# Vulnerabilities published in 2022


- [CVE-2022-40080](https://insights.sbomify.com/CVE-2022-40080/): Memory corruption in acer:aspire e5-475g firmware (high 7.8)
- [CVE-2022-4008](https://insights.sbomify.com/CVE-2022-4008/): Denial of service in Octopus Tentacle (medium 5.5)
- [CVE-2022-40076](https://insights.sbomify.com/CVE-2022-40076/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40075](https://insights.sbomify.com/CVE-2022-40075/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40074](https://insights.sbomify.com/CVE-2022-40074/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40073](https://insights.sbomify.com/CVE-2022-40073/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40072](https://insights.sbomify.com/CVE-2022-40072/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40071](https://insights.sbomify.com/CVE-2022-40071/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40070](https://insights.sbomify.com/CVE-2022-40070/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-4007](https://insights.sbomify.com/CVE-2022-4007/): Cross-site scripting in GitLab (medium 5.4)
- [CVE-2022-40069](https://insights.sbomify.com/CVE-2022-40069/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40068](https://insights.sbomify.com/CVE-2022-40068/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-40067](https://insights.sbomify.com/CVE-2022-40067/): Memory corruption in tenda:ac21 firmware (high 7.5)
- [CVE-2022-4006](https://insights.sbomify.com/CVE-2022-4006/): WBCE CMS Header class.login.php increase_attempts excessive authentication (low 3.7)
- [CVE-2022-40055](https://insights.sbomify.com/CVE-2022-40055/): Auth bypass in gxgroup:gpon ont titanium 2122a firmware (critical 9.8)
- [CVE-2022-40050](https://insights.sbomify.com/CVE-2022-40050/): File upload in zfile:zfile (critical 9.8)
- [CVE-2022-4005](https://insights.sbomify.com/CVE-2022-4005/): Donation Button <= 4.0.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2022-40049](https://insights.sbomify.com/CVE-2022-40049/): SQL injection in theme park ticketing system project:theme park ticketing system (high 7.5)
- [CVE-2022-40048](https://insights.sbomify.com/CVE-2022-40048/): File upload in flatpress:flatpress (high 7.2)
- [CVE-2022-40047](https://insights.sbomify.com/CVE-2022-40047/): Cross-site scripting in flatpress:flatpress (medium 5.4)
- [CVE-2022-40044](https://insights.sbomify.com/CVE-2022-40044/): Centreon contains cross-site scripting vulnerability via esc_name parameter (medium 5.4)
- [CVE-2022-40043](https://insights.sbomify.com/CVE-2022-40043/): Centreon SQL Injection vulnerability via esc_name parameter (high 8.8)
- [CVE-2022-4004](https://insights.sbomify.com/CVE-2022-4004/): Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam (medium 4.3)
- [CVE-2022-40037](https://insights.sbomify.com/CVE-2022-40037/): File upload in javaweb blog project:javaweb blog (critical 9.8)
- [CVE-2022-40036](https://insights.sbomify.com/CVE-2022-40036/): Missing authorization in blog-ssm project:blog-ssm (medium 6.5)
- [CVE-2022-40035](https://insights.sbomify.com/CVE-2022-40035/): File upload in blog-ssm project:blog-ssm (high 8.8)
- [CVE-2022-40034](https://insights.sbomify.com/CVE-2022-40034/): Cross-site scripting in javaweb blog project:javaweb blog (medium 5.4)
- [CVE-2022-40032](https://insights.sbomify.com/CVE-2022-40032/): SQL injection in simple task managing system project:simple task managing system (critical 9.8)
- [CVE-2022-40030](https://insights.sbomify.com/CVE-2022-40030/): SQL injection in simple task managing system project:simple task managing system (critical 9.8)
- [CVE-2022-4003](https://insights.sbomify.com/CVE-2022-4003/): Denial of service in Q14 Mesh Router Firmware (low 2.7)
- [CVE-2022-40029](https://insights.sbomify.com/CVE-2022-40029/): Cross-site scripting in simple task managing system project:simple task managing system (medium 4.8)
- [CVE-2022-40028](https://insights.sbomify.com/CVE-2022-40028/): Cross-site scripting in simple task managing system project:simple task managing system (medium 4.8)
- [CVE-2022-40027](https://insights.sbomify.com/CVE-2022-40027/): Cross-site scripting in simple task managing system project:simple task managing system (medium 6.1)
