# Vulnerabilities published in 2022


- [CVE-2022-39809](https://insights.sbomify.com/CVE-2022-39809/): Cross-site scripting in wso2:enterprise integrator (medium 6.1)
- [CVE-2022-39808](https://insights.sbomify.com/CVE-2022-39808/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-39807](https://insights.sbomify.com/CVE-2022-39807/): Memory corruption in SAP 3D Visual Enterprise Author (medium 5.5)
- [CVE-2022-39806](https://insights.sbomify.com/CVE-2022-39806/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-39805](https://insights.sbomify.com/CVE-2022-39805/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-39804](https://insights.sbomify.com/CVE-2022-39804/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-39803](https://insights.sbomify.com/CVE-2022-39803/): Memory corruption in SAP 3D Visual Enterprise Author (high 7.8)
- [CVE-2022-39802](https://insights.sbomify.com/CVE-2022-39802/): Path traversal in SAP Manufacturing Execution (high 7.5)
- [CVE-2022-39801](https://insights.sbomify.com/CVE-2022-39801/): Auth bypass in SAP GRC Access Control Emergency Access Management (high 7.5)
- [CVE-2022-39800](https://insights.sbomify.com/CVE-2022-39800/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (BI LaunchPad) (medium 6.1)
- [CVE-2022-3980](https://insights.sbomify.com/CVE-2022-3980/): XML external entity in Sophos Mobile managed on-premises (critical 9.8)
- [CVE-2022-39799](https://insights.sbomify.com/CVE-2022-39799/): Cross-site scripting in SAP NetWeaver AS ABAP (SAP GUI for HTML within the Fiori Launchpad) (medium 6.1)
- [CVE-2022-3979](https://insights.sbomify.com/CVE-2022-3979/): NagVis CoreLogonMultisite.php checkAuthCookie type conversion (medium 5.6)
- [CVE-2022-3978](https://insights.sbomify.com/CVE-2022-3978/): NodeBB abort cross-site request forgery (medium 4.3)
- [CVE-2022-3977](https://insights.sbomify.com/CVE-2022-3977/): Use after free in Kernel (high 7.8)
- [CVE-2022-3976](https://insights.sbomify.com/CVE-2022-3976/): MZ Automation libiec61850 MMS File Services mms_client_files.c path traversal (medium 5.5)
- [CVE-2022-3975](https://insights.sbomify.com/CVE-2022-3975/): NukeViet CMS Data URL Request.php filterAttr cross site scripting (low 3.5)
- [CVE-2022-3974](https://insights.sbomify.com/CVE-2022-3974/): Axiomatic Bento4 mp4info Ap4StdCFileByteStream.cpp ReadPartial heap-based overflow (medium 6.3)
- [CVE-2022-3973](https://insights.sbomify.com/CVE-2022-3973/): Pingkon HMS-PHP Data Pump Metadata admin.php sql injection (high 7.3)
- [CVE-2022-3972](https://insights.sbomify.com/CVE-2022-3972/): Pingkon HMS-PHP adminlogin.php sql injection (high 7.3)
- [CVE-2022-3971](https://insights.sbomify.com/CVE-2022-3971/): matrix-appservice-irc PgDataStore.ts sql injection (medium 4.6)
- [CVE-2022-3970](https://insights.sbomify.com/CVE-2022-3970/): LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow (medium 6.3)
- [CVE-2022-3969](https://insights.sbomify.com/CVE-2022-3969/): OpenKM FileUtils.java getFileExtension temp file (low 2.6)
- [CVE-2022-3968](https://insights.sbomify.com/CVE-2022-3968/): emlog article_save.php cross site scripting (low 3.5)
- [CVE-2022-3967](https://insights.sbomify.com/CVE-2022-3967/): Vesta Control Panel sed main.sh argument injection (medium 5.3)
- [CVE-2022-3966](https://insights.sbomify.com/CVE-2022-3966/): Ultimate Member Plugin Template class-shortcodes.php load_template pathname traversal (medium 4.3)
- [CVE-2022-3965](https://insights.sbomify.com/CVE-2022-3965/): ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds (medium 4.3)
- [CVE-2022-3964](https://insights.sbomify.com/CVE-2022-3964/): ffmpeg QuickTime RPZA Video Encoder rpzaenc.c out-of-bounds (medium 4.3)
- [CVE-2022-3963](https://insights.sbomify.com/CVE-2022-3963/): gnuboard5 FAQ Key ID faq.php cross site scripting (low 3.5)
- [CVE-2022-3962](https://insights.sbomify.com/CVE-2022-3962/): Kiali: error message spoofing in kiali ui (medium 4.3)
- [CVE-2022-3961](https://insights.sbomify.com/CVE-2022-3961/): Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure (medium 6.5)
- [CVE-2022-3960](https://insights.sbomify.com/CVE-2022-3960/): Code injection in Pentaho Business Analytics Server (medium 6.3)
- [CVE-2022-3959](https://insights.sbomify.com/CVE-2022-3959/): drogon Session Hash small space of random values (low 3.1)
