# Vulnerabilities published in 2022 - [CVE-2022-38678](https://insights.sbomify.com/CVE-2022-38678/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38677](https://insights.sbomify.com/CVE-2022-38677/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38676](https://insights.sbomify.com/CVE-2022-38676/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38675](https://insights.sbomify.com/CVE-2022-38675/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38674](https://insights.sbomify.com/CVE-2022-38674/): Denial of service in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38673](https://insights.sbomify.com/CVE-2022-38673/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38672](https://insights.sbomify.com/CVE-2022-38672/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38671](https://insights.sbomify.com/CVE-2022-38671/): Memory corruption in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (medium 5.5) - [CVE-2022-38670](https://insights.sbomify.com/CVE-2022-38670/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8) - [CVE-2022-3867](https://insights.sbomify.com/CVE-2022-3867/): Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected (low 2.7) - [CVE-2022-38669](https://insights.sbomify.com/CVE-2022-38669/): Missing authorization in SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 (high 7.8) - [CVE-2022-38668](https://insights.sbomify.com/CVE-2022-38668/): Information disclosure in crowcpp:crow (high 7.5) - [CVE-2022-38667](https://insights.sbomify.com/CVE-2022-38667/): Use after free in crowcpp:crow (critical 9.8) - [CVE-2022-38666](https://insights.sbomify.com/CVE-2022-38666/): SSL/TLS certificate validation unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin (high 7.5) - [CVE-2022-38665](https://insights.sbomify.com/CVE-2022-38665/): RabbitMQ password stored in plain text by Jenkins CollabNet Plugins Plugin (medium 6.5) - [CVE-2022-38664](https://insights.sbomify.com/CVE-2022-38664/): Cross-site Scripting in Jenkins Job Configuration History Plugin (medium 5.4) - [CVE-2022-38663](https://insights.sbomify.com/CVE-2022-38663/): Improper masking of credentials Jenkins in Git Plugin (medium 6.5) - [CVE-2022-38662](https://insights.sbomify.com/CVE-2022-38662/): HCL Digital Experience is susceptible to open redirects (medium 6.1) - [CVE-2022-38661](https://insights.sbomify.com/CVE-2022-38661/): HCL Workload Automation is affected by a vulnerability in Jlog component of the Master Domain Manager (medium 6.2) - [CVE-2022-38660](https://insights.sbomify.com/CVE-2022-38660/): HCL XPages applications are susceptible to Cross Site Request Forgery (CSRF) vulnerability (high 8.3) - [CVE-2022-3866](https://insights.sbomify.com/CVE-2022-3866/): Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ (medium 5.0) - [CVE-2022-38659](https://insights.sbomify.com/CVE-2022-38659/): HCL BigFix Platform is affected by insecure credential storage (medium 6.0) - [CVE-2022-38658](https://insights.sbomify.com/CVE-2022-38658/): HCL BigFix Server Automation (SA) is affected by a security vulnerability around Notification Service (high 7.7) - [CVE-2022-38657](https://insights.sbomify.com/CVE-2022-38657/): An open redirect to malicious sites affects HCL Leap (high 8.2) - [CVE-2022-38656](https://insights.sbomify.com/CVE-2022-38656/): HCL Commerce, when using Elasticsearch, could be affected by a denial of service vulnerability (high 8.6) - [CVE-2022-38655](https://insights.sbomify.com/CVE-2022-38655/): HCL BigFix WebUI is affected by a missing-permission-check vulnerability (medium 6.4) - [CVE-2022-38654](https://insights.sbomify.com/CVE-2022-38654/): HCL Domino is susceptible to an information disclosure vulnerability (medium 5.5) - [CVE-2022-38653](https://insights.sbomify.com/CVE-2022-38653/): HCL Digital Experience is susceptible to cross-site scripting (XSS) (low 2.0) - [CVE-2022-38652](https://insights.sbomify.com/CVE-2022-38652/): Deserialization in vmware:hyperic agent (critical 9.9) - [CVE-2022-38651](https://insights.sbomify.com/CVE-2022-38651/): Auth bypass in vmware:hyperic server (critical 9.8) - [CVE-2022-38650](https://insights.sbomify.com/CVE-2022-38650/): Deserialization in vmware:hyperic server (critical 10.0) - [CVE-2022-3865](https://insights.sbomify.com/CVE-2022-3865/): WP