# Vulnerabilities published in 2022


- [CVE-2022-40827](https://insights.sbomify.com/CVE-2022-40827/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40826](https://insights.sbomify.com/CVE-2022-40826/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40825](https://insights.sbomify.com/CVE-2022-40825/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40824](https://insights.sbomify.com/CVE-2022-40824/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40817](https://insights.sbomify.com/CVE-2022-40817/): Missing authorization in zammad:zammad (medium 4.3)
- [CVE-2022-40816](https://insights.sbomify.com/CVE-2022-40816/): Missing authorization in zammad:zammad (medium 6.5)
- [CVE-2022-40812](https://insights.sbomify.com/CVE-2022-40812/): Supply chain in democritus pdfs project:democritus pdfs (critical 9.8)
- [CVE-2022-40811](https://insights.sbomify.com/CVE-2022-40811/): Supply chain in democritus urls project:democritus urls (critical 9.8)
- [CVE-2022-40810](https://insights.sbomify.com/CVE-2022-40810/): Supply chain in democritus ip addresses project:democritus ip addresses (critical 9.8)
- [CVE-2022-40809](https://insights.sbomify.com/CVE-2022-40809/): Supply chain in democritus dicts project:democritus dicts (critical 9.8)
- [CVE-2022-40808](https://insights.sbomify.com/CVE-2022-40808/): Supply chain in democritus dates project:democritus dates (critical 9.8)
- [CVE-2022-40807](https://insights.sbomify.com/CVE-2022-40807/): Supply chain in democritus domains project:democritus domains (critical 9.8)
- [CVE-2022-40806](https://insights.sbomify.com/CVE-2022-40806/): Supply chain in democritus uuids project:democritus uuids (critical 9.8)
- [CVE-2022-40805](https://insights.sbomify.com/CVE-2022-40805/): Supply chain in democritus urls project:democritus urls (critical 9.8)
- [CVE-2022-40799](https://insights.sbomify.com/CVE-2022-40799/): D-Link DNR-322L Download of Code Without Integrity Check (high 8.8, exploited in the wild)
- [CVE-2022-40798](https://insights.sbomify.com/CVE-2022-40798/): Missing authorization in ocomon project:ocomon (high 7.5)
- [CVE-2022-40797](https://insights.sbomify.com/CVE-2022-40797/): File upload in roxyfileman:roxy fileman (critical 9.8)
- [CVE-2022-40785](https://insights.sbomify.com/CVE-2022-40785/): Command injection in mipcm:mipc camera firmware (high 8.8)
- [CVE-2022-40784](https://insights.sbomify.com/CVE-2022-40784/): Memory corruption in mipcm:mipc camera firmware (high 8.8)
- [CVE-2022-40778](https://insights.sbomify.com/CVE-2022-40778/): Cross-site scripting in opswat:metadefender (medium 5.4)
- [CVE-2022-40777](https://insights.sbomify.com/CVE-2022-40777/): File upload in interspire:email marketer (high 8.8)
- [CVE-2022-40775](https://insights.sbomify.com/CVE-2022-40775/): Null dereference in axiosys:bento4 (medium 5.5)
- [CVE-2022-40774](https://insights.sbomify.com/CVE-2022-40774/): Null dereference in axiosys:bento4 (medium 5.5)
- [CVE-2022-40773](https://insights.sbomify.com/CVE-2022-40773/): Privilege escalation in zohocorp:manageengine servicedesk plus msp (high 8.8)
- [CVE-2022-40772](https://insights.sbomify.com/CVE-2022-40772/): Security feature bypass in zohocorp:manageengine assetexplorer (medium 6.5)
- [CVE-2022-40771](https://insights.sbomify.com/CVE-2022-40771/): XML external entity in zohocorp:manageengine assetexplorer (medium 4.9)
- [CVE-2022-40770](https://insights.sbomify.com/CVE-2022-40770/): Command injection in zohocorp:manageengine servicedesk plus (high 7.2)
- [CVE-2022-40769](https://insights.sbomify.com/CVE-2022-40769/): Weak cryptography in profanity project:profanity (high 7.5)
- [CVE-2022-40768](https://insights.sbomify.com/CVE-2022-40768/): Information disclosure in debian:debian linux (medium 5.5)
- [CVE-2022-40766](https://insights.sbomify.com/CVE-2022-40766/): SQL injection in moderncampus:omni cms (critical 9.8)
- [CVE-2022-40765](https://insights.sbomify.com/CVE-2022-40765/): Mitel MiVoice Connect Command Injection (medium 6.8, exploited in the wild)
- [CVE-2022-40764](https://insights.sbomify.com/CVE-2022-40764/): Snyk CLI affected by Command Injection vulnerability (high 7.8)