- [CVE-2022-40026](https://insights.sbomify.com/CVE-2022-40026/): SQL injection in simple task managing system project:simple task managing system (high 7.2)
- [CVE-2022-40023](https://insights.sbomify.com/CVE-2022-40023/): mako is vulnerable to Regular Expression Denial of Service (high 7.5)
- [CVE-2022-40022](https://insights.sbomify.com/CVE-2022-40022/): Command injection in microchip:syncserver s650 firmware (critical 9.8)
- [CVE-2022-40021](https://insights.sbomify.com/CVE-2022-40021/): Command injection in qvidium:amino a140 firmware (critical 9.8)
- [CVE-2022-4002](https://insights.sbomify.com/CVE-2022-4002/): Command injection in Q14 Mesh Router Firmware (high 7.2)
- [CVE-2022-40016](https://insights.sbomify.com/CVE-2022-40016/): Use after free in media-server project:media-server (high 7.5)
- [CVE-2022-40011](https://insights.sbomify.com/CVE-2022-40011/): Cross-site scripting in typora:typora (medium 6.1)
- [CVE-2022-40010](https://insights.sbomify.com/CVE-2022-40010/): Cross-site scripting in tenda:ac6 firmware (medium 5.4)
- [CVE-2022-4001](https://insights.sbomify.com/CVE-2022-4001/): Auth bypass in Q14 Mesh Router Firmware (high 7.3)
- [CVE-2022-40009](https://insights.sbomify.com/CVE-2022-40009/): Use after free in swftools:swftools (critical 9.8)
- [CVE-2022-40008](https://insights.sbomify.com/CVE-2022-40008/): Memory corruption in swftools:swftools (critical 9.8)
- [CVE-2022-40005](https://insights.sbomify.com/CVE-2022-40005/): Command injection in intelbras:wifiber 120ac inmesh firmware (high 8.8)
- [CVE-2022-40004](https://insights.sbomify.com/CVE-2022-40004/): Cross-site scripting in thingsboard:thingsboard (critical 9.6)
- [CVE-2022-40002](https://insights.sbomify.com/CVE-2022-40002/): FeehiCMS Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2022-40001](https://insights.sbomify.com/CVE-2022-40001/): FeehiCMS Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2022-40000](https://insights.sbomify.com/CVE-2022-40000/): FeehiCMS Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2022-4000](https://insights.sbomify.com/CVE-2022-4000/): WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-39997](https://insights.sbomify.com/CVE-2022-39997/): A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges (high 8.0)
- [CVE-2022-39996](https://insights.sbomify.com/CVE-2022-39996/): Cross-site scripting in teldat:rs123 firmware (medium 4.8)
- [CVE-2022-3999](https://insights.sbomify.com/CVE-2022-3999/): WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion (high 8.1)
- [CVE-2022-39989](https://insights.sbomify.com/CVE-2022-39989/): Hardcoded credentials in fighting cock information system project:fighting cock information system (critical 9.8)
- [CVE-2022-39988](https://insights.sbomify.com/CVE-2022-39988/): Cross-site scripting in centreon:centreon (medium 5.4)
- [CVE-2022-39987](https://insights.sbomify.com/CVE-2022-39987/): RaspAP Command Injection vulnerability (high 8.8)
- [CVE-2022-39986](https://insights.sbomify.com/CVE-2022-39986/): RaspAP Command Injection vulnerability (critical 9.8)
- [CVE-2022-39983](https://insights.sbomify.com/CVE-2022-39983/): File upload in instantdeveloper:rd3 (critical 9.8)
- [CVE-2022-3998](https://insights.sbomify.com/CVE-2022-3998/): MonikaBrzica scm uredi_korisnika.php sql injection (medium 6.3)
- [CVE-2022-39978](https://insights.sbomify.com/CVE-2022-39978/): File upload in online pet shop we app project:online pet shop we app (high 7.2)
- [CVE-2022-39977](https://insights.sbomify.com/CVE-2022-39977/): File upload in online pet shop we app project:online pet shop we app (high 7.2)
- [CVE-2022-39976](https://insights.sbomify.com/CVE-2022-39976/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (critical 9.8)
- [CVE-2022-39975](https://insights.sbomify.com/CVE-2022-39975/): Liferay Portal Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-39974](https://insights.sbomify.com/CVE-2022-39974/): WASM3 Improper Input Validation vulnerability (high 7.5)
- [CVE-2022-3997](https://insights.sbomify.com/CVE-2022-3997/): MonikaBrzica scm upis_u_bazu.php sql injection (medium 6.3)
- [CVE-2022-39960](https://insights.sbomify.com/CVE-2022-39960/): Missing authorization in netic:group export (medium 5.3)
