# Vulnerabilities published in 2022 - [CVE-2022-38284](https://insights.sbomify.com/CVE-2022-38284/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38283](https://insights.sbomify.com/CVE-2022-38283/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38282](https://insights.sbomify.com/CVE-2022-38282/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38281](https://insights.sbomify.com/CVE-2022-38281/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38280](https://insights.sbomify.com/CVE-2022-38280/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-3828](https://insights.sbomify.com/CVE-2022-3828/): Video Thumbnails <= 2.12.3 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-38279](https://insights.sbomify.com/CVE-2022-38279/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38278](https://insights.sbomify.com/CVE-2022-38278/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38277](https://insights.sbomify.com/CVE-2022-38277/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38276](https://insights.sbomify.com/CVE-2022-38276/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38275](https://insights.sbomify.com/CVE-2022-38275/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38274](https://insights.sbomify.com/CVE-2022-38274/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38273](https://insights.sbomify.com/CVE-2022-38273/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-38272](https://insights.sbomify.com/CVE-2022-38272/): SQL injection in jflyfox:jfinal cms (high 7.2) - [CVE-2022-3827](https://insights.sbomify.com/CVE-2022-3827/): centreon Contact Groups Form formContactGroup.php sql injection (medium 6.3) - [CVE-2022-38269](https://insights.sbomify.com/CVE-2022-38269/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (high 7.2) - [CVE-2022-38268](https://insights.sbomify.com/CVE-2022-38268/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (high 7.2) - [CVE-2022-38267](https://insights.sbomify.com/CVE-2022-38267/): SQL injection in school activity updates with sms notification project:school activity updates with sms notification (high 7.2) - [CVE-2022-38266](https://insights.sbomify.com/CVE-2022-38266/): Denial of service in debian:debian linux (medium 6.5) - [CVE-2022-38265](https://insights.sbomify.com/CVE-2022-38265/): SQL injection in apartment visitor management system project:apartment visitor management system (high 7.2) - [CVE-2022-38260](https://insights.sbomify.com/CVE-2022-38260/): SQL injection in janobe:interview management system (high 7.2) - [CVE-2022-3826](https://insights.sbomify.com/CVE-2022-3826/): Huaxia ERP Retail Management list information disclosure (medium 4.3) - [CVE-2022-38258](https://insights.sbomify.com/CVE-2022-38258/): Path traversal in dlink:dir-819 firmware (high 8.1) - [CVE-2022-38256](https://insights.sbomify.com/CVE-2022-38256/): Cross-site scripting in tastyigniter:tastyigniter (medium 5.4) - [CVE-2022-38255](https://insights.sbomify.com/CVE-2022-38255/): SQL injection in janobe:interview management system (high 7.2) - [CVE-2022-38254](https://insights.sbomify.com/CVE-2022-38254/): Cross-site scripting in nagios:nagios xi (medium 6.1) - [CVE-2022-38251](https://insights.sbomify.com/CVE-2022-38251/): Cross-site scripting in nagios:nagios xi (medium 4.8) - [CVE-2022-38250](https://insights.sbomify.com/CVE-2022-38250/): SQL injection in nagios:nagios xi (critical 9.8) - [CVE-2022-3825](https://insights.sbomify.com/CVE-2022-3825/): Huaxia ERP User Management sql injection (medium 6.3) - [CVE-2022-38249](https://insights.sbomify.com/CVE-2022-38249/): Cross-site scripting in nagios:nagios xi (medium 6.1) - [CVE-2022-38248](https://insights.sbomify.com/CVE-2022-38248/): Cross-site scripting in nagios:nagios xi (medium 6.1) - [CVE-2022-38247](https://insights.sbomify.com/CVE-2022-38247/): Cross-site scripting in nagios:nagios xi (medium 4.8) - [CVE-2022-3824](https://insights.sbomify.com/CVE-2022-3824/): WP Admin UI Customize < 1.5.13 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-38238](https://insights.sbomify.com/CVE-2022-38238/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38237](https://insights.sbomify.com/CVE-2022-38237/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38236](https://insights.sbomify.com/CVE-2022-38236/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38235](https://insights.sbomify.com/CVE-2022-38235/): Memory corruption in xpdf project:xpdf (medium 5.5) - [CVE-2022-38234](https://insights.sbomify.com/CVE-2022-38234/): Denial of service in xpdf project:xpdf (medium 5.5) - [CVE-2022-38233](https://insights.sbomify.com/CVE-2022-38233/): Memory corruption in xpdf project:xpdf (medium 5.5) - [CVE-2022-38231](https://insights.sbomify.com/CVE-2022-38231/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38230](https://insights.sbomify.com/CVE-2022-38230/): Denial of service in xpdf project:xpdf (medium 5.5) - [CVE-2022-3823](https://insights.sbomify.com/CVE-2022-3823/): Beautiful Cookie Consent Banner < 2.9.1 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-38229](https://insights.sbomify.com/CVE-2022-38229/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38228](https://insights.sbomify.com/CVE-2022-38228/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38227](https://insights.sbomify.com/CVE-2022-38227/): Memory corruption in xpdf project:xpdf (high 7.8) - [CVE-2022-38223](https://insights.sbomify.com/CVE-2022-38223/): Memory corruption in fedoraproject:fedora (high 7.8) - [CVE-2022-38222](https://insights.sbomify.com/CVE-2022-38222/): Use after