- [CVE-2022-3958](https://insights.sbomify.com/CVE-2022-3958/): Potential XSS on personal menu navigation (low 3.3)
- [CVE-2022-3957](https://insights.sbomify.com/CVE-2022-3957/): GPAC SVG Parser svg_attributes.c svg_parse_preserveaspectratio memory leak (medium 4.3)
- [CVE-2022-3956](https://insights.sbomify.com/CVE-2022-3956/): tsruban HHIMS Patient Portrait sql injection (medium 6.3)
- [CVE-2022-3955](https://insights.sbomify.com/CVE-2022-3955/): tholum crm42 Login class.user.php sql injection (high 7.3)
- [CVE-2022-3952](https://insights.sbomify.com/CVE-2022-3952/): ManyDesigns Portofino WarFileLauncher.java createTempDir temp file (low 2.6)
- [CVE-2022-3950](https://insights.sbomify.com/CVE-2022-3950/): sanluan PublicCMS Tab dwz.min.js initLink cross site scripting (low 3.5)
- [CVE-2022-3949](https://insights.sbomify.com/CVE-2022-3949/): Sourcecodester Simple Cashiering System User Account cross site scripting (low 3.5)
- [CVE-2022-3948](https://insights.sbomify.com/CVE-2022-3948/): eolinker goku_lite getList sql injection (medium 6.3)
- [CVE-2022-3947](https://insights.sbomify.com/CVE-2022-3947/): eolinker goku_lite list sql injection (medium 6.3)
- [CVE-2022-3946](https://insights.sbomify.com/CVE-2022-3946/): Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion (medium 6.5)
- [CVE-2022-3945](https://insights.sbomify.com/CVE-2022-3945/): Improper Restriction of Excessive Authentication Attempts in kareadita/kavita (critical 9.4)
- [CVE-2022-3944](https://insights.sbomify.com/CVE-2022-3944/): jerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload (medium 6.3)
- [CVE-2022-3943](https://insights.sbomify.com/CVE-2022-3943/): ForU CMS cms_chip.php cross site scripting (low 3.5)
- [CVE-2022-39429](https://insights.sbomify.com/CVE-2022-39429/): Denial of service in Database - Enterprise Edition (medium 4.3)
- [CVE-2022-39428](https://insights.sbomify.com/CVE-2022-39428/): Other in Web Applications Desktop Integrator (critical 9.8)
- [CVE-2022-39427](https://insights.sbomify.com/CVE-2022-39427/): Other in VM VirtualBox (high 8.8)
- [CVE-2022-39426](https://insights.sbomify.com/CVE-2022-39426/): Auth bypass in VM VirtualBox (high 8.1)
- [CVE-2022-39425](https://insights.sbomify.com/CVE-2022-39425/): Auth bypass in VM VirtualBox (high 8.1)
- [CVE-2022-39424](https://insights.sbomify.com/CVE-2022-39424/): Code injection in VM VirtualBox (high 8.1)
- [CVE-2022-39423](https://insights.sbomify.com/CVE-2022-39423/): Information disclosure in VM VirtualBox (medium 6.0)
- [CVE-2022-39422](https://insights.sbomify.com/CVE-2022-39422/): Privilege escalation in VM VirtualBox (high 7.5)
- [CVE-2022-39421](https://insights.sbomify.com/CVE-2022-39421/): Other in VM VirtualBox (high 7.3)
- [CVE-2022-39420](https://insights.sbomify.com/CVE-2022-39420/): Other in Transportation Management (medium 5.4)
- [CVE-2022-3942](https://insights.sbomify.com/CVE-2022-3942/): SourceCodester Sanitization Management System cross site scripting (medium 4.3)
- [CVE-2022-39419](https://insights.sbomify.com/CVE-2022-39419/): Information disclosure in Database - Enterprise Edition (medium 4.3)
- [CVE-2022-39417](https://insights.sbomify.com/CVE-2022-39417/): Denial of service in Solaris Operating System (medium 5.5)
- [CVE-2022-39412](https://insights.sbomify.com/CVE-2022-39412/): Missing authorization in Access Manager (high 7.5)
- [CVE-2022-39411](https://insights.sbomify.com/CVE-2022-39411/): Other in Transportation Management (medium 4.9)
- [CVE-2022-39410](https://insights.sbomify.com/CVE-2022-39410/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2022-3941](https://insights.sbomify.com/CVE-2022-3941/): Activity Log Plugin HTTP Header neutralization for logs (medium 5.3)
- [CVE-2022-39409](https://insights.sbomify.com/CVE-2022-39409/): Denial of service in Transportation Management (low 2.7)
- [CVE-2022-39408](https://insights.sbomify.com/CVE-2022-39408/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2022-39407](https://insights.sbomify.com/CVE-2022-39407/): Information disclosure in PeopleSoft Enterprise PT PeopleTools (medium 5.5)
- [CVE-2022-39406](https://insights.sbomify.com/CVE-2022-39406/): Missing authorization in PeopleSoft Enterprise CC Common Application Objects (high 8.1)
- [CVE-2022-39405](https://insights.sbomify.com/CVE-2022-39405/): Missing authorization in Access Manager (medium 5.3)
