# Vulnerabilities published in 2022


- [CVE-2022-38533](https://insights.sbomify.com/CVE-2022-38533/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2022-38532](https://insights.sbomify.com/CVE-2022-38532/): Privilege escalation in msi:center (high 7.8)
- [CVE-2022-38531](https://insights.sbomify.com/CVE-2022-38531/): Command injection in fpt:g-97rg3 firmware (high 8.8)
- [CVE-2022-38530](https://insights.sbomify.com/CVE-2022-38530/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-3853](https://insights.sbomify.com/CVE-2022-3853/): Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via CSRF (medium 5.4)
- [CVE-2022-38529](https://insights.sbomify.com/CVE-2022-38529/): Memory corruption in tinyexr project:tinyexr (high 7.8)
- [CVE-2022-38528](https://insights.sbomify.com/CVE-2022-38528/): Memory corruption in assimp:assimp (medium 6.5)
- [CVE-2022-38527](https://insights.sbomify.com/CVE-2022-38527/): Cross-site scripting in ucms project:ucms (medium 6.1)
- [CVE-2022-3852](https://insights.sbomify.com/CVE-2022-3852/): VR Calendar <= 2.3.3 - Cross-Site Request Forgery (high 8.8)
- [CVE-2022-38512](https://insights.sbomify.com/CVE-2022-38512/): Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module (medium 6.5)
- [CVE-2022-38511](https://insights.sbomify.com/CVE-2022-38511/): Command injection in totolink:a810r firmware (high 7.8)
- [CVE-2022-38510](https://insights.sbomify.com/CVE-2022-38510/): Memory corruption in tenda:tx9 pro firmware (high 7.8)
- [CVE-2022-38509](https://insights.sbomify.com/CVE-2022-38509/): SQL injection in wedding planner project:wedding planner (critical 9.8)
- [CVE-2022-3850](https://insights.sbomify.com/CVE-2022-3850/): Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF (medium 4.3)
- [CVE-2022-38497](https://insights.sbomify.com/CVE-2022-38497/): LIEF contains a segmentation violation (medium 5.5)
- [CVE-2022-38496](https://insights.sbomify.com/CVE-2022-38496/): Denial of service in lief-project:lief (medium 5.5)
- [CVE-2022-38495](https://insights.sbomify.com/CVE-2022-38495/): LIEF vulnerable to heap based buffer overflow via print_binary function (high 7.8)
- [CVE-2022-38493](https://insights.sbomify.com/CVE-2022-38493/): Denial of service in rhonabwy project:rhonabwy (high 7.5)
- [CVE-2022-38492](https://insights.sbomify.com/CVE-2022-38492/): SQL injection in easyvista:service manager (high 7.7)
- [CVE-2022-38491](https://insights.sbomify.com/CVE-2022-38491/): Auth bypass in easyvista:service manager (high 8.2)
- [CVE-2022-38490](https://insights.sbomify.com/CVE-2022-38490/): SQL injection in easyvista:service manager (critical 9.6)
- [CVE-2022-3849](https://insights.sbomify.com/CVE-2022-3849/): WP User Merger < 1.5.3 - Admin+ SQLi via user_id (high 8.8)
- [CVE-2022-38489](https://insights.sbomify.com/CVE-2022-38489/): Cross-site scripting in easyvista:service manager (medium 4.8)
- [CVE-2022-38488](https://insights.sbomify.com/CVE-2022-38488/): SQL injection in logrocket-oauth2-example project:logrocket-oauth2-example (critical 9.8)
- [CVE-2022-38485](https://insights.sbomify.com/CVE-2022-38485/): Path traversal in agevolt:agevolt (medium 6.5)
- [CVE-2022-38484](https://insights.sbomify.com/CVE-2022-38484/): Path traversal in agevolt:agevolt (high 8.8)
- [CVE-2022-38482](https://insights.sbomify.com/CVE-2022-38482/): Other in mega:hopex (medium 4.3)
- [CVE-2022-38481](https://insights.sbomify.com/CVE-2022-38481/): Cross-site scripting in mega:hopex (medium 6.1)
- [CVE-2022-3848](https://insights.sbomify.com/CVE-2022-3848/): WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_id (high 8.8)
- [CVE-2022-38478](https://insights.sbomify.com/CVE-2022-38478/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-38477](https://insights.sbomify.com/CVE-2022-38477/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-38476](https://insights.sbomify.com/CVE-2022-38476/): Use after free in Firefox ESR (high 7.5)
- [CVE-2022-38475](https://insights.sbomify.com/CVE-2022-38475/): Memory corruption in Firefox (medium 6.5)