User Merger < 1.5.3 - Admin+ SQLi via ID (high 8.8) - [CVE-2022-38649](https://insights.sbomify.com/CVE-2022-38649/): Apache Airflow Pinot provider allowed Command Injection (critical 9.8) - [CVE-2022-38648](https://insights.sbomify.com/CVE-2022-38648/): PDFTranscoder does not block external resources (medium 5.3) - [CVE-2022-3864](https://insights.sbomify.com/CVE-2022-3864/): Security feature bypass in Relion 670/650/SAM600-IO Series (medium 4.5) - [CVE-2022-38639](https://insights.sbomify.com/CVE-2022-38639/): Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting (medium 5.4) - [CVE-2022-38638](https://insights.sbomify.com/CVE-2022-38638/): Casdoor arbitrary file write vulnerability (critical 9.1) - [CVE-2022-38637](https://insights.sbomify.com/CVE-2022-38637/): SQL injection in hospital management system project:hospital management system (critical 9.8) - [CVE-2022-38633](https://insights.sbomify.com/CVE-2022-38633/): Privilege escalation in genymobile:genymotion desktop (high 7.8) - [CVE-2022-3863](https://insights.sbomify.com/CVE-2022-3863/): Use after free in Chrome (medium 6.5) - [CVE-2022-38628](https://insights.sbomify.com/CVE-2022-38628/): Cross-site scripting in niceforyou:linear emerge e3 access control firmware (medium 6.1) - [CVE-2022-38627](https://insights.sbomify.com/CVE-2022-38627/): SQL injection in niceforyou:linear emerge e3 access control firmware (critical 9.8) - [CVE-2022-38625](https://insights.sbomify.com/CVE-2022-38625/): Security feature bypass in patlite:nbm-d88n firmware (high 8.8) - [CVE-2022-38621](https://insights.sbomify.com/CVE-2022-38621/): Code injection in doufox:doufox (critical 9.8) - [CVE-2022-3862](https://insights.sbomify.com/CVE-2022-3862/): Livemesh Addons for Elementor < 7.2.4 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-38619](https://insights.sbomify.com/CVE-2022-38619/): SQL injection in bpcbt:smartvista front-end (critical 9.8) - [CVE-2022-38618](https://insights.sbomify.com/CVE-2022-38618/): SQL injection in bpcbt:smartvista (high 8.8) - [CVE-2022-38617](https://insights.sbomify.com/CVE-2022-38617/): SQL injection in bpcbt:smartvista (high 8.8) - [CVE-2022-38616](https://insights.sbomify.com/CVE-2022-38616/): SQL injection in bpcbt:smartvista front-end (high 8.8) - [CVE-2022-38615](https://insights.sbomify.com/CVE-2022-38615/): SQL injection in bpcbt:smartvista front-end (high 8.8) - [CVE-2022-38614](https://insights.sbomify.com/CVE-2022-38614/): Path traversal in bpcbt:smartvista cardgen (high 7.5) - [CVE-2022-38613](https://insights.sbomify.com/CVE-2022-38613/): Path traversal in bpcbt:smartvista cardgen (medium 6.5) - [CVE-2022-38611](https://insights.sbomify.com/CVE-2022-38611/): Other in watchdog:anti-virus (high 7.8) - [CVE-2022-38610](https://insights.sbomify.com/CVE-2022-38610/): SQL injection in garage management system project:garage management system (high 7.2) - [CVE-2022-3861](https://insights.sbomify.com/CVE-2022-3861/): Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection (high 8.8) - [CVE-2022-38606](https://insights.sbomify.com/CVE-2022-38606/): SQL injection in garage management system project:garage management system (high 7.2) - [CVE-2022-38605](https://insights.sbomify.com/CVE-2022-38605/): SQL injection in church management system project:church management system (high 7.2) - [CVE-2022-38604](https://insights.sbomify.com/CVE-2022-38604/): Path traversal in wacom:driver (high 7.3) - [CVE-2022-38600](https://insights.sbomify.com/CVE-2022-38600/): Denial of service in mplayerhq:mplayer (medium 5.5) - [CVE-2022-3860](https://insights.sbomify.com/CVE-2022-3860/): Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLi (high 8.8) - [CVE-2022-38599](https://insights.sbomify.com/CVE-2022-38599/): Information disclosure in goteleport:teleport (medium 6.5) - [CVE-2022-38595](https://insights.sbomify.com/CVE-2022-38595/): SQL injection in church management system project:church management system (high 7.2) - [CVE-2022-38594](https://insights.sbomify.com/CVE-2022-38594/): SQL injection in church management system project:church management system (high 7.2) - [CVE-2022-3859](https://insights.sbomify.com/CVE-2022-3859/): Privilege escalation in Trellix Agent (medium 