# Vulnerabilities published in 2022


- [CVE-2022-38989](https://insights.sbomify.com/CVE-2022-38989/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38988](https://insights.sbomify.com/CVE-2022-38988/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38987](https://insights.sbomify.com/CVE-2022-38987/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38986](https://insights.sbomify.com/CVE-2022-38986/): Memory corruption in EMUI (critical 9.1)
- [CVE-2022-38985](https://insights.sbomify.com/CVE-2022-38985/): Other in EMUI (high 7.5)
- [CVE-2022-38984](https://insights.sbomify.com/CVE-2022-38984/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-38983](https://insights.sbomify.com/CVE-2022-38983/): Use after free in EMUI (critical 9.8)
- [CVE-2022-38982](https://insights.sbomify.com/CVE-2022-38982/): Auth bypass in HarmonyOS (critical 9.8)
- [CVE-2022-38981](https://insights.sbomify.com/CVE-2022-38981/): Memory corruption in HarmonyOS (high 7.5)
- [CVE-2022-38980](https://insights.sbomify.com/CVE-2022-38980/): Memory corruption in HarmonyOS (critical 9.8)
- [CVE-2022-3898](https://insights.sbomify.com/CVE-2022-3898/): WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery (high 8.8)
- [CVE-2022-38979](https://insights.sbomify.com/CVE-2022-38979/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38978](https://insights.sbomify.com/CVE-2022-38978/): Misconfiguration in EMUI (high 7.5)
- [CVE-2022-38977](https://insights.sbomify.com/CVE-2022-38977/): Memory corruption in HarmonyOS (high 7.5)
- [CVE-2022-38975](https://insights.sbomify.com/CVE-2022-38975/): EC-CUBE DOM-based cross-site scripting vulnerability (medium 5.4)
- [CVE-2022-38974](https://insights.sbomify.com/CVE-2022-38974/): WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-38973](https://insights.sbomify.com/CVE-2022-38973/): Missing authorization in Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition (low 3.3)
- [CVE-2022-38972](https://insights.sbomify.com/CVE-2022-38972/): Cross-site scripting in A-Form (medium 6.1)
- [CVE-2022-38971](https://insights.sbomify.com/CVE-2022-38971/): WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS) (medium 4.7)
- [CVE-2022-38970](https://insights.sbomify.com/CVE-2022-38970/): Weak cryptography in hipcam:realserver (medium 6.5)
- [CVE-2022-3897](https://insights.sbomify.com/CVE-2022-3897/): WP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-3896](https://insights.sbomify.com/CVE-2022-3896/): WP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-38956](https://insights.sbomify.com/CVE-2022-38956/): Security feature bypass in netgear:wpn824ext firmware (medium 5.3)
- [CVE-2022-38955](https://insights.sbomify.com/CVE-2022-38955/): Security feature bypass in netgear:wpn824ext firmware (high 7.5)
- [CVE-2022-3895](https://insights.sbomify.com/CVE-2022-3895/): Potential XSS in common user interface component library (medium 4.0)
- [CVE-2022-38947](https://insights.sbomify.com/CVE-2022-38947/): SQL injection in jigar-sable:flipkart-clone-php (critical 9.8)
- [CVE-2022-38946](https://insights.sbomify.com/CVE-2022-38946/): File upload in divscorp:doctor-appointment (critical 9.8)
- [CVE-2022-3894](https://insights.sbomify.com/CVE-2022-3894/): WP OAuth Server < 4.2.5 - Arbitrary Post Deletion via CSRF (medium 4.3)
- [CVE-2022-38936](https://insights.sbomify.com/CVE-2022-38936/): Memory corruption in pbc project:pbc (high 7.5)
- [CVE-2022-38935](https://insights.sbomify.com/CVE-2022-38935/): Privilege escalation in niter:niterforum (high 8.8)
- [CVE-2022-38934](https://insights.sbomify.com/CVE-2022-38934/): Memory corruption in toaruos:toaruos (low 3.3)
- [CVE-2022-38932](https://insights.sbomify.com/CVE-2022-38932/): Memory corruption in toaruos:toaruos (high 8.4)
- [CVE-2022-38931](https://insights.sbomify.com/CVE-2022-38931/): Server-side request forgery in baijiacms project:baijiacms (high 8.8)
- [CVE-2022-3893](https://insights.sbomify.com/CVE-2022-3893/): Potential XSS on custom menu navigation (low 2.3)
