# Vulnerabilities published in 2022


- [CVE-2022-4032](https://insights.sbomify.com/CVE-2022-4032/): Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer (high 7.2)
- [CVE-2022-40319](https://insights.sbomify.com/CVE-2022-40319/): Missing authorization in lsoft:listserv (high 7.5)
- [CVE-2022-40318](https://insights.sbomify.com/CVE-2022-40318/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2022-40317](https://insights.sbomify.com/CVE-2022-40317/): Cross-site scripting in openkm:openkm (medium 5.4)
- [CVE-2022-40316](https://insights.sbomify.com/CVE-2022-40316/): Moodle No groups filtering in H5P activity attempts report (medium 4.3)
- [CVE-2022-40315](https://insights.sbomify.com/CVE-2022-40315/): Moodle Minor SQL injection risk in admin user browsing (critical 9.8)
- [CVE-2022-40314](https://insights.sbomify.com/CVE-2022-40314/): Moodle remote code execution (critical 9.8)
- [CVE-2022-40313](https://insights.sbomify.com/CVE-2022-40313/): Moodle Stored Cross-site Scripting and page denial of service (high 7.1)
- [CVE-2022-40312](https://insights.sbomify.com/CVE-2022-40312/): WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF) (medium 5.5)
- [CVE-2022-40311](https://insights.sbomify.com/CVE-2022-40311/): WordPress Analytics Cat plugin <= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-40310](https://insights.sbomify.com/CVE-2022-40310/): WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability (medium 4.3)
- [CVE-2022-4031](https://insights.sbomify.com/CVE-2022-4031/): Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification (low 3.8)
- [CVE-2022-40309](https://insights.sbomify.com/CVE-2022-40309/): Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories (medium 4.3)
- [CVE-2022-40308](https://insights.sbomify.com/CVE-2022-40308/): Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files (high 7.5)
- [CVE-2022-40307](https://insights.sbomify.com/CVE-2022-40307/): Use after free in debian:debian linux (medium 4.7)
- [CVE-2022-40306](https://insights.sbomify.com/CVE-2022-40306/): Denial of service in ecisolutions:printanista managed print service (medium 5.9)
- [CVE-2022-40305](https://insights.sbomify.com/CVE-2022-40305/): Server-side request forgery in canto:canto (critical 9.8)
- [CVE-2022-40304](https://insights.sbomify.com/CVE-2022-40304/): Memory corruption in apple:ipados (high 7.8)
- [CVE-2022-40303](https://insights.sbomify.com/CVE-2022-40303/): Integer overflow in apple:ipados (high 7.5)
- [CVE-2022-40302](https://insights.sbomify.com/CVE-2022-40302/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2022-40300](https://insights.sbomify.com/CVE-2022-40300/): SQL injection in zohocorp:manageengine access manager plus (critical 9.8)
- [CVE-2022-4030](https://insights.sbomify.com/CVE-2022-4030/): Simple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion (high 8.1)
- [CVE-2022-40299](https://insights.sbomify.com/CVE-2022-40299/): Privilege escalation in singular:singular (high 7.8)
- [CVE-2022-40298](https://insights.sbomify.com/CVE-2022-40298/): Privilege escalation in crestron:airmedia (high 8.8)
- [CVE-2022-40297](https://insights.sbomify.com/CVE-2022-40297/): Weak cryptography in ubports:ubuntu touch (high 7.8)
- [CVE-2022-40296](https://insights.sbomify.com/CVE-2022-40296/): Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (critical 9.8)
- [CVE-2022-40295](https://insights.sbomify.com/CVE-2022-40295/): Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (medium 4.9)
- [CVE-2022-40294](https://insights.sbomify.com/CVE-2022-40294/): CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC (high 8.8)
- [CVE-2022-40293](https://insights.sbomify.com/CVE-2022-40293/): Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (critical 9.8)
- [CVE-2022-40292](https://insights.sbomify.com/CVE-2022-40292/): Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (medium 5.3)
- [CVE-2022-40291](https://insights.sbomify.com/CVE-2022-40291/): Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC (high 8.8)
- [CVE-2022-40290](https://insights.sbomify.com/CVE-2022-40290/): Reflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (medium 6.1)
- [CVE-2022-4029](https://insights.sbomify.com/CVE-2022-4029/): Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value (medium 4.7)