6.7) - [CVE-2022-38583](https://insights.sbomify.com/CVE-2022-38583/): Misconfiguration in sage:sage 300 (high 7.8) - [CVE-2022-38582](https://insights.sbomify.com/CVE-2022-38582/): Missing authorization in watchdog:anti-virus (medium 6.5) - [CVE-2022-38580](https://insights.sbomify.com/CVE-2022-38580/): Skipper vulnerable to SSRF via X-Skipper-Proxy (critical 9.8) - [CVE-2022-3858](https://insights.sbomify.com/CVE-2022-3858/): Chaty < 3.0.3 - Admin+ SQLi (high 7.2) - [CVE-2022-38577](https://insights.sbomify.com/CVE-2022-38577/): Privilege escalation in processmaker:processmaker (high 8.8) - [CVE-2022-38576](https://insights.sbomify.com/CVE-2022-38576/): SQL injection in janobe:interview management system (high 7.2) - [CVE-2022-38573](https://insights.sbomify.com/CVE-2022-38573/): Memory corruption in 10-strike:network inventory explorer (critical 9.8) - [CVE-2022-38571](https://insights.sbomify.com/CVE-2022-38571/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38570](https://insights.sbomify.com/CVE-2022-38570/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38569](https://insights.sbomify.com/CVE-2022-38569/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38568](https://insights.sbomify.com/CVE-2022-38568/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38567](https://insights.sbomify.com/CVE-2022-38567/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38566](https://insights.sbomify.com/CVE-2022-38566/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38565](https://insights.sbomify.com/CVE-2022-38565/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38564](https://insights.sbomify.com/CVE-2022-38564/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38563](https://insights.sbomify.com/CVE-2022-38563/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-38562](https://insights.sbomify.com/CVE-2022-38562/): Memory corruption in tenda:m3 firmware (high 7.5) - [CVE-2022-3856](https://insights.sbomify.com/CVE-2022-3856/): Comic Book Management System < 2.2.0 - Admin+ SQLi (high 7.2) - [CVE-2022-38557](https://insights.sbomify.com/CVE-2022-38557/): Hardcoded credentials in dlink:dir-845l firmware (critical 9.8) - [CVE-2022-38556](https://insights.sbomify.com/CVE-2022-38556/): Hardcoded credentials in trendnet:tew733gr firmware (critical 9.8) - [CVE-2022-38555](https://insights.sbomify.com/CVE-2022-38555/): Memory corruption in linksys:e1200 firmware (critical 9.8) - [CVE-2022-38553](https://insights.sbomify.com/CVE-2022-38553/): Cross-site scripting in creativeitem:academy learning management system (medium 6.1) - [CVE-2022-38550](https://insights.sbomify.com/CVE-2022-38550/): Cross-site scripting in jeesns:jeesns (medium 5.4) - [CVE-2022-3855](https://insights.sbomify.com/CVE-2022-3855/): 404 to Start <= 1.6.1 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-38547](https://insights.sbomify.com/CVE-2022-38547/): Command injection in ATP series firmware (high 7.2) - [CVE-2022-38546](https://insights.sbomify.com/CVE-2022-38546/): Misconfiguration in NBG7510 firmware (medium 5.3) - [CVE-2022-38545](https://insights.sbomify.com/CVE-2022-38545/): Valine code injection vulnerability (critical 9.6) - [CVE-2022-38542](https://insights.sbomify.com/CVE-2022-38542/): SQL injection in archerydms:archery (critical 9.8) - [CVE-2022-38541](https://insights.sbomify.com/CVE-2022-38541/): SQL injection in archerydms:archery (critical 9.8) - [CVE-2022-38540](https://insights.sbomify.com/CVE-2022-38540/): SQL injection in archerydms:archery (critical 9.8) - [CVE-2022-3854](https://insights.sbomify.com/CVE-2022-3854/): Null dereference in ceph (medium 6.5) - [CVE-2022-38539](https://insights.sbomify.com/CVE-2022-38539/): SQL injection in archerydms:archery (critical 9.8) - [CVE-2022-38538](https://insights.sbomify.com/CVE-2022-38538/): SQL injection in archerydms:archery (critical 9.8) - [CVE-2022-38537](https://insights.sbomify.com/CVE-2022-38537/): SQL injection in archerydms:archery (critical 9.8) - [CVE-2022-38535](https://insights.sbomify.com/CVE-2022-38535/): Command injection in totolink:a720r firmware (high 7.2) - [CVE-2022-38534](https://insights.sbomify.com/CVE-2022-38534/): Command injection in totolink:a720r firmware (high 7.2) --- From sbomify Insights: https://insights.sbomify.com/years/2022/page/262/