# Vulnerabilities published in 2022


- [CVE-2022-38410](https://insights.sbomify.com/CVE-2022-38410/): Adobe Illustrator EPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-3841](https://insights.sbomify.com/CVE-2022-3841/): Server-side request forgery in RHACM (high 7.8)
- [CVE-2022-38409](https://insights.sbomify.com/CVE-2022-38409/): Adobe Illustrator EPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38408](https://insights.sbomify.com/CVE-2022-38408/): Adobe Illustrator Improper Input Validation Arbitrary code execution (high 7.8)
- [CVE-2022-38407](https://insights.sbomify.com/CVE-2022-38407/): Adobe InCopy EPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38406](https://insights.sbomify.com/CVE-2022-38406/): Adobe InCopy EPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-38405](https://insights.sbomify.com/CVE-2022-38405/): Adobe InCopy SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38404](https://insights.sbomify.com/CVE-2022-38404/): Adobe InCopy SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38403](https://insights.sbomify.com/CVE-2022-38403/): Adobe InCopy SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38402](https://insights.sbomify.com/CVE-2022-38402/): Adobe InCopy SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38401](https://insights.sbomify.com/CVE-2022-38401/): Adobe InCopy PCX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-38400](https://insights.sbomify.com/CVE-2022-38400/): Information disclosure in Mailform Pro CGI (medium 5.9)
- [CVE-2022-3840](https://insights.sbomify.com/CVE-2022-3840/): Google Apps Login < 3.4.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38399](https://insights.sbomify.com/CVE-2022-38399/): Auth bypass in SmaCam CS-QR10 and SmaCam Night Vision CS-QR20 (medium 6.8)
- [CVE-2022-38398](https://insights.sbomify.com/CVE-2022-38398/): Server-Side Request Forgery Information Disclosure Vulnerability (medium 5.3)
- [CVE-2022-38396](https://insights.sbomify.com/CVE-2022-38396/): Privilege escalation in HP Factory Preinstalled Windows 10 20H2 Images (high 7.8)
- [CVE-2022-38395](https://insights.sbomify.com/CVE-2022-38395/): Privilege escalation in HP Support Assistant (high 7.8)
- [CVE-2022-38394](https://insights.sbomify.com/CVE-2022-38394/): Hardcoded credentials in CentreCOM AR260S V2 (critical 9.8)
- [CVE-2022-38393](https://insights.sbomify.com/CVE-2022-38393/): Memory corruption in RT-AX82U (high 7.5)
- [CVE-2022-38392](https://insights.sbomify.com/CVE-2022-38392/): Denial of service in *:5400rmp oem harddrive (medium 5.3)
- [CVE-2022-38391](https://insights.sbomify.com/CVE-2022-38391/): IBM Spectrum Control information disclosure (medium 5.1)
- [CVE-2022-38390](https://insights.sbomify.com/CVE-2022-38390/): Cross-site scripting in Business Automation Workflow (medium 5.4)
- [CVE-2022-3839](https://insights.sbomify.com/CVE-2022-3839/): Analytics for WP <= 1.5.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38389](https://insights.sbomify.com/CVE-2022-38389/): IBM Tivoli Workload Scheduler XML external entity injection (high 7.1)
- [CVE-2022-38388](https://insights.sbomify.com/CVE-2022-38388/): Missing authorization in Navigator Mobile (medium 4.0)
- [CVE-2022-38387](https://insights.sbomify.com/CVE-2022-38387/): Command injection in Cloud Pak for Security (high 7.1)
- [CVE-2022-38386](https://insights.sbomify.com/CVE-2022-38386/): IBM Cloud Pak for Security information disclosure (medium 5.9)
- [CVE-2022-38385](https://insights.sbomify.com/CVE-2022-38385/): Other in Cloud Pak for Security (high 7.1)
- [CVE-2022-38383](https://insights.sbomify.com/CVE-2022-38383/): IBM Cloud Pak for Security information disclosure (medium 4.0)
- [CVE-2022-38382](https://insights.sbomify.com/CVE-2022-38382/): IBM Cloud Pak for Security session fixation (medium 4.7)
- [CVE-2022-38381](https://insights.sbomify.com/CVE-2022-38381/): Security feature bypass in Fortinet FortiADC (medium 5.3)
- [CVE-2022-38380](https://insights.sbomify.com/CVE-2022-38380/): Missing authorization in Fortinet FortiOS (medium 4.3)
