# Vulnerabilities published in 2022


- [CVE-2022-39084](https://insights.sbomify.com/CVE-2022-39084/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.7)
- [CVE-2022-39083](https://insights.sbomify.com/CVE-2022-39083/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.7)
- [CVE-2022-39082](https://insights.sbomify.com/CVE-2022-39082/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.7)
- [CVE-2022-39081](https://insights.sbomify.com/CVE-2022-39081/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.7)
- [CVE-2022-39080](https://insights.sbomify.com/CVE-2022-39080/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2022-3908](https://insights.sbomify.com/CVE-2022-3908/): Helloprint < 1.4.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-39075](https://insights.sbomify.com/CVE-2022-39075/): Missing authorization in ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra (high 7.1)
- [CVE-2022-39074](https://insights.sbomify.com/CVE-2022-39074/): Missing authorization in ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra (low 3.3)
- [CVE-2022-39073](https://insights.sbomify.com/CVE-2022-39073/): Command injection in MF286R (critical 9.8)
- [CVE-2022-39072](https://insights.sbomify.com/CVE-2022-39072/): SQL injection in MF286R,MF289D (medium 5.4)
- [CVE-2022-39071](https://insights.sbomify.com/CVE-2022-39071/): Missing authorization in ZTE Blade A52, ZTE Blade A51, ZTE Blade A3 Lite, ZTE Blade A5 2020, ZTE Blade L210, ZTE Blade A7s, ZTE Blade A31, ZTE Blade A31 Plus, ZTE Blade A5 (2019), ZTE Blade A71, ZTE Blade A72, ZTE Blade V20 Smart, ZTE Blade V30, ZTE Blade V30 Vita, ZTE V40 Pro, ZTE Blade V40 Vita, ZTE Axon 40 Ultra (high 7.1)
- [CVE-2022-39070](https://insights.sbomify.com/CVE-2022-39070/): Missing authorization in ZXA10 C3XX (critical 9.8)
- [CVE-2022-3907](https://insights.sbomify.com/CVE-2022-3907/): Clerk < 4.0.0 - Authentication Bypass and API Keys Disclosure (high 7.5)
- [CVE-2022-39069](https://insights.sbomify.com/CVE-2022-39069/): SQL injection in ZAIP-AIE (medium 5.3)
- [CVE-2022-39068](https://insights.sbomify.com/CVE-2022-39068/): Buffer Overflow Vulnerability in ZTE MF296R (medium 4.5)
- [CVE-2022-39067](https://insights.sbomify.com/CVE-2022-39067/): Memory corruption in MF286R (medium 6.5)
- [CVE-2022-39066](https://insights.sbomify.com/CVE-2022-39066/): SQL injection in MF286R (high 8.8)
- [CVE-2022-39065](https://insights.sbomify.com/CVE-2022-39065/): Denial of service in TRÅDFRI gateway system (medium 6.5)
- [CVE-2022-39064](https://insights.sbomify.com/CVE-2022-39064/): Denial of service in TRÅDFRI smart lighting system (high 8.1)
- [CVE-2022-39063](https://insights.sbomify.com/CVE-2022-39063/): Memory corruption in Open5GS (high 7.5)
- [CVE-2022-39062](https://insights.sbomify.com/CVE-2022-39062/): Misconfiguration in SICAM TOOLBOX II (high 7.8)
- [CVE-2022-39061](https://insights.sbomify.com/CVE-2022-39061/): ChangingTec MegaServiSignAdapter - Out-of-bounds Read (medium 6.5)
- [CVE-2022-39060](https://insights.sbomify.com/CVE-2022-39060/): ChangingTec MegaServiSignAdapter - Improper Input Validation (critical 9.8)
- [CVE-2022-3906](https://insights.sbomify.com/CVE-2022-3906/): Easy Form Builder < 3.4.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-39059](https://insights.sbomify.com/CVE-2022-39059/): ChangingTec MegaServiSignAdapter - Path Traversal (high 7.5)
- [CVE-2022-39058](https://insights.sbomify.com/CVE-2022-39058/): Changing Information Technology Inc. RAVA certificate validation system - Path Traversal (high 7.5)
- [CVE-2022-39057](https://insights.sbomify.com/CVE-2022-39057/): Changing Information Technology Inc. RAVA certificate validation system - Command Injection (high 7.2)
- [CVE-2022-39056](https://insights.sbomify.com/CVE-2022-39056/): Changing Information Technology Inc. RAVA certificate validation system - SQL Injection (critical 9.8)
- [CVE-2022-39055](https://insights.sbomify.com/CVE-2022-39055/): Changing Information Technology Inc. RAVA certificate validation system - Server-Side Request Forgery (SSRF) (medium 5.3)
