# Vulnerabilities published in 2022


- [CVE-2022-40686](https://insights.sbomify.com/CVE-2022-40686/): WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-40685](https://insights.sbomify.com/CVE-2022-40685/): Information disclosure in Intel(R) DCM software (medium 6.5)
- [CVE-2022-40684](https://insights.sbomify.com/CVE-2022-40684/): Fortinet Multiple Products Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2022-40683](https://insights.sbomify.com/CVE-2022-40683/): Memory corruption in FortiWeb (high 7.1)
- [CVE-2022-40682](https://insights.sbomify.com/CVE-2022-40682/): Missing authorization in FortiClientWindows (high 7.1)
- [CVE-2022-40681](https://insights.sbomify.com/CVE-2022-40681/): Missing authorization in FortiClientWindows (high 7.1)
- [CVE-2022-40680](https://insights.sbomify.com/CVE-2022-40680/): Cross-site scripting in FortiOS (low 3.8)
- [CVE-2022-4068](https://insights.sbomify.com/CVE-2022-4068/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms (high 7.6)
- [CVE-2022-40679](https://insights.sbomify.com/CVE-2022-40679/): Command injection in FortiADC (high 7.1)
- [CVE-2022-40678](https://insights.sbomify.com/CVE-2022-40678/): Information disclosure in FortiNAC (high 7.4)
- [CVE-2022-40677](https://insights.sbomify.com/CVE-2022-40677/): Command injection in FortiNAC (high 7.2)
- [CVE-2022-40676](https://insights.sbomify.com/CVE-2022-40676/): Cross-site scripting in FortiNAC (high 7.1)
- [CVE-2022-40675](https://insights.sbomify.com/CVE-2022-40675/): Weak cryptography in FortiNAC (medium 6.0)
- [CVE-2022-40674](https://insights.sbomify.com/CVE-2022-40674/): Use after free in debian:debian linux (high 8.1)
- [CVE-2022-40673](https://insights.sbomify.com/CVE-2022-40673/): Missing authorization in fedoraproject:fedora (high 7.8)
- [CVE-2022-40672](https://insights.sbomify.com/CVE-2022-40672/): WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-40671](https://insights.sbomify.com/CVE-2022-40671/): WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-4067](https://insights.sbomify.com/CVE-2022-4067/): Cross-site Scripting (XSS) - Stored in librenms/librenms (low 3.4)
- [CVE-2022-40664](https://insights.sbomify.com/CVE-2022-40664/): Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher (critical 9.8)
- [CVE-2022-40663](https://insights.sbomify.com/CVE-2022-40663/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40662](https://insights.sbomify.com/CVE-2022-40662/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40661](https://insights.sbomify.com/CVE-2022-40661/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40660](https://insights.sbomify.com/CVE-2022-40660/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-4066](https://insights.sbomify.com/CVE-2022-4066/): davidmoreno onion Log response.c onion_response_flush allocation of resources (low 3.5)
- [CVE-2022-40659](https://insights.sbomify.com/CVE-2022-40659/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40658](https://insights.sbomify.com/CVE-2022-40658/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40657](https://insights.sbomify.com/CVE-2022-40657/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40656](https://insights.sbomify.com/CVE-2022-40656/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40655](https://insights.sbomify.com/CVE-2022-40655/): Memory corruption in NIS-Elements Viewer (high 7.8)
- [CVE-2022-40654](https://insights.sbomify.com/CVE-2022-40654/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40653](https://insights.sbomify.com/CVE-2022-40653/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40652](https://insights.sbomify.com/CVE-2022-40652/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40651](https://insights.sbomify.com/CVE-2022-40651/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40650](https://insights.sbomify.com/CVE-2022-40650/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-4065](https://insights.sbomify.com/CVE-2022-4065/): cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal (medium 5.5)