- [CVE-2022-3838](https://insights.sbomify.com/CVE-2022-3838/): WPUpper Share Buttons <= 3.42 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38379](https://insights.sbomify.com/CVE-2022-38379/): Cross-site scripting in FortiSOAR (low 3.4)
- [CVE-2022-38378](https://insights.sbomify.com/CVE-2022-38378/): Privilege escalation in FortiOS (medium 4.0)
- [CVE-2022-38377](https://insights.sbomify.com/CVE-2022-38377/): Missing authorization in FortiAnalyzer (medium 4.1)
- [CVE-2022-38376](https://insights.sbomify.com/CVE-2022-38376/): Cross-site scripting in FortiNAC (medium 5.8)
- [CVE-2022-38375](https://insights.sbomify.com/CVE-2022-38375/): Missing authorization in FortiNAC (high 8.6)
- [CVE-2022-38374](https://insights.sbomify.com/CVE-2022-38374/): Cross-site scripting in Fortinet FortiADC (high 8.8)
- [CVE-2022-38373](https://insights.sbomify.com/CVE-2022-38373/): Cross-site scripting in Fortinet FortiDeceptor (high 8.0)
- [CVE-2022-38372](https://insights.sbomify.com/CVE-2022-38372/): Privilege escalation in Fortinet FortiTester (medium 6.7)
- [CVE-2022-38371](https://insights.sbomify.com/CVE-2022-38371/): Denial of service in APOGEE MBC (PPC) (BACnet) (high 8.7)
- [CVE-2022-38370](https://insights.sbomify.com/CVE-2022-38370/): No authorization of DatabaseConnectController in grafana-connector. (high 7.5)
- [CVE-2022-3837](https://insights.sbomify.com/CVE-2022-3837/): Uji Countdown < 2.3.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38369](https://insights.sbomify.com/CVE-2022-38369/): Login check vulnerability by session Id (high 8.8)
- [CVE-2022-38368](https://insights.sbomify.com/CVE-2022-38368/): Command injection in aviatrix:gateway (high 8.8)
- [CVE-2022-38367](https://insights.sbomify.com/CVE-2022-38367/): Missing authorization in netic:user export for jira (medium 5.3)
- [CVE-2022-38362](https://insights.sbomify.com/CVE-2022-38362/): Docker Provider <3.0 RCE vulnerability in example dag (high 8.8)
- [CVE-2022-3836](https://insights.sbomify.com/CVE-2022-3836/): Seed Social < 2.0.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38359](https://insights.sbomify.com/CVE-2022-38359/): Cross-site request forgery in Eyes of Network (high 8.8)
- [CVE-2022-38358](https://insights.sbomify.com/CVE-2022-38358/): Cross-site scripting in Eyes of Network (medium 6.1)
- [CVE-2022-38357](https://insights.sbomify.com/CVE-2022-38357/): Other in Eyes of Network Web (high 8.8)
- [CVE-2022-38356](https://insights.sbomify.com/CVE-2022-38356/): WordPress Pearl Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-38355](https://insights.sbomify.com/CVE-2022-38355/): Information disclosure in SVMPC1 (high 7.5)
- [CVE-2022-38352](https://insights.sbomify.com/CVE-2022-38352/): ThinkPHP deserialization vulnerability (critical 9.8)
- [CVE-2022-38351](https://insights.sbomify.com/CVE-2022-38351/): Privilege escalation in supremainc:biostar 2 (high 8.8)
- [CVE-2022-3835](https://insights.sbomify.com/CVE-2022-3835/): Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38349](https://insights.sbomify.com/CVE-2022-38349/): Denial of service in freedesktop:poppler (medium 6.5)
- [CVE-2022-38342](https://insights.sbomify.com/CVE-2022-38342/): XML external entity in safe:fme server (high 8.5)
- [CVE-2022-38341](https://insights.sbomify.com/CVE-2022-38341/): Other in safe:fme server (high 7.1)
- [CVE-2022-38340](https://insights.sbomify.com/CVE-2022-38340/): Path traversal in safe:fme server (critical 9.1)
- [CVE-2022-3834](https://insights.sbomify.com/CVE-2022-3834/): Google Forms <= 0.95 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38339](https://insights.sbomify.com/CVE-2022-38339/): Cross-site scripting in safe:fme server (critical 9.6)
- [CVE-2022-38337](https://insights.sbomify.com/CVE-2022-38337/): Denial of service in mobatek:mobaxterm (critical 9.1)
- [CVE-2022-38336](https://insights.sbomify.com/CVE-2022-38336/): Auth bypass in mobatek:mobaxterm (high 8.1)
- [CVE-2022-38335](https://insights.sbomify.com/CVE-2022-38335/): Cross-site scripting in vtiger:vtiger crm (medium 5.4)
