVE-2022-41231/): Path traversal in Jenkins build-publisher Plugin (medium 5.7)
- [CVE-2022-41230](https://insights.sbomify.com/CVE-2022-41230/): Missing permission check in Jenkins build-publisher Plugin (medium 4.3)
- [CVE-2022-4123](https://insights.sbomify.com/CVE-2022-4123/): Buildah (as part of Podman) vulnerable to Path Traversal (low 3.3)
- [CVE-2022-41229](https://insights.sbomify.com/CVE-2022-41229/): Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2022-41228](https://insights.sbomify.com/CVE-2022-41228/): Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization (high 8.8)
- [CVE-2022-41227](https://insights.sbomify.com/CVE-2022-41227/): Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-Site Request Forgery (high 8.8)
- [CVE-2022-41226](https://insights.sbomify.com/CVE-2022-41226/): Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference (critical 9.8)
- [CVE-2022-41225](https://insights.sbomify.com/CVE-2022-41225/): Jenkins Anchore Container Image Scanner Plugin vulnerable to cross site scripting (medium 5.4)
- [CVE-2022-41224](https://insights.sbomify.com/CVE-2022-41224/): Jenkins vulnerable to stored cross site scripting in the I:helpIcon component (medium 5.4)
- [CVE-2022-41223](https://insights.sbomify.com/CVE-2022-41223/): Mitel MiVoice Connect Code Injection (medium 6.8, exploited in the wild)
- [CVE-2022-41222](https://insights.sbomify.com/CVE-2022-41222/): Use after free in canonical:ubuntu linux (high 7.0)
- [CVE-2022-41221](https://insights.sbomify.com/CVE-2022-41221/): XML external entity in opentext:archive center administration (high 7.1)
- [CVE-2022-41220](https://insights.sbomify.com/CVE-2022-41220/): Memory corruption in md2roff project:md2roff (critical 9.8)
- [CVE-2022-4122](https://insights.sbomify.com/CVE-2022-4122/): Buildah (as part of Podman) vulnerable to Link Following (medium 5.3)
- [CVE-2022-41218](https://insights.sbomify.com/CVE-2022-41218/): Use after free in debian:debian linux (medium 5.5)
- [CVE-2022-41217](https://insights.sbomify.com/CVE-2022-41217/): Cloudflow - Unauthenticated file upload vulnerability (critical 9.8)
- [CVE-2022-41216](https://insights.sbomify.com/CVE-2022-41216/): Cloudflow - Local File Inclusion Vulnerability (high 8.3)
- [CVE-2022-41215](https://insights.sbomify.com/CVE-2022-41215/): Open redirect in SAP NetWeaver ABAP Server and ABAP Platform (medium 4.7)
- [CVE-2022-41214](https://insights.sbomify.com/CVE-2022-41214/): Path traversal in SAP NetWeaver Application Server ABAP and ABAP Platform (high 8.7)
- [CVE-2022-41212](https://insights.sbomify.com/CVE-2022-41212/): Path traversal in SAP NetWeaver Application Server ABAP and ABAP Platform (medium 4.9)
- [CVE-2022-41211](https://insights.sbomify.com/CVE-2022-41211/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.0)
- [CVE-2022-41210](https://insights.sbomify.com/CVE-2022-41210/): Weak cryptography in SAP Customer Data Cloud (Gigya) (medium 5.2)
- [CVE-2022-4121](https://insights.sbomify.com/CVE-2022-4121/): Null dereference in libetpan (medium 5.5)
- [CVE-2022-41209](https://insights.sbomify.com/CVE-2022-41209/): Weak cryptography in SAP Customer Data Cloud (Gigya) (medium 5.2)
- [CVE-2022-41208](https://insights.sbomify.com/CVE-2022-41208/): Cross-site scripting in SAP Financial Consolidation (medium 5.4)
- [CVE-2022-41207](https://insights.sbomify.com/CVE-2022-41207/): Open redirect in SAP Biller Direct (medium 6.1)
- [CVE-2022-41206](https://insights.sbomify.com/CVE-2022-41206/): Cross-site scripting in SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) (medium 5.4)
- [CVE-2022-41205](https://insights.sbomify.com/CVE-2022-41205/): Code injection in SAP GUI for Windows (medium 5.5)
- [CVE-2022-41204](https://insights.sbomify.com/CVE-2022-41204/): Open redirect in SAP Commerce (high 8.8)
- [CVE-2022-41203](https://insights.sbomify.com/CVE-2022-41203/): Deserialization in SAP BusinessObjects Business Intelligence Platform (Central Management Console and BI Launchpad) (critical 9.9)
- [CVE-2022-41202](https://insights.sbomify.com/CVE-2022-41202/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41201](https://insights.sbomify.com/CVE-2022-41201/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41200](https://insights.sbomify.com/CVE-2022-41200/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-4120](https://insights.sbomify.com/CVE-2022-4120/): Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2022-41199](https://insights.sbomify.com/CVE-2022-41199/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41198](https://insights.sbomify.com/CVE-2022-41198/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41197](https://insights.sbomify.com/CVE-2022-41197/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41196](https://insights.sbomify.com/CVE-2022-41196/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41195](https://insights.sbomify.com/CVE-2022-41195/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41194](https://insights.sbomify.com/CVE-2022-41194/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41193](https://insights.sbomify.com/CVE-2022-41193/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41192](https://insights.sbomify.com/CVE-2022-41192/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41191](https://insights.sbomify.com/CVE-2022-41191/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41190](https://insights.sbomify.com/CVE-2022-41190/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-4119](https://insights.sbomify.com/CVE-2022-4119/): Image Optimizer, Resizer and CDN < 6.8.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41189](https://insights.sbomify.com/CVE-2022-41189/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41188](https://insights.sbomify.com/CVE-2022-41188/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41187](https://insights.sbomify.com/CVE-2022-41187/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41186](https://insights.sbomify.com/CVE-2022-41186/): Memory corruption in SAP 3D Visual Enterprise Viewer (high 7.8)
- [CVE-2022-41185](https://insights.sbomify.com/CVE-2022-41185/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-41184](https://insights.sbomify.com/CVE-2022-41184/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-41183](https://insights.sbomify.com/CVE-2022-41183/): Memory corruption in SAP 3D Visual Enterprise Author (medium 5.5)
- [CVE-2022-41182](https://insights.sbomify.com/CVE-2022-41182/): Memory corruption in SAP 3D Visual Enterprise Author (medium 5.5)
- [CVE-2022-41181](https://insights.sbomify.com/CVE-2022-41181/): Memory corruption in SAP 3D Visual Enterprise Author (medium 5.5)
- [CVE-2022-41180](https://insights.sbomify.com/CVE-2022-41180/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/244/