- [CVE-2022-38474](https://insights.sbomify.com/CVE-2022-38474/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2022-38473](https://insights.sbomify.com/CVE-2022-38473/): Security feature bypass in Firefox (high 8.8)
- [CVE-2022-38472](https://insights.sbomify.com/CVE-2022-38472/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-38470](https://insights.sbomify.com/CVE-2022-38470/): WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-3847](https://insights.sbomify.com/CVE-2022-3847/): Showing URL in QR Code <= 0.0.1 - Stored XSS via CSRF (medium 6.1)
- [CVE-2022-38469](https://insights.sbomify.com/CVE-2022-38469/): Weak cryptography in Proficy Historian (high 7.5)
- [CVE-2022-38468](https://insights.sbomify.com/CVE-2022-38468/): WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-38467](https://insights.sbomify.com/CVE-2022-38467/): WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2022-38466](https://insights.sbomify.com/CVE-2022-38466/): Misconfiguration in CoreShield One-Way Gateway (OWG) Software (high 7.8)
- [CVE-2022-38465](https://insights.sbomify.com/CVE-2022-38465/): Weak cryptography in SIMATIC Drive Controller family (critical 9.3)
- [CVE-2022-38463](https://insights.sbomify.com/CVE-2022-38463/): Cross-site scripting in servicenow:servicenow (medium 6.1)
- [CVE-2022-38462](https://insights.sbomify.com/CVE-2022-38462/): Reflected XSS in querystring parameters (medium 6.1)
- [CVE-2022-38461](https://insights.sbomify.com/CVE-2022-38461/): WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-38460](https://insights.sbomify.com/CVE-2022-38460/): WordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-3846](https://insights.sbomify.com/CVE-2022-3846/): Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR (high 7.5)
- [CVE-2022-38459](https://insights.sbomify.com/CVE-2022-38459/): Memory corruption in QUARTZ-GOLD (high 7.2)
- [CVE-2022-38458](https://insights.sbomify.com/CVE-2022-38458/): Information disclosure in Orbi Router RBR750 (medium 6.5)
- [CVE-2022-38457](https://insights.sbomify.com/CVE-2022-38457/): There is an UAF vulnerability in vmwgfx driver (medium 6.3)
- [CVE-2022-38456](https://insights.sbomify.com/CVE-2022-38456/): WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure (medium 4.3)
- [CVE-2022-38454](https://insights.sbomify.com/CVE-2022-38454/): WordPress Kraken.io Image Optimizer plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-38453](https://insights.sbomify.com/CVE-2022-38453/): Contec Health CMS8000 (low 3.0)
- [CVE-2022-38452](https://insights.sbomify.com/CVE-2022-38452/): Command injection in Orbi Router RBR750 (high 7.2)
- [CVE-2022-38451](https://insights.sbomify.com/CVE-2022-38451/): Path traversal in FreshTomato (medium 6.8)
- [CVE-2022-38450](https://insights.sbomify.com/CVE-2022-38450/): Adobe Acrobat Reader DC XFA Parsing Stack Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-3845](https://insights.sbomify.com/CVE-2022-3845/): phpipam Import Preview import-load-data.php cross site scripting (low 2.4)
- [CVE-2022-38449](https://insights.sbomify.com/CVE-2022-38449/): Adobe Acrobat Reader DC JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38448](https://insights.sbomify.com/CVE-2022-38448/): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38447](https://insights.sbomify.com/CVE-2022-38447/): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38446](https://insights.sbomify.com/CVE-2022-38446/): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38445](https://insights.sbomify.com/CVE-2022-38445/): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38444](https://insights.sbomify.com/CVE-2022-38444/): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38443](https://insights.sbomify.com/CVE-2022-38443/): Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38442](https://insights.sbomify.com/CVE-2022-38442/): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38441](https://insights.sbomify.com/CVE-2022-38441/): Adobe Dimension GLB File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38440](https://insights.sbomify.com/CVE-2022-38440/): Adobe Dimension SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-3844](https://insights.sbomify.com/CVE-2022-3844/): Webmin index.cgi cross site scripting (low 3.5)
