# Vulnerabilities published in 2022


- [CVE-2022-3881](https://insights.sbomify.com/CVE-2022-3881/): WPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation (medium 5.7)
- [CVE-2022-38808](https://insights.sbomify.com/CVE-2022-38808/): SQL injection in yimihome:ywoa (high 8.8)
- [CVE-2022-38803](https://insights.sbomify.com/CVE-2022-38803/): Cross-site scripting in zkteco:biotime (medium 6.8)
- [CVE-2022-38802](https://insights.sbomify.com/CVE-2022-38802/): Cross-site scripting in zkteco:biotime (medium 6.2)
- [CVE-2022-38801](https://insights.sbomify.com/CVE-2022-38801/): Cross-site scripting in zkteco:biotime (medium 5.4)
- [CVE-2022-3880](https://insights.sbomify.com/CVE-2022-3880/): AntiHacker < 4.20 - Subscriber+ Arbitrary Plugin Installation (medium 6.5)
- [CVE-2022-38796](https://insights.sbomify.com/CVE-2022-38796/): Feehi CMS host header injection vulnerability (medium 6.1)
- [CVE-2022-38795](https://insights.sbomify.com/CVE-2022-38795/): Gitea erroneous repo clones (medium 6.5)
- [CVE-2022-38794](https://insights.sbomify.com/CVE-2022-38794/): Path traversal in zaver project:zaver (high 7.5)
- [CVE-2022-38792](https://insights.sbomify.com/CVE-2022-38792/): exotel-py includes code execution backdoor inserted by a third party (critical 9.8)
- [CVE-2022-38791](https://insights.sbomify.com/CVE-2022-38791/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2022-38790](https://insights.sbomify.com/CVE-2022-38790/): Cross-site scripting in weave.works:gitops (medium 5.4)
- [CVE-2022-3879](https://insights.sbomify.com/CVE-2022-3879/): Car Dealer < 3.05 - Subscriber+ Arbitrary Plugin Installation (medium 6.5)
- [CVE-2022-38789](https://insights.sbomify.com/CVE-2022-38789/): Missing authorization in airties:air 4920 firmware (critical 9.1)
- [CVE-2022-38788](https://insights.sbomify.com/CVE-2022-38788/): Weak cryptography in nokia:fastmile 5g receiver firmware (medium 4.3)
- [CVE-2022-38787](https://insights.sbomify.com/CVE-2022-38787/): Privilege escalation in Intel(R) FPGA products (medium 5.7)
- [CVE-2022-38786](https://insights.sbomify.com/CVE-2022-38786/): Privilege escalation in Intel Battery Life Diagnostic Tool software (medium 6.7)
- [CVE-2022-38784](https://insights.sbomify.com/CVE-2022-38784/): Integer overflow in debian:debian linux (high 7.8)
- [CVE-2022-3878](https://insights.sbomify.com/CVE-2022-3878/): Maxon ERP browse_data sql injection (high 7.3)
- [CVE-2022-38779](https://insights.sbomify.com/CVE-2022-38779/): Open redirect in kibana (medium 6.1)
- [CVE-2022-38778](https://insights.sbomify.com/CVE-2022-38778/): Denial of service in kibana (medium 6.5)
- [CVE-2022-38777](https://insights.sbomify.com/CVE-2022-38777/): Privilege escalation in Elastic Endpoint Security (high 7.8)
- [CVE-2022-38775](https://insights.sbomify.com/CVE-2022-38775/): Privilege escalation in Elastic Endpoint Security (high 7.8)
- [CVE-2022-38774](https://insights.sbomify.com/CVE-2022-38774/): Privilege escalation in Elastic Endpoint Security and Elastic Endgame Security (high 7.8)
- [CVE-2022-38773](https://insights.sbomify.com/CVE-2022-38773/): Security feature bypass in SIMATIC Drive Controller CPU 1504D TF (medium 4.6)
- [CVE-2022-38772](https://insights.sbomify.com/CVE-2022-38772/): Code injection in zohocorp:manageengine netflow analyzer (high 8.8)
- [CVE-2022-38771](https://insights.sbomify.com/CVE-2022-38771/): Cross-site scripting in transtek:mojodat fixed asset management (critical 9.8)
- [CVE-2022-38770](https://insights.sbomify.com/CVE-2022-38770/): Missing authorization in transtek:mojodat fixed asset management (medium 5.3)
- [CVE-2022-3877](https://insights.sbomify.com/CVE-2022-3877/): Click Studios Passwordstate URL Field cross site scripting (low 3.5)
- [CVE-2022-38769](https://insights.sbomify.com/CVE-2022-38769/): Information disclosure in transtek:mojodat fixed asset management (high 7.5)
- [CVE-2022-38768](https://insights.sbomify.com/CVE-2022-38768/): Auth bypass in transtek:mojodat fixed asset management (critical 9.8)
- [CVE-2022-38767](https://insights.sbomify.com/CVE-2022-38767/): Denial of service in windriver:vxworks (high 7.5)