- [CVE-2022-38928](https://insights.sbomify.com/CVE-2022-38928/): Null dereference in xpdfreader:xpdf (high 7.8)
- [CVE-2022-38923](https://insights.sbomify.com/CVE-2022-38923/): SQL injection in iss-oberlausitz:bluepage cms (critical 9.8)
- [CVE-2022-38922](https://insights.sbomify.com/CVE-2022-38922/): SQL injection in iss-oberlausitz:bluepage cms (critical 9.8)
- [CVE-2022-3892](https://insights.sbomify.com/CVE-2022-3892/): WP OAuth Server < 4.2.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38916](https://insights.sbomify.com/CVE-2022-38916/): Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type (critical 9.8)
- [CVE-2022-3891](https://insights.sbomify.com/CVE-2022-3891/): WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access (medium 5.3)
- [CVE-2022-38902](https://insights.sbomify.com/CVE-2022-38902/): Cross-site scripting in liferay:dxp (medium 5.4)
- [CVE-2022-38901](https://insights.sbomify.com/CVE-2022-38901/): Cross-site scripting in liferay:dxp (medium 5.4)
- [CVE-2022-38900](https://insights.sbomify.com/CVE-2022-38900/): decode-uri-component vulnerable to Denial of Service (DoS) (high 7.5)
- [CVE-2022-3890](https://insights.sbomify.com/CVE-2022-3890/): Memory corruption in Chrome (critical 9.6)
- [CVE-2022-38890](https://insights.sbomify.com/CVE-2022-38890/): Memory corruption in f5:njs (medium 5.5)
- [CVE-2022-3889](https://insights.sbomify.com/CVE-2022-3889/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-38887](https://insights.sbomify.com/CVE-2022-38887/): Supply chain in d8s-python project:d8s-python (critical 9.8)
- [CVE-2022-38886](https://insights.sbomify.com/CVE-2022-38886/): Supply chain in d8s-xml project:d8s-xml (critical 9.8)
- [CVE-2022-38885](https://insights.sbomify.com/CVE-2022-38885/): Supply chain in d8s-netstrings project:d8s-netstrings (critical 9.8)
- [CVE-2022-38884](https://insights.sbomify.com/CVE-2022-38884/): Supply chain in d8s-grammars project:d8s-grammars (critical 9.8)
- [CVE-2022-38883](https://insights.sbomify.com/CVE-2022-38883/): Supply chain in d8s-math project:d8s-math (critical 9.8)
- [CVE-2022-38882](https://insights.sbomify.com/CVE-2022-38882/): Supply chain in d8s-json project:d8s-json (critical 9.8)
- [CVE-2022-38881](https://insights.sbomify.com/CVE-2022-38881/): Supply chain in d8s-archives project:d8s-archives (critical 9.8)
- [CVE-2022-38880](https://insights.sbomify.com/CVE-2022-38880/): Supply chain in democritus urls project:democritus urls (critical 9.8)
- [CVE-2022-3888](https://insights.sbomify.com/CVE-2022-3888/): Use after free in Chrome (high 8.8)
- [CVE-2022-38878](https://insights.sbomify.com/CVE-2022-38878/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (high 7.2)
- [CVE-2022-38877](https://insights.sbomify.com/CVE-2022-38877/): File upload in garage management system project:garage management system (high 7.2)
- [CVE-2022-38873](https://insights.sbomify.com/CVE-2022-38873/): Security feature bypass in dlink:dap-2310 firmware (high 7.5)
- [CVE-2022-38871](https://insights.sbomify.com/CVE-2022-38871/): Free5gc vulnerable to uncontrolled resource consumption (high 7.5)
- [CVE-2022-38870](https://insights.sbomify.com/CVE-2022-38870/): Information disclosure in free5gc:free5gc (high 7.5)
- [CVE-2022-3887](https://insights.sbomify.com/CVE-2022-3887/): Use after free in Chrome (high 8.8)
- [CVE-2022-38868](https://insights.sbomify.com/CVE-2022-38868/): SQL injection in ehoney project:ehoney (high 7.2)
- [CVE-2022-38867](https://insights.sbomify.com/CVE-2022-38867/): rttys SQL Injection vulnerability (high 8.8)
- [CVE-2022-38866](https://insights.sbomify.com/CVE-2022-38866/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38865](https://insights.sbomify.com/CVE-2022-38865/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2022-38864](https://insights.sbomify.com/CVE-2022-38864/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38863](https://insights.sbomify.com/CVE-2022-38863/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38862](https://insights.sbomify.com/CVE-2022-38862/): Memory corruption in mplayerhq:mencoder (high 7.8)