- [CVE-2022-40649](https://insights.sbomify.com/CVE-2022-40649/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40648](https://insights.sbomify.com/CVE-2022-40648/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40647](https://insights.sbomify.com/CVE-2022-40647/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40646](https://insights.sbomify.com/CVE-2022-40646/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40645](https://insights.sbomify.com/CVE-2022-40645/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40644](https://insights.sbomify.com/CVE-2022-40644/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40643](https://insights.sbomify.com/CVE-2022-40643/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40642](https://insights.sbomify.com/CVE-2022-40642/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40641](https://insights.sbomify.com/CVE-2022-40641/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-40640](https://insights.sbomify.com/CVE-2022-40640/): Memory corruption in SpaceClaim (high 7.8)
- [CVE-2022-4064](https://insights.sbomify.com/CVE-2022-4064/): Dalli Meta Protocol request_formatter.rb self.meta_set injection (medium 6.3)
- [CVE-2022-40639](https://insights.sbomify.com/CVE-2022-40639/): Use after free in SpaceClaim (high 7.8)
- [CVE-2022-40638](https://insights.sbomify.com/CVE-2022-40638/): Use after free in SpaceClaim (high 7.8)
- [CVE-2022-40637](https://insights.sbomify.com/CVE-2022-40637/): Use after free in SpaceClaim (high 7.0)
- [CVE-2022-40636](https://insights.sbomify.com/CVE-2022-40636/): Memory corruption in SpaceClaim (high 7.0)
- [CVE-2022-40635](https://insights.sbomify.com/CVE-2022-40635/): Improper Control of Dynamically-Managed Code Resources in Crafter Studio (medium 6.4)
- [CVE-2022-40634](https://insights.sbomify.com/CVE-2022-40634/): Improper Control of Dynamically-Managed Code Resources in Crafter Studio (medium 6.4)
- [CVE-2022-40633](https://insights.sbomify.com/CVE-2022-40633/): Rittal CMC III Improper Access Control (medium 4.6)
- [CVE-2022-40632](https://insights.sbomify.com/CVE-2022-40632/): WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-40631](https://insights.sbomify.com/CVE-2022-40631/): Cross-site scripting in SCALANCE X200-4P IRT (medium 6.1)
- [CVE-2022-40630](https://insights.sbomify.com/CVE-2022-40630/): Improper Session Management Vulnerability in Tacitine Firewall (medium 6.5)
- [CVE-2022-4063](https://insights.sbomify.com/CVE-2022-4063/): InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE (critical 9.8)
- [CVE-2022-40629](https://insights.sbomify.com/CVE-2022-40629/): Sensitive Information Disclosure Vulnerability in Tacitine Firewall (high 7.5)
- [CVE-2022-40628](https://insights.sbomify.com/CVE-2022-40628/): Remote Code Execution Vulnerability in Tacitine Firewall (critical 9.8)
- [CVE-2022-40626](https://insights.sbomify.com/CVE-2022-40626/): Reflected XSS in the backurl parameter of Zabbix Frontend (medium 4.8)
- [CVE-2022-40624](https://insights.sbomify.com/CVE-2022-40624/): Command injection in pfsense:pfblockerng (critical 9.8)
- [CVE-2022-40623](https://insights.sbomify.com/CVE-2022-40623/): WAVLINK Quantum D4G (WN531G3) CSRF (high 8.8)
- [CVE-2022-40622](https://insights.sbomify.com/CVE-2022-40622/): WAVLINK Quantum D4G (WN531G3) Session Management by IP Address (high 8.8)
- [CVE-2022-40621](https://insights.sbomify.com/CVE-2022-40621/): WAVLINK Quantum D4G (WN531G3) Pass-The-Hash (high 7.5)
- [CVE-2022-40620](https://insights.sbomify.com/CVE-2022-40620/): Security feature bypass in netgear:r6230 firmware (high 7.7)
- [CVE-2022-4062](https://insights.sbomify.com/CVE-2022-4062/): Missing authorization in EcoStruxure Power Commission (high 7.8)
- [CVE-2022-40619](https://insights.sbomify.com/CVE-2022-40619/): Command injection in netgear:r6230 firmware (high 7.7)
