# Vulnerabilities published in 2022


- [CVE-2022-40201](https://insights.sbomify.com/CVE-2022-40201/): Memory corruption in MicroStation Connect (high 7.8)
- [CVE-2022-40200](https://insights.sbomify.com/CVE-2022-40200/): WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2022-4020](https://insights.sbomify.com/CVE-2022-4020/): Acer Aspire BIOS vulnerability (high 8.1)
- [CVE-2022-40199](https://insights.sbomify.com/CVE-2022-40199/): EC-CUBE Directory traversal vulnerability (low 2.7)
- [CVE-2022-40198](https://insights.sbomify.com/CVE-2022-40198/): WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-40196](https://insights.sbomify.com/CVE-2022-40196/): Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler and Intel® C++ Compiler Classic for some Intel(R) oneAPI Toolkits (high 7.8)
- [CVE-2022-40195](https://insights.sbomify.com/CVE-2022-40195/): WordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-40194](https://insights.sbomify.com/CVE-2022-40194/): WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability (medium 5.3)
- [CVE-2022-40193](https://insights.sbomify.com/CVE-2022-40193/): Cross-site scripting in Awesome Filterable Portfolio (WordPress plugin) (medium 6.1)
- [CVE-2022-40192](https://insights.sbomify.com/CVE-2022-40192/): WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2022-40191](https://insights.sbomify.com/CVE-2022-40191/): WordPress Contact Form By Mega Forms plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-40190](https://insights.sbomify.com/CVE-2022-40190/): Cross-site scripting in moduWeb (high 8.8)
- [CVE-2022-4019](https://insights.sbomify.com/CVE-2022-4019/): Denial of service in Playbooks Plugin (medium 4.3)
- [CVE-2022-40189](https://insights.sbomify.com/CVE-2022-40189/): Apache Airlfow Pig Provider RCE (critical 9.8)
- [CVE-2022-40188](https://insights.sbomify.com/CVE-2022-40188/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2022-40187](https://insights.sbomify.com/CVE-2022-40187/): Misconfiguration in bushnellgolf:launch pro firmware (high 8.0)
- [CVE-2022-40186](https://insights.sbomify.com/CVE-2022-40186/): HashiCorp Vault vulnerable to incorrect metadata access (critical 9.1)
- [CVE-2022-40184](https://insights.sbomify.com/CVE-2022-40184/): Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000 (medium 5.1)
- [CVE-2022-40183](https://insights.sbomify.com/CVE-2022-40183/): Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000 (medium 5.8)
- [CVE-2022-40182](https://insights.sbomify.com/CVE-2022-40182/): Security feature bypass in Desigo PXM30-1 (high 8.8)
- [CVE-2022-40181](https://insights.sbomify.com/CVE-2022-40181/): Cross-site scripting in Desigo PXM30-1 (high 8.3)
- [CVE-2022-40180](https://insights.sbomify.com/CVE-2022-40180/): Cross-site request forgery in Desigo PXM30-1 (medium 5.3)
- [CVE-2022-4018](https://insights.sbomify.com/CVE-2022-4018/): Missing Authentication for Critical Function in ikus060/rdiffweb (medium 6.1)
- [CVE-2022-40179](https://insights.sbomify.com/CVE-2022-40179/): Cross-site request forgery in Desigo PXM30-1 (high 8.1)
- [CVE-2022-40178](https://insights.sbomify.com/CVE-2022-40178/): Cross-site scripting in Desigo PXM30-1 (medium 5.4)
- [CVE-2022-40177](https://insights.sbomify.com/CVE-2022-40177/): Path traversal in Desigo PXM30-1 (medium 5.7)
- [CVE-2022-40176](https://insights.sbomify.com/CVE-2022-40176/): Command injection in Desigo PXM30-1 (high 8.0)
- [CVE-2022-4017](https://insights.sbomify.com/CVE-2022-4017/): Booster for WooCommerce - Multiple CSRF (high 8.8)
- [CVE-2022-40160](https://insights.sbomify.com/CVE-2022-40160/): Stack Overflow in JXPath (medium 6.5)
- [CVE-2022-4016](https://insights.sbomify.com/CVE-2022-4016/): Booster for WooCommerce - Custom Role Creation/Deletion via CSRF (medium 6.5)
- [CVE-2022-40159](https://insights.sbomify.com/CVE-2022-40159/): Stack Overflow in JXPath (medium 6.5)
- [CVE-2022-40152](https://insights.sbomify.com/CVE-2022-40152/): Stack Buffer Overflow in Woodstox (medium 6.5)
- [CVE-2022-40151](https://insights.sbomify.com/CVE-2022-40151/): Stack Buffer Overflow in xstream (medium 6.5)