- [CVE-2022-38766](https://insights.sbomify.com/CVE-2022-38766/): Auth bypass in renault:zoe e-tech firmware (high 8.1)
- [CVE-2022-38765](https://insights.sbomify.com/CVE-2022-38765/): Missing authorization in canon:vitrea view (medium 6.5)
- [CVE-2022-38764](https://insights.sbomify.com/CVE-2022-38764/): Misconfiguration in Trend Micro HouseCall (Consumer) (high 7.8)
- [CVE-2022-3876](https://insights.sbomify.com/CVE-2022-3876/): Click Studios Passwordstate API authorization (medium 4.3)
- [CVE-2022-38758](https://insights.sbomify.com/CVE-2022-38758/): XSS vulnerabilities in iManager (high 7.2)
- [CVE-2022-38757](https://insights.sbomify.com/CVE-2022-38757/): CVE-2022-38757 ZENworks (high 7.2)
- [CVE-2022-38756](https://insights.sbomify.com/CVE-2022-38756/): CVE-2022-38756 vulnerability in GW Web prior to 18.4.2 (medium 4.3)
- [CVE-2022-38755](https://insights.sbomify.com/CVE-2022-38755/): Filr Remote unauthenticated user enumeration for versions prior to 4.3.1.1 (medium 5.3)
- [CVE-2022-38754](https://insights.sbomify.com/CVE-2022-38754/): CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS) (high 8.0)
- [CVE-2022-38753](https://insights.sbomify.com/CVE-2022-38753/): Auth bypass in NetIQ Advanced Authentication (medium 6.3)
- [CVE-2022-38752](https://insights.sbomify.com/CVE-2022-38752/): DoS in SnakeYAML (medium 6.5)
- [CVE-2022-38751](https://insights.sbomify.com/CVE-2022-38751/): DoS in SnakeYAML (medium 6.5)
- [CVE-2022-38750](https://insights.sbomify.com/CVE-2022-38750/): DoS in SnakeYAML (medium 6.5)
- [CVE-2022-3875](https://insights.sbomify.com/CVE-2022-3875/): Click Studios Passwordstate API authentication bypass by assumed-immutable data (high 7.3)
- [CVE-2022-38749](https://insights.sbomify.com/CVE-2022-38749/): DoS in SnakeYAML (medium 6.5)
- [CVE-2022-38745](https://insights.sbomify.com/CVE-2022-38745/): Apache OpenOffice: Empty entry in Java class path (high 7.8)
- [CVE-2022-38744](https://insights.sbomify.com/CVE-2022-38744/): FactoryTalk Alarm and Events Server Vulnerable to Denial-Of-Service Attack (high 7.5)
- [CVE-2022-38743](https://insights.sbomify.com/CVE-2022-38743/): Missing authorization in FactoryTalk VantagePoint (high 8.8)
- [CVE-2022-38742](https://insights.sbomify.com/CVE-2022-38742/): Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack (high 8.1)
- [CVE-2022-3874](https://insights.sbomify.com/CVE-2022-3874/): Os command injection via ct_command and fcct_command (high 8.0)
- [CVE-2022-38734](https://insights.sbomify.com/CVE-2022-38734/): Denial of service in Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (high 7.5)
- [CVE-2022-38733](https://insights.sbomify.com/CVE-2022-38733/): Auth bypass in OnCommand Insight (high 8.6)
- [CVE-2022-38732](https://insights.sbomify.com/CVE-2022-38732/): Misconfiguration in SnapCenter (high 7.5)
- [CVE-2022-38731](https://insights.sbomify.com/CVE-2022-38731/): Path traversal in qaelum:dose (medium 4.3)
- [CVE-2022-38730](https://insights.sbomify.com/CVE-2022-38730/): Race condition in docker:desktop (medium 6.3)
- [CVE-2022-3873](https://insights.sbomify.com/CVE-2022-3873/): Cross-site Scripting (XSS) - DOM in jgraph/drawio (medium 6.5)
- [CVE-2022-38725](https://insights.sbomify.com/CVE-2022-38725/): Integer overflow in oneidentity:syslog-ng (high 7.5)
- [CVE-2022-38724](https://insights.sbomify.com/CVE-2022-38724/): Silverstripe XSS in shortcodes (medium 5.4)
- [CVE-2022-38723](https://insights.sbomify.com/CVE-2022-38723/): Gravitee API Management contains Path Traversal (high 8.6)
- [CVE-2022-3872](https://insights.sbomify.com/CVE-2022-3872/): Memory corruption in QEMU (high 8.6)
- [CVE-2022-38716](https://insights.sbomify.com/CVE-2022-38716/): WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-38715](https://insights.sbomify.com/CVE-2022-38715/): Code injection in QUARTZ-GOLD (high 7.2)
- [CVE-2022-38714](https://insights.sbomify.com/CVE-2022-38714/): IBM DataStage on Cloud Pak for Data information disclosure (medium 4.9)
- [CVE-2022-38712](https://insights.sbomify.com/CVE-2022-38712/): Auth bypass in IBM WebSphere Application Server (medium 5.9)