- [CVE-2022-40617](https://insights.sbomify.com/CVE-2022-40617/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2022-40616](https://insights.sbomify.com/CVE-2022-40616/): Auth bypass in Maximo Asset Management (medium 6.5)
- [CVE-2022-40615](https://insights.sbomify.com/CVE-2022-40615/): IBM Sterling Partner Engagement Manager SQL injection (medium 6.3)
- [CVE-2022-4061](https://insights.sbomify.com/CVE-2022-4061/): JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload (high 7.5)
- [CVE-2022-40609](https://insights.sbomify.com/CVE-2022-40609/): IBM SDK, Java Technology Edition code execution (high 8.1)
- [CVE-2022-40608](https://insights.sbomify.com/CVE-2022-40608/): Path traversal in Spectrum Protect Plus (medium 5.9)
- [CVE-2022-40607](https://insights.sbomify.com/CVE-2022-40607/): IBM Spectrum Scale directory traversal (medium 6.8)
- [CVE-2022-40606](https://insights.sbomify.com/CVE-2022-40606/): Cross-site scripting in mitre:caldera (medium 6.1)
- [CVE-2022-40605](https://insights.sbomify.com/CVE-2022-40605/): Cross-site scripting in mitre:caldera (medium 6.1)
- [CVE-2022-40604](https://insights.sbomify.com/CVE-2022-40604/): Format String Vulnerability (high 7.5)
- [CVE-2022-40603](https://insights.sbomify.com/CVE-2022-40603/): Cross-site scripting in ATP series firmware (medium 4.7)
- [CVE-2022-40602](https://insights.sbomify.com/CVE-2022-40602/): Hardcoded credentials in LTE3301-M209 (critical 9.8)
- [CVE-2022-4060](https://insights.sbomify.com/CVE-2022-4060/): User Post Gallery <= 2.19 - Unauthenticated RCE (critical 9.8)
- [CVE-2022-4059](https://insights.sbomify.com/CVE-2022-4059/): Cryptocurrency Widgets Pack < 2.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-4058](https://insights.sbomify.com/CVE-2022-4058/): Photo Gallery < 1.8.3 - Stored XSS via CSRF (medium 5.4)
- [CVE-2022-4057](https://insights.sbomify.com/CVE-2022-4057/): Autoptimize < 3.1.0 - Sensitive Data Disclosure (medium 5.3)
- [CVE-2022-4055](https://insights.sbomify.com/CVE-2022-4055/): Security feature bypass in xdg-utils (high 7.4)
- [CVE-2022-40540](https://insights.sbomify.com/CVE-2022-40540/): Buffer copy without checking the size of input in Linux Kernel (high 8.4)
- [CVE-2022-4054](https://insights.sbomify.com/CVE-2022-4054/): Information disclosure in GitLab (medium 5.5)
- [CVE-2022-40539](https://insights.sbomify.com/CVE-2022-40539/): Improper Validation of Array Index in Automotive Android OS (high 8.4)
- [CVE-2022-40538](https://insights.sbomify.com/CVE-2022-40538/): Reachable assertion in Modem (high 7.5)
- [CVE-2022-40537](https://insights.sbomify.com/CVE-2022-40537/): Improper Validation of Array Index in Bluetooth HOST (high 7.3)
- [CVE-2022-40536](https://insights.sbomify.com/CVE-2022-40536/): Improper authentication in Modem (high 7.5)
- [CVE-2022-40535](https://insights.sbomify.com/CVE-2022-40535/): Buffer Over-read in WLAN (high 7.5)
- [CVE-2022-40534](https://insights.sbomify.com/CVE-2022-40534/): Improper Validation of Array Index in Audio (high 8.4)
- [CVE-2022-40533](https://insights.sbomify.com/CVE-2022-40533/): Untrusted Pointer Dereference in Core (medium 6.2)
- [CVE-2022-40532](https://insights.sbomify.com/CVE-2022-40532/): Integer overflow or wraparound in WLAN (high 8.4)
- [CVE-2022-40531](https://insights.sbomify.com/CVE-2022-40531/): Incorrect type conversion in WLAN (high 8.4)
- [CVE-2022-40530](https://insights.sbomify.com/CVE-2022-40530/): Integer overflow to buffer overflow in WLAN (high 8.4)
- [CVE-2022-4053](https://insights.sbomify.com/CVE-2022-4053/): Student Attendance Management System createClass.php cross site scripting (low 2.4)
- [CVE-2022-40529](https://insights.sbomify.com/CVE-2022-40529/): Improper access control in Kernel (high 7.1)
- [CVE-2022-40527](https://insights.sbomify.com/CVE-2022-40527/): Reachable Assertion in WLAN Embedded SW (high 7.5)
- [CVE-2022-40525](https://insights.sbomify.com/CVE-2022-40525/): Information Exposure in Linux Networking Firmware (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/249/