- [CVE-2022-3996](https://insights.sbomify.com/CVE-2022-3996/): X.509 Policy Constraints Double Locking (high 7.5)
- [CVE-2022-39959](https://insights.sbomify.com/CVE-2022-39959/): Privilege escalation in panini:everest engine (high 7.8)
- [CVE-2022-39958](https://insights.sbomify.com/CVE-2022-39958/): Security feature bypass in ModSecurity Core Rule Set (high 7.5)
- [CVE-2022-39957](https://insights.sbomify.com/CVE-2022-39957/): Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header (high 7.3)
- [CVE-2022-39956](https://insights.sbomify.com/CVE-2022-39956/): Security feature bypass in ModSecurity Core Rule Set (high 7.3)
- [CVE-2022-39955](https://insights.sbomify.com/CVE-2022-39955/): Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header (high 7.3)
- [CVE-2022-39954](https://insights.sbomify.com/CVE-2022-39954/): XML external entity in FortiNAC (medium 6.9)
- [CVE-2022-39953](https://insights.sbomify.com/CVE-2022-39953/): Privilege escalation in FortiNAC (high 7.8)
- [CVE-2022-39952](https://insights.sbomify.com/CVE-2022-39952/): Code injection in FortiNAC (critical 9.8)
- [CVE-2022-39951](https://insights.sbomify.com/CVE-2022-39951/): Command injection in FortiWeb (high 7.2)
- [CVE-2022-39950](https://insights.sbomify.com/CVE-2022-39950/): Cross-site scripting in Fortinet FortiAnalyzer, FortiManager (high 8.0)
- [CVE-2022-3995](https://insights.sbomify.com/CVE-2022-3995/): TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference (medium 4.3)
- [CVE-2022-39949](https://insights.sbomify.com/CVE-2022-39949/): Security feature bypass in Fortinet FortiEDR (medium 4.4)
- [CVE-2022-39948](https://insights.sbomify.com/CVE-2022-39948/): Security feature bypass in FortiOS (medium 4.4)
- [CVE-2022-39947](https://insights.sbomify.com/CVE-2022-39947/): Command injection in FortiADC (high 8.6)
- [CVE-2022-39946](https://insights.sbomify.com/CVE-2022-39946/): Missing authorization in FortiNAC (high 7.2)
- [CVE-2022-39945](https://insights.sbomify.com/CVE-2022-39945/): Missing authorization in Fortinet FortiMail (medium 5.4)
- [CVE-2022-39944](https://insights.sbomify.com/CVE-2022-39944/): The Apache Linkis JDBC EngineConn module has a RCE Vulnerability (high 8.8)
- [CVE-2022-3994](https://insights.sbomify.com/CVE-2022-3994/): Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure (medium 4.3)
- [CVE-2022-3993](https://insights.sbomify.com/CVE-2022-3993/): Improper Restriction of Excessive Authentication Attempts in kareadita/kavita (critical 9.4)
- [CVE-2022-3992](https://insights.sbomify.com/CVE-2022-3992/): SourceCodester Sanitization Management System Banner Image cross site scripting (low 2.4)
- [CVE-2022-39915](https://insights.sbomify.com/CVE-2022-39915/): Missing authorization in Samsung Calendar (low 3.3)
- [CVE-2022-39914](https://insights.sbomify.com/CVE-2022-39914/): Information disclosure in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-39913](https://insights.sbomify.com/CVE-2022-39913/): Information disclosure in Samsung Mobile Devices (medium 6.8)
- [CVE-2022-39912](https://insights.sbomify.com/CVE-2022-39912/): Missing authorization in Samsung Mobile Devices (medium 6.2)
- [CVE-2022-39911](https://insights.sbomify.com/CVE-2022-39911/): Security feature bypass in Samsung Pass (medium 4.8)
- [CVE-2022-39910](https://insights.sbomify.com/CVE-2022-39910/): Missing authorization in Samsung Pass (low 3.9)
- [CVE-2022-3991](https://insights.sbomify.com/CVE-2022-3991/): Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2022-39909](https://insights.sbomify.com/CVE-2022-39909/): Other in Samsung Gear IconX PC Manager (high 7.1)
- [CVE-2022-39908](https://insights.sbomify.com/CVE-2022-39908/): Race condition in Samsung Mobile Devices (medium 6.9)
- [CVE-2022-39907](https://insights.sbomify.com/CVE-2022-39907/): Integer overflow in Samsung Mobile Devices (medium 6.9)
- [CVE-2022-39906](https://insights.sbomify.com/CVE-2022-39906/): Missing authorization in Samsung Mobile Devices (low 2.3)
- [CVE-2022-39905](https://insights.sbomify.com/CVE-2022-39905/): Information disclosure in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-39904](https://insights.sbomify.com/CVE-2022-39904/): Information disclosure in Samsung Mobile Devices (low 3.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/253/