- [CVE-2022-40762](https://insights.sbomify.com/CVE-2022-40762/): Denial of service in samsung:mtower (high 7.5)
- [CVE-2022-40761](https://insights.sbomify.com/CVE-2022-40761/): Denial of service in samsung:mtower (high 7.5)
- [CVE-2022-40760](https://insights.sbomify.com/CVE-2022-40760/): Memory corruption in samsung:mtower (high 7.5)
- [CVE-2022-40759](https://insights.sbomify.com/CVE-2022-40759/): Null dereference in samsung:mtower (high 7.5)
- [CVE-2022-40758](https://insights.sbomify.com/CVE-2022-40758/): Memory corruption in samsung:mtower (high 7.5)
- [CVE-2022-40757](https://insights.sbomify.com/CVE-2022-40757/): Memory corruption in samsung:mtower (high 7.5)
- [CVE-2022-40756](https://insights.sbomify.com/CVE-2022-40756/): Misconfiguration in actian:psql (high 8.8)
- [CVE-2022-40755](https://insights.sbomify.com/CVE-2022-40755/): Denial of service in jasper project:jasper (medium 5.5)
- [CVE-2022-40754](https://insights.sbomify.com/CVE-2022-40754/): Open Redirect (medium 6.1)
- [CVE-2022-40753](https://insights.sbomify.com/CVE-2022-40753/): IBM InfoSphere Information Server cross-site scripting (medium 5.4)
- [CVE-2022-40752](https://insights.sbomify.com/CVE-2022-40752/): Command injection in InfoSphere DataStage (critical 9.8)
- [CVE-2022-40751](https://insights.sbomify.com/CVE-2022-40751/): IBM UrbanCode Deploy information disclosure (medium 4.9)
- [CVE-2022-40750](https://insights.sbomify.com/CVE-2022-40750/): IBM WebSphere Application Server cross-site scripting (medium 5.4)
- [CVE-2022-40748](https://insights.sbomify.com/CVE-2022-40748/): Cross-site scripting in InfoSphere Information Server (medium 5.4)
- [CVE-2022-40747](https://insights.sbomify.com/CVE-2022-40747/): XML external entity in IBM InfoSphere Information Server (critical 9.1)
- [CVE-2022-40746](https://insights.sbomify.com/CVE-2022-40746/): Code injection in i (high 7.2)
- [CVE-2022-40745](https://insights.sbomify.com/CVE-2022-40745/): IBM Aspera Faspex information disclosure (medium 5.5)
- [CVE-2022-40744](https://insights.sbomify.com/CVE-2022-40744/): IBM Aspera Faspex cross-site scripting (medium 4.8)
- [CVE-2022-40743](https://insights.sbomify.com/CVE-2022-40743/): Apache Traffic Server: Security issues with the xdebug plugin (medium 6.1)
- [CVE-2022-40742](https://insights.sbomify.com/CVE-2022-40742/): SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Local File Inclusion (medium 6.5)
- [CVE-2022-40741](https://insights.sbomify.com/CVE-2022-40741/): SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Command Injection (critical 9.8)
- [CVE-2022-40740](https://insights.sbomify.com/CVE-2022-40740/): Realtek GPON router - Command Injection (high 7.2)
- [CVE-2022-40739](https://insights.sbomify.com/CVE-2022-40739/): Ragic, Inc. Ragic - Reflected XSS (medium 5.4)
- [CVE-2022-40738](https://insights.sbomify.com/CVE-2022-40738/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2022-40737](https://insights.sbomify.com/CVE-2022-40737/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-40736](https://insights.sbomify.com/CVE-2022-40736/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-40735](https://insights.sbomify.com/CVE-2022-40735/): Denial of service in diffie-hellman key exchange project:diffie-hellman key exchange (high 7.5)
- [CVE-2022-40734](https://insights.sbomify.com/CVE-2022-40734/): UniSharp Laravel Filemanager directory traversal vulnerability (medium 6.5)
- [CVE-2022-40733](https://insights.sbomify.com/CVE-2022-40733/): Null dereference in Windows (medium 5.0)
- [CVE-2022-40732](https://insights.sbomify.com/CVE-2022-40732/): Null dereference in Windows (medium 5.0)
- [CVE-2022-40725](https://insights.sbomify.com/CVE-2022-40725/): PingID Desktop PIN attempt lockout bypass. (high 7.3)
- [CVE-2022-40724](https://insights.sbomify.com/CVE-2022-40724/): Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. (medium 6.4)
- [CVE-2022-40723](https://insights.sbomify.com/CVE-2022-40723/): Configuration-based MFA Bypass in PingID RADIUS PCV. (medium 6.5)
- [CVE-2022-40722](https://insights.sbomify.com/CVE-2022-40722/): Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. (high 7.7)