- [CVE-2022-39404](https://insights.sbomify.com/CVE-2022-39404/): Other in MySQL Installer (medium 4.2)
- [CVE-2022-39403](https://insights.sbomify.com/CVE-2022-39403/): Other in MySQL Server (low 3.9)
- [CVE-2022-39402](https://insights.sbomify.com/CVE-2022-39402/): Information disclosure in MySQL Server (medium 4.3)
- [CVE-2022-39401](https://insights.sbomify.com/CVE-2022-39401/): Denial of service in Solaris Operating System (medium 5.5)
- [CVE-2022-39400](https://insights.sbomify.com/CVE-2022-39400/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-3940](https://insights.sbomify.com/CVE-2022-3940/): lanyulei ferry task.go path traversal (low 3.5)
- [CVE-2022-39399](https://insights.sbomify.com/CVE-2022-39399/): Other in Java SE JDK and JRE (low 3.7)
- [CVE-2022-39398](https://insights.sbomify.com/CVE-2022-39398/): InfotelGLPI vulnerable to Cross-site Scripting (high 8.8)
- [CVE-2022-39397](https://insights.sbomify.com/CVE-2022-39397/): Exposure of sensitive information in aliyun-oss-client (medium 5.6)
- [CVE-2022-39396](https://insights.sbomify.com/CVE-2022-39396/): Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser (critical 9.8)
- [CVE-2022-39395](https://insights.sbomify.com/CVE-2022-39395/): Vela Insecure Defaults (critical 9.6)
- [CVE-2022-39394](https://insights.sbomify.com/CVE-2022-39394/): wasmtime_trap_code C API function has out of bounds write vulnerability (low 3.8)
- [CVE-2022-39393](https://insights.sbomify.com/CVE-2022-39393/): Wasmtime vulnerable to data leakage between instances in the pooling allocator (high 8.6)
- [CVE-2022-39392](https://insights.sbomify.com/CVE-2022-39392/): Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration (medium 5.9)
- [CVE-2022-3939](https://insights.sbomify.com/CVE-2022-3939/): lanyulei ferry API file.go path traversal (medium 6.3)
- [CVE-2022-39389](https://insights.sbomify.com/CVE-2022-39389/): Witness Block Parsing DoS Vulnerability in lnd (high 8.2)
- [CVE-2022-39388](https://insights.sbomify.com/CVE-2022-39388/): Istio may allow identity impersonation if user has localhost access (high 7.6)
- [CVE-2022-39387](https://insights.sbomify.com/CVE-2022-39387/): XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication (critical 9.1)
- [CVE-2022-39386](https://insights.sbomify.com/CVE-2022-39386/): fastify-websocket vulnerable to uncaught exception via crash on malformed packet (high 7.5)
- [CVE-2022-39385](https://insights.sbomify.com/CVE-2022-39385/): Users erroneously and transparently added to private messages in Discourse (medium 6.5)
- [CVE-2022-39384](https://insights.sbomify.com/CVE-2022-39384/): OpenZeppelin Contracts initializer reentrancy may lead to double initialization (medium 5.6)
- [CVE-2022-39383](https://insights.sbomify.com/CVE-2022-39383/): SSRF vulnerability in KubeVela VelaUX APIServer (medium 4.9)
- [CVE-2022-39382](https://insights.sbomify.com/CVE-2022-39382/): NODE_ENV in Keystone defaults to development with esbuild (critical 9.8)
- [CVE-2022-39381](https://insights.sbomify.com/CVE-2022-39381/): Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp (high 7.5)
- [CVE-2022-39380](https://insights.sbomify.com/CVE-2022-39380/): wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering (medium 5.3)
- [CVE-2022-39379](https://insights.sbomify.com/CVE-2022-39379/): Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) (low 3.1)
- [CVE-2022-39378](https://insights.sbomify.com/CVE-2022-39378/): Displaying user badges can leak topic titles to users that have no access to the topic (medium 5.3)
- [CVE-2022-39377](https://insights.sbomify.com/CVE-2022-39377/): sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow (high 7.0)
- [CVE-2022-39376](https://insights.sbomify.com/CVE-2022-39376/): Improper input validation on emails links in GLPI (low 2.6)
- [CVE-2022-39375](https://insights.sbomify.com/CVE-2022-39375/): Cross-Site Scripting (XSS) through public RSS feed in GLPI (medium 4.5)
- [CVE-2022-39374](https://insights.sbomify.com/CVE-2022-39374/): Synapse Denial of service due to incorrect application of event authorization rules during state resolution (medium 6.5)
- [CVE-2022-39373](https://insights.sbomify.com/CVE-2022-39373/): Stored Cross-Site Scripting (XSS) in entity name in GLPI (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/255/