- [CVE-2022-40150](https://insights.sbomify.com/CVE-2022-40150/): Stack Buffer Overflow in Jettison (medium 6.5)
- [CVE-2022-4015](https://insights.sbomify.com/CVE-2022-4015/): Sports Club Management System make_payments.php sql injection (medium 4.7)
- [CVE-2022-40149](https://insights.sbomify.com/CVE-2022-40149/): Stack Buffer Overflow in Jettison (medium 6.5)
- [CVE-2022-40147](https://insights.sbomify.com/CVE-2022-40147/): Security feature bypass in Industrial Edge Management (high 7.4)
- [CVE-2022-40146](https://insights.sbomify.com/CVE-2022-40146/): Jar url should be blocked by DefaultScriptSecurity (high 7.5)
- [CVE-2022-40145](https://insights.sbomify.com/CVE-2022-40145/): Apache Karaf: JDBC JAAS LDAP injection (critical 9.8)
- [CVE-2022-40144](https://insights.sbomify.com/CVE-2022-40144/): Auth bypass in Trend Micro Apex One (critical 9.8)
- [CVE-2022-40143](https://insights.sbomify.com/CVE-2022-40143/): Privilege escalation in Trend Micro Apex One (high 7.3)
- [CVE-2022-40142](https://insights.sbomify.com/CVE-2022-40142/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-40141](https://insights.sbomify.com/CVE-2022-40141/): Information disclosure in Trend Micro Apex One (high 7.5)
- [CVE-2022-40140](https://insights.sbomify.com/CVE-2022-40140/): Denial of service in Trend Micro Apex One (medium 5.5)
- [CVE-2022-4014](https://insights.sbomify.com/CVE-2022-4014/): FeehiCMS Post My Comment Tab cross-site request forgery (medium 4.3)
- [CVE-2022-40139](https://insights.sbomify.com/CVE-2022-40139/): Trend Micro Apex One and Apex One as a Service Improper Validation (high 7.2, exploited in the wild)
- [CVE-2022-40138](https://insights.sbomify.com/CVE-2022-40138/): Integer overflow in Hermes (critical 9.8)
- [CVE-2022-40137](https://insights.sbomify.com/CVE-2022-40137/): Memory corruption in BIOS (medium 6.7)
- [CVE-2022-40136](https://insights.sbomify.com/CVE-2022-40136/): Information disclosure in BIOS (medium 4.4)
- [CVE-2022-40135](https://insights.sbomify.com/CVE-2022-40135/): Information disclosure in BIOS (medium 4.4)
- [CVE-2022-40134](https://insights.sbomify.com/CVE-2022-40134/): Information disclosure in BIOS (medium 4.4)
- [CVE-2022-40133](https://insights.sbomify.com/CVE-2022-40133/): There is an UAF vulnerability in vmwgfx driver (medium 6.3)
- [CVE-2022-40132](https://insights.sbomify.com/CVE-2022-40132/): WordPress Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-40131](https://insights.sbomify.com/CVE-2022-40131/): WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-40130](https://insights.sbomify.com/CVE-2022-40130/): WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability (medium 4.3)
- [CVE-2022-4013](https://insights.sbomify.com/CVE-2022-4013/): Hospital Management Center appointment.php cross-site request forgery (medium 4.3)
- [CVE-2022-40129](https://insights.sbomify.com/CVE-2022-40129/): Use after free in Foxit Reader (high 8.8)
- [CVE-2022-40128](https://insights.sbomify.com/CVE-2022-40128/): WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-40127](https://insights.sbomify.com/CVE-2022-40127/): Apache Airflow <2.4.0 has an RCE in a bash example (high 8.8)
- [CVE-2022-40126](https://insights.sbomify.com/CVE-2022-40126/): Privilege escalation in clash project:clash (high 7.8)
- [CVE-2022-40123](https://insights.sbomify.com/CVE-2022-40123/): Path traversal in mojoportal:mojoportal (medium 6.5)
- [CVE-2022-40122](https://insights.sbomify.com/CVE-2022-40122/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40121](https://insights.sbomify.com/CVE-2022-40121/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40120](https://insights.sbomify.com/CVE-2022-40120/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-4012](https://insights.sbomify.com/CVE-2022-4012/): Hospital Management Center patient-info.php sql injection (medium 6.3)