- [CVE-2022-40289](https://insights.sbomify.com/CVE-2022-40289/): Cross-site scripting in PHP Point of Sale (critical 9.0)
- [CVE-2022-40288](https://insights.sbomify.com/CVE-2022-40288/): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality (critical 9.0)
- [CVE-2022-40287](https://insights.sbomify.com/CVE-2022-40287/): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields. (critical 9.0)
- [CVE-2022-40284](https://insights.sbomify.com/CVE-2022-40284/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-40282](https://insights.sbomify.com/CVE-2022-40282/): Command injection in belden:hirschmann bat-c2 firmware (high 8.8)
- [CVE-2022-40281](https://insights.sbomify.com/CVE-2022-40281/): Information disclosure in samsung:tizenrt (high 7.5)
- [CVE-2022-40280](https://insights.sbomify.com/CVE-2022-40280/): Denial of service in samsung:tizenrt (high 7.5)
- [CVE-2022-4028](https://insights.sbomify.com/CVE-2022-4028/): Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures (medium 6.4)
- [CVE-2022-40279](https://insights.sbomify.com/CVE-2022-40279/): Denial of service in samsung:tizenrt (high 7.5)
- [CVE-2022-40278](https://insights.sbomify.com/CVE-2022-40278/): Use after free in samsung:tizenrt (high 7.5)
- [CVE-2022-40277](https://insights.sbomify.com/CVE-2022-40277/): Joplin Remote Code Execution (high 7.8)
- [CVE-2022-40276](https://insights.sbomify.com/CVE-2022-40276/): Information disclosure in Zettlr (medium 5.5)
- [CVE-2022-40274](https://insights.sbomify.com/CVE-2022-40274/): Code injection in Gridea (high 7.8)
- [CVE-2022-4027](https://insights.sbomify.com/CVE-2022-4027/): Simple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum Replies (high 7.2)
- [CVE-2022-40269](https://insights.sbomify.com/CVE-2022-40269/): Auth bypass in GOT2000 Series GT25 model (medium 6.8)
- [CVE-2022-40268](https://insights.sbomify.com/CVE-2022-40268/): Other in GOT2000 Series GT25 model (medium 6.1)
- [CVE-2022-40267](https://insights.sbomify.com/CVE-2022-40267/): Authentication Bypass Vulnerability in Web Server Function on MELSEC Series (medium 5.9)
- [CVE-2022-40266](https://insights.sbomify.com/CVE-2022-40266/): Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series (medium 5.3)
- [CVE-2022-40265](https://insights.sbomify.com/CVE-2022-40265/): Denial of Service (DoS) Vulnerability in MELSEC iQ-R Series Ethernet Interface Module (high 8.6)
- [CVE-2022-40264](https://insights.sbomify.com/CVE-2022-40264/): Path traversal in GENESIS64 (medium 6.3)
- [CVE-2022-40263](https://insights.sbomify.com/CVE-2022-40263/): BD Totalys MultiProcessor - Hardcoded Credentials (medium 6.6)
- [CVE-2022-40262](https://insights.sbomify.com/CVE-2022-40262/): The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase. (high 8.2)
- [CVE-2022-40261](https://insights.sbomify.com/CVE-2022-40261/): SMM memory corruption vulnerability in OverClockSmiHandler SMM driver (high 8.2)
- [CVE-2022-40259](https://insights.sbomify.com/CVE-2022-40259/): MegaRAC Default Credentials Vulnerability (high 8.3)
- [CVE-2022-40258](https://insights.sbomify.com/CVE-2022-40258/): Weak password hashes for Redfish & API (medium 5.3)
- [CVE-2022-40257](https://insights.sbomify.com/CVE-2022-40257/): An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 (medium 5.4)
- [CVE-2022-40250](https://insights.sbomify.com/CVE-2022-40250/): Stack overflow vulnerability in SMI handler on SmmSmbiosElog. (high 8.8)
- [CVE-2022-4025](https://insights.sbomify.com/CVE-2022-4025/): Information disclosure in Chrome (medium 4.3)
- [CVE-2022-40248](https://insights.sbomify.com/CVE-2022-40248/): An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 (medium 5.4)
- [CVE-2022-40246](https://insights.sbomify.com/CVE-2022-40246/): Arbitrary write vulnerability in SbPei module leads to arbitrary code execution during PEI phase. (high 7.2)
- [CVE-2022-40242](https://insights.sbomify.com/CVE-2022-40242/): MegaRAC Default Credentials Vulnerability (high 7.5)
- [CVE-2022-4024](https://insights.sbomify.com/CVE-2022-4024/): Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion (medium 6.5)
- [CVE-2022-40238](https://insights.sbomify.com/CVE-2022-40238/): A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5 (high 8.8)
- [CVE-2022-40237](https://insights.sbomify.com/CVE-2022-40237/): IBM MQ for HPE NonStop denial of service (medium 6.5)