- [CVE-2022-38710](https://insights.sbomify.com/CVE-2022-38710/): IBM Robotic Process Automation information disclosure (medium 5.3)
- [CVE-2022-38709](https://insights.sbomify.com/CVE-2022-38709/): Cross-site scripting in Robotic Process Automation (medium 6.1)
- [CVE-2022-38708](https://insights.sbomify.com/CVE-2022-38708/): IBM Cognos Analytics server-side request forgery (medium 6.5)
- [CVE-2022-38707](https://insights.sbomify.com/CVE-2022-38707/): IBM Cognos Command Center information disclosure (medium 4.0)
- [CVE-2022-38705](https://insights.sbomify.com/CVE-2022-38705/): IBM CICS TX phishing (medium 5.3)
- [CVE-2022-38704](https://insights.sbomify.com/CVE-2022-38704/): WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-38703](https://insights.sbomify.com/CVE-2022-38703/): WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2022-38702](https://insights.sbomify.com/CVE-2022-38702/): WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection (medium 5.8)
- [CVE-2022-38701](https://insights.sbomify.com/CVE-2022-38701/): Memory corruption in OpenHarmony (medium 6.2)
- [CVE-2022-38700](https://insights.sbomify.com/CVE-2022-38700/): Auth bypass in OpenHarmony (high 8.8)
- [CVE-2022-3870](https://insights.sbomify.com/CVE-2022-3870/): Information disclosure in GitLab (medium 5.3)
- [CVE-2022-38699](https://insights.sbomify.com/CVE-2022-38699/): ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw (medium 5.9)
- [CVE-2022-38698](https://insights.sbomify.com/CVE-2022-38698/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8)
- [CVE-2022-38697](https://insights.sbomify.com/CVE-2022-38697/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38696](https://insights.sbomify.com/CVE-2022-38696/): Memory corruption in SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765 (critical 9.8)
- [CVE-2022-38695](https://insights.sbomify.com/CVE-2022-38695/): Privilege escalation in SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/ (high 7.8)
- [CVE-2022-38694](https://insights.sbomify.com/CVE-2022-38694/): Memory corruption in SC9863A//T310/T610/T618/ (high 7.8)
- [CVE-2022-38693](https://insights.sbomify.com/CVE-2022-38693/): Memory corruption in SC9863A//T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765 (critical 9.8)
- [CVE-2022-38692](https://insights.sbomify.com/CVE-2022-38692/): Memory corruption in SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/ (critical 9.8)
- [CVE-2022-38691](https://insights.sbomify.com/CVE-2022-38691/): Security feature bypass in SC9863A//T310/T610/T618/ (high 7.8)
- [CVE-2022-38690](https://insights.sbomify.com/CVE-2022-38690/): Race condition in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-3869](https://insights.sbomify.com/CVE-2022-3869/): Code Injection in froxlor/froxlor (medium 6.5)
- [CVE-2022-38689](https://insights.sbomify.com/CVE-2022-38689/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38688](https://insights.sbomify.com/CVE-2022-38688/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38687](https://insights.sbomify.com/CVE-2022-38687/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38686](https://insights.sbomify.com/CVE-2022-38686/): Denial of service in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 6.4)
- [CVE-2022-38685](https://insights.sbomify.com/CVE-2022-38685/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38684](https://insights.sbomify.com/CVE-2022-38684/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38683](https://insights.sbomify.com/CVE-2022-38683/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38682](https://insights.sbomify.com/CVE-2022-38682/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38681](https://insights.sbomify.com/CVE-2022-38681/): Integer overflow in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-38680](https://insights.sbomify.com/CVE-2022-38680/): Integer overflow in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)
- [CVE-2022-3868](https://insights.sbomify.com/CVE-2022-3868/): SourceCodester Sanitization Management System sql injection (medium 4.7)
- [CVE-2022-38679](https://insights.sbomify.com/CVE-2022-38679/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/261/