- [CVE-2022-38334](https://insights.sbomify.com/CVE-2022-38334/): Denial of service in xpdfreader:xpdf (medium 5.5)
- [CVE-2022-38333](https://insights.sbomify.com/CVE-2022-38333/): Memory corruption in openwrt:openwrt (high 7.5)
- [CVE-2022-3833](https://insights.sbomify.com/CVE-2022-3833/): Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38329](https://insights.sbomify.com/CVE-2022-38329/): Cross-site request forgery in shopxian:shopxian cms (medium 4.3)
- [CVE-2022-38326](https://insights.sbomify.com/CVE-2022-38326/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-38325](https://insights.sbomify.com/CVE-2022-38325/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-38323](https://insights.sbomify.com/CVE-2022-38323/): File upload in event management system project:event management system (high 7.2)
- [CVE-2022-3832](https://insights.sbomify.com/CVE-2022-3832/): External Media < 1.0.36 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38314](https://insights.sbomify.com/CVE-2022-38314/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-38313](https://insights.sbomify.com/CVE-2022-38313/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-38312](https://insights.sbomify.com/CVE-2022-38312/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-38311](https://insights.sbomify.com/CVE-2022-38311/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-38310](https://insights.sbomify.com/CVE-2022-38310/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-3831](https://insights.sbomify.com/CVE-2022-3831/): reCAPTCHA <= 1.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38309](https://insights.sbomify.com/CVE-2022-38309/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-38308](https://insights.sbomify.com/CVE-2022-38308/): Command injection in totolink:a7000ru firmware (critical 9.8)
- [CVE-2022-38307](https://insights.sbomify.com/CVE-2022-38307/): LIEF contains segmentation violation (medium 5.5)
- [CVE-2022-38306](https://insights.sbomify.com/CVE-2022-38306/): LIEF vulnerable to heap based buffer overflow (high 7.8)
- [CVE-2022-38305](https://insights.sbomify.com/CVE-2022-38305/): File upload in aerocms project:aerocms (high 8.8)
- [CVE-2022-38304](https://insights.sbomify.com/CVE-2022-38304/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-38303](https://insights.sbomify.com/CVE-2022-38303/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-38302](https://insights.sbomify.com/CVE-2022-38302/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-38301](https://insights.sbomify.com/CVE-2022-38301/): Path traversal in onedev project:onedev (high 8.8)
- [CVE-2022-3830](https://insights.sbomify.com/CVE-2022-3830/): WP Page Builder <= 1.2.8 - Admin+ Stored Cross-Site (medium 4.8)
- [CVE-2022-38299](https://insights.sbomify.com/CVE-2022-38299/): Server-side request forgery in appsmith:appsmith (medium 4.3)
- [CVE-2022-38298](https://insights.sbomify.com/CVE-2022-38298/): Server-side request forgery in appsmith:appsmith (high 8.8)
- [CVE-2022-38297](https://insights.sbomify.com/CVE-2022-38297/): Auth bypass in ucms project:ucms (critical 9.8)
- [CVE-2022-38296](https://insights.sbomify.com/CVE-2022-38296/): File upload in cuppacms:cuppacms (critical 9.8)
- [CVE-2022-38295](https://insights.sbomify.com/CVE-2022-38295/): Cross-site scripting in cuppacms:cuppacms (medium 6.1)
- [CVE-2022-38292](https://insights.sbomify.com/CVE-2022-38292/): Server-side request forgery in slims:senayan library management system (critical 9.8)
- [CVE-2022-38291](https://insights.sbomify.com/CVE-2022-38291/): Cross-site scripting in slims:senayan library management system (medium 6.1)
- [CVE-2022-3829](https://insights.sbomify.com/CVE-2022-3829/): Font Awesome 4 Menus <= 4.7.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38286](https://insights.sbomify.com/CVE-2022-38286/): SQL injection in jflyfox:jfinal cms (high 7.2)
- [CVE-2022-38285](https://insights.sbomify.com/CVE-2022-38285/): SQL injection in jflyfox:jfinal cms (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/264/