- [CVE-2022-40721](https://insights.sbomify.com/CVE-2022-40721/): File upload in CreativeDream file uploader (critical 9.8)
- [CVE-2022-40720](https://insights.sbomify.com/CVE-2022-40720/): Command injection in DIR-2150 (high 8.8)
- [CVE-2022-40719](https://insights.sbomify.com/CVE-2022-40719/): Command injection in DIR-2150 (high 8.8)
- [CVE-2022-40718](https://insights.sbomify.com/CVE-2022-40718/): Memory corruption in DIR-2150 (high 8.8)
- [CVE-2022-40717](https://insights.sbomify.com/CVE-2022-40717/): Memory corruption in DIR-2150 (high 8.8)
- [CVE-2022-40716](https://insights.sbomify.com/CVE-2022-40716/): HashiCorp Consul vulnerable to authorization bypass (medium 6.5)
- [CVE-2022-40715](https://insights.sbomify.com/CVE-2022-40715/): Path traversal in nokia:1350 optical management system (medium 6.5)
- [CVE-2022-40714](https://insights.sbomify.com/CVE-2022-40714/): Cross-site scripting in nokia:1350 optical management system (medium 6.1)
- [CVE-2022-40713](https://insights.sbomify.com/CVE-2022-40713/): Path traversal in nokia:1350 optical management system (medium 6.5)
- [CVE-2022-40712](https://insights.sbomify.com/CVE-2022-40712/): Cross-site scripting in nokia:1350 optical management system (medium 6.1)
- [CVE-2022-40711](https://insights.sbomify.com/CVE-2022-40711/): Cross-site scripting in primekey:ejbca (medium 4.8)
- [CVE-2022-40710](https://insights.sbomify.com/CVE-2022-40710/): Privilege escalation in Trend Micro Deep Security (high 7.8)
- [CVE-2022-40709](https://insights.sbomify.com/CVE-2022-40709/): Memory corruption in Trend Micro Deep Security (low 3.3)
- [CVE-2022-40708](https://insights.sbomify.com/CVE-2022-40708/): Memory corruption in Trend Micro Deep Security (low 3.3)
- [CVE-2022-40707](https://insights.sbomify.com/CVE-2022-40707/): Memory corruption in Trend Micro Deep Security (low 3.3)
- [CVE-2022-40705](https://insights.sbomify.com/CVE-2022-40705/): Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP (high 7.5)
- [CVE-2022-40704](https://insights.sbomify.com/CVE-2022-40704/): Cross-site scripting in phoronix-test-suite (medium 6.1)
- [CVE-2022-40703](https://insights.sbomify.com/CVE-2022-40703/): Auth bypass in Kardia App (medium 5.2)
- [CVE-2022-40702](https://insights.sbomify.com/CVE-2022-40702/): WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control (medium 5.4)
- [CVE-2022-40701](https://insights.sbomify.com/CVE-2022-40701/): Path traversal in QUARTZ-GOLD (medium 6.5)
- [CVE-2022-40700](https://insights.sbomify.com/CVE-2022-40700/): Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins (high 8.2)
- [CVE-2022-4070](https://insights.sbomify.com/CVE-2022-4070/): Insufficient Session Expiration in librenms/librenms (low 2.7)
- [CVE-2022-40699](https://insights.sbomify.com/CVE-2022-40699/): WordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2022-40698](https://insights.sbomify.com/CVE-2022-40698/): WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-40697](https://insights.sbomify.com/CVE-2022-40697/): WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-40696](https://insights.sbomify.com/CVE-2022-40696/): WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure (low 3.7)
- [CVE-2022-40695](https://insights.sbomify.com/CVE-2022-40695/): WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-40694](https://insights.sbomify.com/CVE-2022-40694/): WordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-40693](https://insights.sbomify.com/CVE-2022-40693/): Information disclosure in SDS-3008 Series Industrial Ethernet Switch (medium 5.9)
- [CVE-2022-40692](https://insights.sbomify.com/CVE-2022-40692/): WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-40691](https://insights.sbomify.com/CVE-2022-40691/): Information disclosure in SDS-3008 Series Industrial Ethernet Switch (medium 5.3)
- [CVE-2022-40690](https://insights.sbomify.com/CVE-2022-40690/): Cross-site scripting in BookStack (medium 5.4)
- [CVE-2022-4069](https://insights.sbomify.com/CVE-2022-4069/): Cross-site Scripting (XSS) - Generic in librenms/librenms (low 3.4)
- [CVE-2022-40687](https://insights.sbomify.com/CVE-2022-40687/): WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/248/