# Vulnerabilities published in 2022 - [CVE-2022-40524](https://insights.sbomify.com/CVE-2022-40524/): Buffer over-read in Modem (medium 6.7) - [CVE-2022-40523](https://insights.sbomify.com/CVE-2022-40523/): Information exposure in Kernel (high 7.1) - [CVE-2022-40522](https://insights.sbomify.com/CVE-2022-40522/): Double free in Linux Networking (high 8.4) - [CVE-2022-40521](https://insights.sbomify.com/CVE-2022-40521/): Improper authorization in Modem (high 7.5) - [CVE-2022-40520](https://insights.sbomify.com/CVE-2022-40520/): Stack based buffer overflow in Core (high 8.4) - [CVE-2022-4052](https://insights.sbomify.com/CVE-2022-4052/): Student Attendance Management System createClass.php sql injection (medium 4.7) - [CVE-2022-40519](https://insights.sbomify.com/CVE-2022-40519/): Buffer over-read in Core (medium 6.8) - [CVE-2022-40518](https://insights.sbomify.com/CVE-2022-40518/): Buffer overread in Core (medium 6.8) - [CVE-2022-40517](https://insights.sbomify.com/CVE-2022-40517/): Stack based buffer overflow in Core (high 8.4) - [CVE-2022-40516](https://insights.sbomify.com/CVE-2022-40516/): Stack-based buffer overflow in Core (high 8.4) - [CVE-2022-40515](https://insights.sbomify.com/CVE-2022-40515/): Double free in Video (high 7.3) - [CVE-2022-40514](https://insights.sbomify.com/CVE-2022-40514/): Buffer copy without checking size of input in WLAN Firmware (critical 9.8) - [CVE-2022-40513](https://insights.sbomify.com/CVE-2022-40513/): Uncontrolled resource consumption in WLAN Firmware. (high 7.5) - [CVE-2022-40512](https://insights.sbomify.com/CVE-2022-40512/): Buffer over-read in WLAN Firmware. (high 7.5) - [CVE-2022-40510](https://insights.sbomify.com/CVE-2022-40510/): Buffer copy without checking size of input in Audio. (critical 9.8) - [CVE-2022-4051](https://insights.sbomify.com/CVE-2022-4051/): Hostel Searching Project view-property.php sql injection (medium 6.3) - [CVE-2022-40508](https://insights.sbomify.com/CVE-2022-40508/): Reachable assertion in Modem (high 7.5) - [CVE-2022-40507](https://insights.sbomify.com/CVE-2022-40507/): Double free in Core (high 8.4) - [CVE-2022-40505](https://insights.sbomify.com/CVE-2022-40505/): Buffer over-read in Modem (high 8.2) - [CVE-2022-40504](https://insights.sbomify.com/CVE-2022-40504/): Reachable assertion in Modem (high 7.5) - [CVE-2022-40503](https://insights.sbomify.com/CVE-2022-40503/): Buffer over-read in Bluetooth Host. (high 8.2) - [CVE-2022-40502](https://insights.sbomify.com/CVE-2022-40502/): Improper input validation in WLAN Host (high 7.5) - [CVE-2022-4050](https://insights.sbomify.com/CVE-2022-4050/): JoomSport < 5.2.8 - Unauthenticated SQLi (critical 9.8) - [CVE-2022-40497](https://insights.sbomify.com/CVE-2022-40497/): Code injection in wazuh:wazuh (high 8.8) - [CVE-2022-40494](https://insights.sbomify.com/CVE-2022-40494/): Auth bypass in ehang-io:nps (critical 9.8) - [CVE-2022-40490](https://insights.sbomify.com/CVE-2022-40490/): Cross-site scripting in prasathmani:tiny file manager (medium 4.8) - [CVE-2022-4049](https://insights.sbomify.com/CVE-2022-4049/): WP User <= 7.0 - Unauthenticated SQLi (critical 9.8) - [CVE-2022-40489](https://insights.sbomify.com/CVE-2022-40489/): ThinkCMF Cross Site Request Forgery (CSRF) vulnerability (high 8.8) - [CVE-2022-40488](https://insights.sbomify.com/CVE-2022-40488/): ProcessWire vulnerable to Cross-Site Request Forgery (medium 6.5) - [CVE-2022-40487](https://insights.sbomify.com/CVE-2022-40487/): ProcessWire vulnerable to Cross-site Scripting (medium 6.1) - [CVE-2022-40486](https://insights.sbomify.com/CVE-2022-40486/): Code injection in tp-link:archer ax10 v1 firmware (high 8.8) - [CVE-2022-40485](https://insights.sbomify.com/CVE-2022-40485/): SQL injection in wedding planner project:wedding planner (critical 9.8) - [CVE-2022-40484](https://insights.sbomify.com/CVE-2022-40484/): SQL injection in wedding planner project:wedding planner (critical 9.8) - [CVE-2022-40483](https://insights.sbomify.com/CVE-2022-40483/): SQL injection in wedding planner project:wedding planner (critical 9.8) - [CVE-2022-40482](https://insights.sbomify.com/CVE-2022-40482/): Information disclosure in laravel:framework (medium 5.3) - [CVE-2022-40480](https://insights.sbomify.com/CVE-2022-40480/): Denial