- [CVE-2022-38861](https://insights.sbomify.com/CVE-2022-38861/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38860](https://insights.sbomify.com/CVE-2022-38860/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2022-3886](https://insights.sbomify.com/CVE-2022-3886/): Use after free in Chrome (high 8.8)
- [CVE-2022-38858](https://insights.sbomify.com/CVE-2022-38858/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38856](https://insights.sbomify.com/CVE-2022-38856/): Memory corruption in mplayerhq:mencoder (medium 5.5)
- [CVE-2022-38855](https://insights.sbomify.com/CVE-2022-38855/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38853](https://insights.sbomify.com/CVE-2022-38853/): Memory corruption in mplayerhq:mencoder (medium 5.5)
- [CVE-2022-38851](https://insights.sbomify.com/CVE-2022-38851/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-38850](https://insights.sbomify.com/CVE-2022-38850/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2022-3885](https://insights.sbomify.com/CVE-2022-3885/): Use after free in Chrome (high 8.8)
- [CVE-2022-38846](https://insights.sbomify.com/CVE-2022-38846/): Information disclosure in espocrm:espocrm (medium 5.9)
- [CVE-2022-38845](https://insights.sbomify.com/CVE-2022-38845/): Cross-site scripting in espocrm:espocrm (medium 6.1)
- [CVE-2022-38844](https://insights.sbomify.com/CVE-2022-38844/): Code injection in espocrm:espocrm (high 8.0)
- [CVE-2022-38843](https://insights.sbomify.com/CVE-2022-38843/): File upload in espocrm:espocrm (high 8.8)
- [CVE-2022-38841](https://insights.sbomify.com/CVE-2022-38841/): Command injection in linksys:e8450 firmware (high 8.8)
- [CVE-2022-38840](https://insights.sbomify.com/CVE-2022-38840/): XML external entity in guralp:man-eam-0003 (high 7.5)
- [CVE-2022-3884](https://insights.sbomify.com/CVE-2022-3884/): Directory Permission Vulnerability in Hitachi Ops Center Analyzer (high 7.3)
- [CVE-2022-38833](https://insights.sbomify.com/CVE-2022-38833/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (high 7.2)
- [CVE-2022-38832](https://insights.sbomify.com/CVE-2022-38832/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (high 7.2)
- [CVE-2022-38831](https://insights.sbomify.com/CVE-2022-38831/): Memory corruption in tenda:rx9 pro firmware (critical 9.8)
- [CVE-2022-38830](https://insights.sbomify.com/CVE-2022-38830/): Memory corruption in tenda:rx9 pro firmware (critical 9.8)
- [CVE-2022-3883](https://insights.sbomify.com/CVE-2022-3883/): StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation (medium 6.5)
- [CVE-2022-38829](https://insights.sbomify.com/CVE-2022-38829/): Memory corruption in tenda:rx9 pro firmware (critical 9.8)
- [CVE-2022-38828](https://insights.sbomify.com/CVE-2022-38828/): Command injection in totolink:t6 firmware (critical 9.8)
- [CVE-2022-38827](https://insights.sbomify.com/CVE-2022-38827/): Memory corruption in totolink:t6 firmware (critical 9.8)
- [CVE-2022-38826](https://insights.sbomify.com/CVE-2022-38826/): Command injection in totolink:t6 firmware (critical 9.8)
- [CVE-2022-38823](https://insights.sbomify.com/CVE-2022-38823/): Hardcoded credentials in totolink:t6 firmware (critical 9.8)
- [CVE-2022-3882](https://insights.sbomify.com/CVE-2022-3882/): WP Memory < 2.46 - Subscriber+ Arbitrary Plugin Installation (medium 6.5)
- [CVE-2022-38817](https://insights.sbomify.com/CVE-2022-38817/): Dapr Dashboard vulnerable to Incorrect Access Control (high 7.5)
- [CVE-2022-38814](https://insights.sbomify.com/CVE-2022-38814/): Cross-site scripting in fiberhome:an5506-02-b firmware (medium 5.4)
- [CVE-2022-38813](https://insights.sbomify.com/CVE-2022-38813/): Missing authorization in phpgurukul blood donor management system project:phpgurukul blood donor management system (high 8.1)
- [CVE-2022-38812](https://insights.sbomify.com/CVE-2022-38812/): SQL injection in aerocms project:aerocms (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/260/