- [CVE-2022-38439](https://insights.sbomify.com/CVE-2022-38439/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-38438](https://insights.sbomify.com/CVE-2022-38438/): AEM Reflected XSS Arbitrary code execution (medium 5.4)
- [CVE-2022-38437](https://insights.sbomify.com/CVE-2022-38437/): Adobe Acrobat Reader Use After Free Memory leak (medium 5.5)
- [CVE-2022-38436](https://insights.sbomify.com/CVE-2022-38436/): Adobe Illustrator CDR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38435](https://insights.sbomify.com/CVE-2022-38435/): Adobe Illustrator PCX File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38434](https://insights.sbomify.com/CVE-2022-38434/): Adobe Photoshop SVG File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38433](https://insights.sbomify.com/CVE-2022-38433/): Adobe Photoshop SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38432](https://insights.sbomify.com/CVE-2022-38432/): Adobe Photoshop SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38431](https://insights.sbomify.com/CVE-2022-38431/): Adobe Photoshop SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38430](https://insights.sbomify.com/CVE-2022-38430/): Adobe Photoshop MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-3843](https://insights.sbomify.com/CVE-2022-3843/): WAGO: Exposure of configuration interface in unmanaged switches (critical 9.1)
- [CVE-2022-38429](https://insights.sbomify.com/CVE-2022-38429/): Adobe Photoshop SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38428](https://insights.sbomify.com/CVE-2022-38428/): Adobe Photoshop DCM File Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38427](https://insights.sbomify.com/CVE-2022-38427/): Adobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38426](https://insights.sbomify.com/CVE-2022-38426/): Adobe Photoshop U3D File Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38425](https://insights.sbomify.com/CVE-2022-38425/): Adobe Bridge DCM File Parsing Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38424](https://insights.sbomify.com/CVE-2022-38424/): Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write (high 7.2)
- [CVE-2022-38423](https://insights.sbomify.com/CVE-2022-38423/): Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability (medium 4.9)
- [CVE-2022-38422](https://insights.sbomify.com/CVE-2022-38422/): Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability (high 7.5)
- [CVE-2022-38421](https://insights.sbomify.com/CVE-2022-38421/): Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2022-38420](https://insights.sbomify.com/CVE-2022-38420/): Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service (high 7.5)
- [CVE-2022-3842](https://insights.sbomify.com/CVE-2022-3842/): Use after free in Chrome (high 7.5)
- [CVE-2022-38419](https://insights.sbomify.com/CVE-2022-38419/): Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read (high 7.5)
- [CVE-2022-38418](https://insights.sbomify.com/CVE-2022-38418/): Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-38417](https://insights.sbomify.com/CVE-2022-38417/): Adobe InDesign SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38416](https://insights.sbomify.com/CVE-2022-38416/): Adobe InDesign SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38415](https://insights.sbomify.com/CVE-2022-38415/): Adobe InDesign PCX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38414](https://insights.sbomify.com/CVE-2022-38414/): Adobe InDesign SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38413](https://insights.sbomify.com/CVE-2022-38413/): Adobe InDesign SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38412](https://insights.sbomify.com/CVE-2022-38412/): Adobe Animate SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38411](https://insights.sbomify.com/CVE-2022-38411/): Adobe Animate SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/263/