- [CVE-2022-39054](https://insights.sbomify.com/CVE-2022-39054/): COWELL INFORMATION SYSTEM CO., LTD. enterprise travel management system - Reflected XSS (medium 6.1)
- [CVE-2022-39053](https://insights.sbomify.com/CVE-2022-39053/): HEIMAVISTA INC. Rpage - Reflected XSS (medium 6.1)
- [CVE-2022-39052](https://insights.sbomify.com/CVE-2022-39052/): DoS attack using email (high 7.5)
- [CVE-2022-39051](https://insights.sbomify.com/CVE-2022-39051/): Perl Code execution in Template Toolkit (medium 6.8)
- [CVE-2022-39050](https://insights.sbomify.com/CVE-2022-39050/): Possible XSS stored in customer information (medium 4.6)
- [CVE-2022-39049](https://insights.sbomify.com/CVE-2022-39049/): Possible XSS in Admin Interface (low 3.5)
- [CVE-2022-39048](https://insights.sbomify.com/CVE-2022-39048/): Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect (medium 6.1)
- [CVE-2022-39047](https://insights.sbomify.com/CVE-2022-39047/): Memory corruption in freeciv:freeciv (high 8.8)
- [CVE-2022-39046](https://insights.sbomify.com/CVE-2022-39046/): Information disclosure in gnu:glibc (high 7.5)
- [CVE-2022-39045](https://insights.sbomify.com/CVE-2022-39045/): Path traversal in QUARTZ-GOLD (high 7.2)
- [CVE-2022-39044](https://insights.sbomify.com/CVE-2022-39044/): Command injection in Buffalo network devices (medium 6.8)
- [CVE-2022-39043](https://insights.sbomify.com/CVE-2022-39043/): Juiker app - Information Leakage (low 2.4)
- [CVE-2022-39042](https://insights.sbomify.com/CVE-2022-39042/): aEnrich a+HRD - Improper Authentication (critical 9.8)
- [CVE-2022-39041](https://insights.sbomify.com/CVE-2022-39041/): aEnrich a+HRD - SQL Injection (critical 9.8)
- [CVE-2022-39040](https://insights.sbomify.com/CVE-2022-39040/): aEnrich a+HRD - Path Traversal (high 7.5)
- [CVE-2022-3904](https://insights.sbomify.com/CVE-2022-3904/): MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics (medium 6.1)
- [CVE-2022-39039](https://insights.sbomify.com/CVE-2022-39039/): aEnrich a+HRD - Server-Side Request Forgery (SSRF) (critical 9.8)
- [CVE-2022-39038](https://insights.sbomify.com/CVE-2022-39038/): FLOWRING Agentflow BPM - Broken Access Control (high 8.8)
- [CVE-2022-39037](https://insights.sbomify.com/CVE-2022-39037/): FLOWRING Agentflow BPM - Path Traversal (high 7.5)
- [CVE-2022-39036](https://insights.sbomify.com/CVE-2022-39036/): FLOWRING Agentflow BPM - Arbitrary File Upload (critical 9.8)
- [CVE-2022-39035](https://insights.sbomify.com/CVE-2022-39035/): Smart eVision - Stored XSS (medium 6.1)
- [CVE-2022-39034](https://insights.sbomify.com/CVE-2022-39034/): Smart eVision - Path Traversal -2 (medium 6.5)
- [CVE-2022-39033](https://insights.sbomify.com/CVE-2022-39033/): Smart eVision - Path Traversal -1 (critical 9.8)
- [CVE-2022-39032](https://insights.sbomify.com/CVE-2022-39032/): Smart eVision - Improper Privilege Management (high 8.8)
- [CVE-2022-39031](https://insights.sbomify.com/CVE-2022-39031/): Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -3 (medium 5.3)
- [CVE-2022-39030](https://insights.sbomify.com/CVE-2022-39030/): Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2 (high 7.5)
- [CVE-2022-3903](https://insights.sbomify.com/CVE-2022-3903/): Denial of service in Kernel (medium 4.6)
- [CVE-2022-39029](https://insights.sbomify.com/CVE-2022-39029/): Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1 (medium 6.5)
- [CVE-2022-39028](https://insights.sbomify.com/CVE-2022-39028/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2022-39027](https://insights.sbomify.com/CVE-2022-39027/): e-Excellence Inc. U-Office Force - Stored XSS (medium 5.4)
- [CVE-2022-39026](https://insights.sbomify.com/CVE-2022-39026/): e-Excellence Inc. U-Office Force - Stored XSS (medium 5.4)
- [CVE-2022-39025](https://insights.sbomify.com/CVE-2022-39025/): e-Excellence Inc. U-Office Force - Reflected XSS (medium 6.1)
- [CVE-2022-39024](https://insights.sbomify.com/CVE-2022-39024/): e-Excellence Inc. U-Office Force - Reflected XSS (medium 6.1)
- [CVE-2022-39023](https://insights.sbomify.com/CVE-2022-39023/): e-Excellence Inc. U-Office Force - Path Traversal (medium 6.5)
- [CVE-2022-39022](https://insights.sbomify.com/CVE-2022-39022/): e-Excellence Inc. U-Office Force - Path Traversal (medium 6.5)