- [CVE-2022-40235](https://insights.sbomify.com/CVE-2022-40235/): Denial of service in IBM InfoSphere Information Server (medium 6.5)
- [CVE-2022-40234](https://insights.sbomify.com/CVE-2022-40234/): Information disclosure in Spectrum Protect Plus (medium 5.9)
- [CVE-2022-40233](https://insights.sbomify.com/CVE-2022-40233/): IBM AIX denial of service (medium 6.2)
- [CVE-2022-40232](https://insights.sbomify.com/CVE-2022-40232/): IBM Sterling B2B Integrator Standard Edition improper access control (medium 6.3)
- [CVE-2022-40231](https://insights.sbomify.com/CVE-2022-40231/): IBM Sterling B2B Integrator Standard Edition improper access control (medium 4.3)
- [CVE-2022-40230](https://insights.sbomify.com/CVE-2022-40230/): Auth bypass in IBM MQ Appliance (medium 6.5)
- [CVE-2022-4023](https://insights.sbomify.com/CVE-2022-4023/): 3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad (medium 5.3)
- [CVE-2022-40228](https://insights.sbomify.com/CVE-2022-40228/): IBM DataPower Gateway session fixation (low 3.7)
- [CVE-2022-40227](https://insights.sbomify.com/CVE-2022-40227/): Denial of service in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (high 7.5)
- [CVE-2022-40226](https://insights.sbomify.com/CVE-2022-40226/): Other in SICAM P850 (high 7.5)
- [CVE-2022-40225](https://insights.sbomify.com/CVE-2022-40225/): Denial of service in SIPLUS TIM 1531 IRC (medium 6.9)
- [CVE-2022-40224](https://insights.sbomify.com/CVE-2022-40224/): Denial of service in SDS-3008 Series Industrial Ethernet Switch (medium 5.3)
- [CVE-2022-40223](https://insights.sbomify.com/CVE-2022-40223/): WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability (medium 5.4)
- [CVE-2022-40222](https://insights.sbomify.com/CVE-2022-40222/): Command injection in QUARTZ-GOLD (critical 9.8)
- [CVE-2022-40220](https://insights.sbomify.com/CVE-2022-40220/): Command injection in QUARTZ-GOLD (high 7.2)
- [CVE-2022-4022](https://insights.sbomify.com/CVE-2022-4022/): Cross-site scripting in SVG Support (medium 6.4)
- [CVE-2022-40219](https://insights.sbomify.com/CVE-2022-40219/): WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-40218](https://insights.sbomify.com/CVE-2022-40218/): WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability (medium 6.5)
- [CVE-2022-40217](https://insights.sbomify.com/CVE-2022-40217/): WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability (medium 6.5)
- [CVE-2022-40216](https://insights.sbomify.com/CVE-2022-40216/): WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability (medium 4.3)
- [CVE-2022-40215](https://insights.sbomify.com/CVE-2022-40215/): WordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (low 3.4)
- [CVE-2022-40213](https://insights.sbomify.com/CVE-2022-40213/): Cross-site scripting in GS Testimonial Slider (WordPress plugin) (medium 4.1)
- [CVE-2022-40211](https://insights.sbomify.com/CVE-2022-40211/): WordPress GiveWP plugin <= 2.25.1 - Cross Site Scripting (XSS) via render_dropdown vulnerability (medium 5.9)
- [CVE-2022-40210](https://insights.sbomify.com/CVE-2022-40210/): Information disclosure in Intel DCM software (medium 6.8)
- [CVE-2022-4021](https://insights.sbomify.com/CVE-2022-4021/): Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery (high 8.8)
- [CVE-2022-40209](https://insights.sbomify.com/CVE-2022-40209/): WP Smart Import plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2022-40208](https://insights.sbomify.com/CVE-2022-40208/): Moodle may allow students to bypass sequential navigation during a quiz attempt (medium 4.3)
- [CVE-2022-40207](https://insights.sbomify.com/CVE-2022-40207/): Privilege escalation in Intel(R) SUR software (high 8.2)
- [CVE-2022-40206](https://insights.sbomify.com/CVE-2022-40206/): WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability (medium 6.3)
- [CVE-2022-40205](https://insights.sbomify.com/CVE-2022-40205/): WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability (medium 5.4)
- [CVE-2022-40204](https://insights.sbomify.com/CVE-2022-40204/): Cross-site scripting in DASDEC (medium 4.1)
- [CVE-2022-40203](https://insights.sbomify.com/CVE-2022-40203/): WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control (medium 6.3)
- [CVE-2022-40202](https://insights.sbomify.com/CVE-2022-40202/): Auth bypass in InfraSuite Device Master (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/251/