of service in microchip:dt100112 firmware (medium 6.5) - [CVE-2022-4048](https://insights.sbomify.com/CVE-2022-4048/): CODESYS V3 prone to Inadequate Encryption Stregth (high 7.7) - [CVE-2022-40476](https://insights.sbomify.com/CVE-2022-40476/): Null dereference in linux:linux kernel (medium 5.5) - [CVE-2022-40475](https://insights.sbomify.com/CVE-2022-40475/): Command injection in totolink:a860r firmware (critical 9.8) - [CVE-2022-40472](https://insights.sbomify.com/CVE-2022-40472/): Code injection in zktec:zkbio time (high 8.0) - [CVE-2022-40471](https://insights.sbomify.com/CVE-2022-40471/): File upload in oretnom23:clinic\'s patient management system (critical 9.8) - [CVE-2022-40470](https://insights.sbomify.com/CVE-2022-40470/): Cross-site scripting in phpgurukul:blood donor management system (medium 4.8) - [CVE-2022-4047](https://insights.sbomify.com/CVE-2022-4047/): Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload (critical 9.8) - [CVE-2022-40469](https://insights.sbomify.com/CVE-2022-40469/): Code injection in ikuai8:ikuaios (high 8.8) - [CVE-2022-40468](https://insights.sbomify.com/CVE-2022-40468/): Information disclosure in tinyproxy project:tinyproxy (high 7.5) - [CVE-2022-4046](https://insights.sbomify.com/CVE-2022-4046/): CODESYS: Improper memory restrictions fro CODESYS Control (high 8.8) - [CVE-2022-4045](https://insights.sbomify.com/CVE-2022-4045/): Denial of service in Mattermost (low 3.1) - [CVE-2022-40447](https://insights.sbomify.com/CVE-2022-40447/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2022-40446](https://insights.sbomify.com/CVE-2022-40446/): SQL injection in zzcms:zzcms (high 7.2) - [CVE-2022-40444](https://insights.sbomify.com/CVE-2022-40444/): Information disclosure in zzcms:zzcms (medium 5.3) - [CVE-2022-40443](https://insights.sbomify.com/CVE-2022-40443/): Path traversal in zzcms:zzcms (medium 5.3) - [CVE-2022-40440](https://insights.sbomify.com/CVE-2022-40440/): mxGraph vulnerable to cross-site scripting in setTooltips function (medium 6.1) - [CVE-2022-4044](https://insights.sbomify.com/CVE-2022-4044/): Denial of service in Mattermost (medium 4.3) - [CVE-2022-40439](https://insights.sbomify.com/CVE-2022-40439/): Denial of service in axiosys:bento4 (medium 6.5) - [CVE-2022-40438](https://insights.sbomify.com/CVE-2022-40438/): Memory corruption in axiosys:bento4 (medium 6.5) - [CVE-2022-40435](https://insights.sbomify.com/CVE-2022-40435/): Cross-site scripting in employee performance evaluation system project:employee performance evaluation system (medium 4.8) - [CVE-2022-40434](https://insights.sbomify.com/CVE-2022-40434/): Cross-site scripting in softr:softr (critical 9.8) - [CVE-2022-40432](https://insights.sbomify.com/CVE-2022-40432/): Supply chain in d8s-strings project:d8s-strings (critical 9.8) - [CVE-2022-40431](https://insights.sbomify.com/CVE-2022-40431/): Supply chain in d8s-pdfs project:d8s-pdfs (critical 9.8) - [CVE-2022-40430](https://insights.sbomify.com/CVE-2022-40430/): Supply chain in d8s-utility project:d8s-utility (critical 9.8) - [CVE-2022-4043](https://insights.sbomify.com/CVE-2022-4043/): WP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection (high 7.2) - [CVE-2022-40429](https://insights.sbomify.com/CVE-2022-40429/): Supply chain in d8s-ip-addresses project:d8s-ip-addresses (critical 9.8) - [CVE-2022-40428](https://insights.sbomify.com/CVE-2022-40428/): Supply chain in d8s-mpeg project:d8s mpeg (critical 9.8) - [CVE-2022-40427](https://insights.sbomify.com/CVE-2022-40427/): Supply chain in democritus domains project:democritus domains (critical 9.8) - [CVE-2022-40426](https://insights.sbomify.com/CVE-2022-40426/): Supply chain in d8s-asns project:d8s-asns (critical 9.8) - [CVE-2022-40425](https://insights.sbomify.com/CVE-2022-40425/): Supply chain in d8s-html project:d8s-html (critical 9.8) - [CVE-2022-40424](https://insights.sbomify.com/CVE-2022-40424/): Supply chain in democritus urls project:democritus urls (critical 9.8) - [CVE-2022-4042](https://insights.sbomify.com/CVE-2022-4042/): Paytium < 4.3.7 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-4041](https://insights.sbomify.com/CVE-2022-4041/): Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter (medium 5.9) - [CVE-2022-40408](https://insights.sbomify.com/CVE-2022-40408/): FeehiCMS vulnerable to Cross-Site scripting via crafted payload (medium 5.4) - [CVE-2022-40407](https://insights.sbomify.com/CVE-2022-40407/): File upload in chamilo:chamilo (high 8.8) - [CVE-2022-40405](https://insights.sbomify.com/CVE-2022-40405/): SQL injection in wowonder:wowonder (high 7.5) - [CVE-2022-40404](https://insights.sbomify.com/CVE-2022-40404/): SQL injection in wedding planner project:wedding planner (high 8.8) - [CVE-2022-40403](https://insights.sbomify.com/CVE-2022-40403/): SQL injection in wedding planner project:wedding planner (high 7.2) - [CVE-2022-40402](https://insights.sbomify.com/CVE-2022-40402/): SQL injection in wedding planner project:wedding planner (high 8.8) - [CVE-2022-4039](https://insights.sbomify.com/CVE-2022-4039/): Rhsso-container-image: unsecured management interface exposed to adjecent network (high 8.0) - [CVE-2022-40373](https://insights.sbomify.com/CVE-2022-40373/): FeehiCMS Cross Site Scripting vulnerability (medium 5.4) - [CVE-2022-4037](https://insights.sbomify.com/CVE-2022-4037/): Race condition in GitLab (medium 6.4) - [CVE-2022-40365](https://insights.sbomify.com/CVE-2022-40365/): ouqiang gocron Cross-site scripting vulnerability (medium 6.1) - [CVE-2022-40363](https://insights.sbomify.com/CVE-2022-40363/): Memory corruption in flipperzero:flipper zero firmware (medium 5.5) - [CVE-2022-40361](https://insights.sbomify.com/CVE-2022-40361/): Cross-site scripting in elitecms:elite cms (medium 6.1) - [CVE-2022-4036](https://insights.sbomify.com/CVE-2022-4036/): Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass (medium 5.3) - [CVE-2022-40359](https://insights.sbomify.com/CVE-2022-40359/): Cross-site scripting in kfm project:kfm (medium 6.1) - [CVE-2022-40358](https://insights.sbomify.com/CVE-2022-40358/): Cross-site scripting in ajaxplorer:ajaxplorer (medium 5.4) - [CVE-2022-40357](https://insights.sbomify.com/CVE-2022-40357/): Server-side request forgery in zblogcn:z-blogphp (critical 9.8) - [CVE-2022-40354](https://insights.sbomify.com/CVE-2022-40354/): SQL injection in online tours \& travels management system project:online tours \& travels management system (high 7.2) - [CVE-2022-40353](https://insights.sbomify.com/CVE-2022-40353/): SQL injection in online tours \& travels management system project:online tours \& travels management system (high 7.2) - [CVE-2022-40352](https://insights.sbomify.com/CVE-2022-40352/): SQL injection in online tours \& travels management system project:online tours \& travels management system (high 7.2) - [CVE-2022-4035](https://insights.sbomify.com/CVE-2022-4035/): Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form (high 7.2) - [CVE-2022-40348](https://insights.sbomify.com/CVE-2022-40348/): Cross-site scripting in intern record system project:intern record system (medium 5.4) - [CVE-2022-40347](https://insights.sbomify.com/CVE-2022-40347/): SQL injection in intern record system project:intern record system (critical 9.8) - [CVE-2022-40341](https://insights.sbomify.com/CVE-2022-40341/): File upload in mojoportal:mojoportal (high 8.8) - [CVE-2022-4034](https://insights.sbomify.com/CVE-2022-4034/): Appointment Hour Booking <= 1.3.72 - CSV Injection (medium 5.8) - [CVE-2022-40337](https://insights.sbomify.com/CVE-2022-40337/): Other in aspiresoftware:open aviation strategic engineering system (high 8.8) - [CVE-2022-4033](https://insights.sbomify.com/CVE-2022-4033/): Quiz and Survey Master <= 8.0.4 - Improper Input Validation (medium 5.3) - [CVE-2022-40325](https://insights.sbomify.com/CVE-2022-40325/): Cross-site scripting in sysaid:help desk (medium 6.1) - [CVE-2022-40324](https://insights.sbomify.com/CVE-2022-40324/): Cross-site scripting in sysaid:help desk (medium 6.1) - [CVE-2022-40323](https://insights.sbomify.com/CVE-2022-40323/): Cross-site scripting in sysaid:help desk (medium 6.1) - [CVE-2022-40322](https://insights.sbomify.com/CVE-2022-40322/): Cross-site scripting in sysaid:help desk (medium 6.1) - [CVE-2022-40320](https://insights.sbomify.com/CVE-2022-40320/): Memory corruption in fedoraproject:fedora (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2022/page/250/