- [CVE-2022-39021](https://insights.sbomify.com/CVE-2022-39021/): e-Excellence Inc. U-Office Force - Open Redirect (medium 6.1)
- [CVE-2022-39020](https://insights.sbomify.com/CVE-2022-39020/): Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd (high 7.6)
- [CVE-2022-3902](https://insights.sbomify.com/CVE-2022-3902/): Information disclosure in GitLab (medium 5.5)
- [CVE-2022-39019](https://insights.sbomify.com/CVE-2022-39019/): Broken access controls on PDFtron WebviewerUI in M-Files Hubshare (medium 6.3)
- [CVE-2022-39018](https://insights.sbomify.com/CVE-2022-39018/): Broken access controls on PDFtron data in M-Files Hubshare (high 8.2)
- [CVE-2022-39017](https://insights.sbomify.com/CVE-2022-39017/): XSS in all comments fields in M-Files Hubshare (high 8.2)
- [CVE-2022-39016](https://insights.sbomify.com/CVE-2022-39016/): Javascript injection in PDFtron in M-Files Hubshare (high 8.2)
- [CVE-2022-39015](https://insights.sbomify.com/CVE-2022-39015/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (AdminTools/Query Builder) (medium 6.5)
- [CVE-2022-39014](https://insights.sbomify.com/CVE-2022-39014/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (CMC) (medium 5.3)
- [CVE-2022-39013](https://insights.sbomify.com/CVE-2022-39013/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (Program Objects) (high 7.6)
- [CVE-2022-39012](https://insights.sbomify.com/CVE-2022-39012/): Other in Aslan-AL10 (high 7.5)
- [CVE-2022-39011](https://insights.sbomify.com/CVE-2022-39011/): Security feature bypass in EMUI (high 7.5)
- [CVE-2022-39010](https://insights.sbomify.com/CVE-2022-39010/): Missing authorization in EMUI (high 7.5)
- [CVE-2022-3901](https://insights.sbomify.com/CVE-2022-3901/): Visioweb.js - Prototype Pollution can results in XSS (high 7.2)
- [CVE-2022-39009](https://insights.sbomify.com/CVE-2022-39009/): Missing authorization in EMUI (critical 9.8)
- [CVE-2022-39008](https://insights.sbomify.com/CVE-2022-39008/): Deserialization in EMUI (critical 9.1)
- [CVE-2022-39007](https://insights.sbomify.com/CVE-2022-39007/): Privilege escalation in EMUI (critical 9.8)
- [CVE-2022-39006](https://insights.sbomify.com/CVE-2022-39006/): Race condition in EMUI (medium 5.9)
- [CVE-2022-39005](https://insights.sbomify.com/CVE-2022-39005/): Denial of service in EMUI (high 7.5)
- [CVE-2022-39004](https://insights.sbomify.com/CVE-2022-39004/): Denial of service in EMUI (high 7.5)
- [CVE-2022-39003](https://insights.sbomify.com/CVE-2022-39003/): Memory corruption in EMUI (critical 9.1)
- [CVE-2022-39002](https://insights.sbomify.com/CVE-2022-39002/): Memory corruption in HarmonyOS;EMUI;Magic UI (critical 9.8)
- [CVE-2022-39001](https://insights.sbomify.com/CVE-2022-39001/): Path traversal in EMUI (high 7.5)
- [CVE-2022-39000](https://insights.sbomify.com/CVE-2022-39000/): Other in EMUI (critical 9.8)
- [CVE-2022-3900](https://insights.sbomify.com/CVE-2022-3900/): Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2022-38999](https://insights.sbomify.com/CVE-2022-38999/): Other in EMUI (critical 9.8)
- [CVE-2022-38998](https://insights.sbomify.com/CVE-2022-38998/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-38997](https://insights.sbomify.com/CVE-2022-38997/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38996](https://insights.sbomify.com/CVE-2022-38996/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38995](https://insights.sbomify.com/CVE-2022-38995/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38994](https://insights.sbomify.com/CVE-2022-38994/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38993](https://insights.sbomify.com/CVE-2022-38993/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38992](https://insights.sbomify.com/CVE-2022-38992/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38991](https://insights.sbomify.com/CVE-2022-38991/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38990](https://insights.sbomify.com/CVE-2022-38990/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-3899](https://insights.sbomify.com/CVE-2022-3899/): 3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/259/