- [CVE-2022-40119](https://insights.sbomify.com/CVE-2022-40119/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40118](https://insights.sbomify.com/CVE-2022-40118/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40117](https://insights.sbomify.com/CVE-2022-40117/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40116](https://insights.sbomify.com/CVE-2022-40116/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40115](https://insights.sbomify.com/CVE-2022-40115/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40114](https://insights.sbomify.com/CVE-2022-40114/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40113](https://insights.sbomify.com/CVE-2022-40113/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-40112](https://insights.sbomify.com/CVE-2022-40112/): Memory corruption in totolink:a3002r firmware (high 7.5)
- [CVE-2022-40111](https://insights.sbomify.com/CVE-2022-40111/): Hardcoded credentials in totolink:a3002r firmware (critical 9.8)
- [CVE-2022-40110](https://insights.sbomify.com/CVE-2022-40110/): Memory corruption in totolink:a3002r firmware (high 7.5)
- [CVE-2022-4011](https://insights.sbomify.com/CVE-2022-4011/): Simple History Plugin Header neutralization for logs (medium 6.5)
- [CVE-2022-40109](https://insights.sbomify.com/CVE-2022-40109/): Misconfiguration in totolink:a3002r firmware (critical 9.8)
- [CVE-2022-40107](https://insights.sbomify.com/CVE-2022-40107/): Memory corruption in tenda:i9 firmware (high 7.5)
- [CVE-2022-40106](https://insights.sbomify.com/CVE-2022-40106/): Memory corruption in tenda:i9 firmware (high 7.5)
- [CVE-2022-40105](https://insights.sbomify.com/CVE-2022-40105/): Memory corruption in tenda:i9 firmware (high 7.5)
- [CVE-2022-40104](https://insights.sbomify.com/CVE-2022-40104/): Memory corruption in tenda:i9 firmware (high 7.5)
- [CVE-2022-40103](https://insights.sbomify.com/CVE-2022-40103/): Memory corruption in tenda:i9 firmware (medium 5.5)
- [CVE-2022-40102](https://insights.sbomify.com/CVE-2022-40102/): Memory corruption in tenda:i9 firmware (high 7.5)
- [CVE-2022-40101](https://insights.sbomify.com/CVE-2022-40101/): Memory corruption in tenda:i9 firmware (high 7.5)
- [CVE-2022-40100](https://insights.sbomify.com/CVE-2022-40100/): Command injection in tenda:i9 firmware (critical 9.8)
- [CVE-2022-4010](https://insights.sbomify.com/CVE-2022-4010/): Image Hover Effects < 5.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-40099](https://insights.sbomify.com/CVE-2022-40099/): SQL injection in online tours \& travels management system project:online tours \& travels management system (high 7.2)
- [CVE-2022-40098](https://insights.sbomify.com/CVE-2022-40098/): SQL injection in online tours \& travels management system project:online tours \& travels management system (high 7.2)
- [CVE-2022-40097](https://insights.sbomify.com/CVE-2022-40097/): SQL injection in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-40093](https://insights.sbomify.com/CVE-2022-40093/): SQL injection in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-40092](https://insights.sbomify.com/CVE-2022-40092/): SQL injection in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-40091](https://insights.sbomify.com/CVE-2022-40091/): SQL injection in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-40090](https://insights.sbomify.com/CVE-2022-40090/): Denial of service in libtiff:libtiff (medium 6.5)
- [CVE-2022-4009](https://insights.sbomify.com/CVE-2022-4009/): Command injection in Octopus Server (high 8.8)
- [CVE-2022-40089](https://insights.sbomify.com/CVE-2022-40089/): Code injection in simple college website project:simple college website (critical 9.8)
- [CVE-2022-40088](https://insights.sbomify.com/CVE-2022-40088/): Cross-site scripting in simple college website project:simple college website (medium 6.1)
- [CVE-2022-40087](https://insights.sbomify.com/CVE-2022-40087/): File upload in simple college website project:simple college website (critical 9.8)
- [CVE-2022-40084](https://insights.sbomify.com/CVE-2022-40084/): OpenCRX vulnerable to password enumeration via error messages in password reset (medium 5.3)
- [CVE-2022-40083](https://insights.sbomify.com/CVE-2022-40083/): Labstack Echo Open Redirect vulnerability (critical 9.6)
- [CVE-2022-40082](https://insights.sbomify.com/CVE-2022-40082/): Hertz contains path traversal via normalizePath function (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/252/