free in xpdfreader:xpdf (high 7.8) - [CVE-2022-38221](https://insights.sbomify.com/CVE-2022-38221/): Memory corruption in the isle evrima project:the isle evrima (critical 9.8) - [CVE-2022-38220](https://insights.sbomify.com/CVE-2022-38220/): Cross-site scripting in quest:kace systems management appliance (medium 6.1) - [CVE-2022-3822](https://insights.sbomify.com/CVE-2022-3822/): Donations via PayPal < 1.9.9 - Admin+ Stored XSS (medium 4.8) - [CVE-2022-38216](https://insights.sbomify.com/CVE-2022-38216/): Mapbox is vulnerable to Integer Overflow (high 7.5) - [CVE-2022-38212](https://insights.sbomify.com/CVE-2022-38212/): Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) (high 7.5) - [CVE-2022-38211](https://insights.sbomify.com/CVE-2022-38211/): Server Side Request Forgery (SSRF) vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only) (high 7.5) - [CVE-2022-38210](https://insights.sbomify.com/CVE-2022-38210/): HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only) (medium 6.1) - [CVE-2022-3821](https://insights.sbomify.com/CVE-2022-3821/): Memory corruption in systemd (medium 5.5) - [CVE-2022-38209](https://insights.sbomify.com/CVE-2022-38209/): Reflected XSS vulnerability in Portal for ArcGIS (medium 6.1) - [CVE-2022-38208](https://insights.sbomify.com/CVE-2022-38208/): Unvalidated redirect in Portal for ArcGIS (medium 6.1) - [CVE-2022-38207](https://insights.sbomify.com/CVE-2022-38207/): Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) (medium 6.1) - [CVE-2022-38206](https://insights.sbomify.com/CVE-2022-38206/): Reflected XSS vulnerability in Portal for ArcGIS (10.9.1, 10.8.1 and 10.7.1 only) (medium 6.1) - [CVE-2022-38205](https://insights.sbomify.com/CVE-2022-38205/): Portal for ArcGIS has a directory traversal vulnerability (10.9.1, 10.8.1 and 10.7.1 only) (high 8.6) - [CVE-2022-38204](https://insights.sbomify.com/CVE-2022-38204/): Reflected XSS vulnerability in Portal for ArcGIS (10.8.1 and 10.7.1 only) (medium 6.1) - [CVE-2022-38203](https://insights.sbomify.com/CVE-2022-38203/): The allowedProxyHosts property is not fully honored in ArcGIS Enterprise (10.8.1 and 10.7.1 only) (high 7.5) - [CVE-2022-38202](https://insights.sbomify.com/CVE-2022-38202/): BUG-000152121 - Directory traversal vulnerability in ArcGIS Server. (high 7.5) - [CVE-2022-38201](https://insights.sbomify.com/CVE-2022-38201/): An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. (medium 6.1) - [CVE-2022-38200](https://insights.sbomify.com/CVE-2022-38200/): BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. (medium 6.1) - [CVE-2022-3820](https://insights.sbomify.com/CVE-2022-3820/): Auth bypass in GitLab (medium 6.5) - [CVE-2022-38199](https://insights.sbomify.com/CVE-2022-38199/): BUG-000144172 - Remote file download issue in ArcGIS Server (medium 6.1) - [CVE-2022-38198](https://insights.sbomify.com/CVE-2022-38198/): BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server (medium 6.1) - [CVE-2022-38197](https://insights.sbomify.com/CVE-2022-38197/): BUG-000148347 Unvalidated redirect issues in ArcGIS Server. (medium 6.1) - [CVE-2022-38196](https://insights.sbomify.com/CVE-2022-38196/): BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability (medium 6.5) - [CVE-2022-38195](https://insights.sbomify.com/CVE-2022-38195/): BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server (medium 6.1) - [CVE-2022-38194](https://insights.sbomify.com/CVE-2022-38194/): Portal for ArcGIS system properties are not properly encrypted (10.8.1 only) (medium 6.7) - [CVE-2022-38193](https://insights.sbomify.com/CVE-2022-38193/): Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1) (medium 6.1) - [CVE-2022-38192](https://insights.sbomify.com/CVE-2022-38192/): There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript. (medium 6.1) - [CVE-2022-38191](https://insights.sbomify.com/CVE-2022-38191/): HTML injection vulnerability in Portal for ArcGIS (medium 6.1) - [CVE-2022-38190](https://insights.sbomify.com/CVE-2022-38190/): Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps (medium 6.1) - [CVE-2022-3819](https://insights.sbomify.com/CVE-2022-3819/): Missing authorization in GitLab (low 3.5) - [CVE-2022-38189](https://insights.sbomify.com/CVE-2022-38189/): There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript. (medium 5.4) - [CVE-2022-38188](https://insights.sbomify.com/CVE-2022-38188/): Cross-site scripting in Portal for ArcGIS (high 7.1) - [CVE-2022-38187](https://insights.sbomify.com/CVE-2022-38187/): Prevent access to sharing/rest/content/features/analyze to unauthorized users (high 7.5) - [CVE-2022-38186](https://insights.sbomify.com/CVE-2022-38186/): Cross-site scripting in Portal for ArcGIS (high 7.1) - [CVE-2022-38184](https://insights.sbomify.com/CVE-2022-38184/): There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 (high 7.5) - [CVE-2022-38183](https://insights.sbomify.com/CVE-2022-38183/): Gitea allowed assignment of private issues (medium 6.5) - [CVE-2022-38181](https://insights.sbomify.com/CVE-2022-38181/): Arm Mali GPU Kernel Driver Use-After-Free (high 8.8, exploited in the wild) - [CVE-2022-38180](https://insights.sbomify.com/CVE-2022-38180/): JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider (medium 5.3) - [CVE-2022-3818](https://insights.sbomify.com/CVE-2022-3818/): Denial of service in GitLab (medium 5.3) - [CVE-2022-38179](https://insights.sbomify.com/CVE-2022-38179/): JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack (medium 4.7) - [CVE-2022-38178](https://insights.sbomify.com/CVE-2022-38178/): Memory leaks in EdDSA DNSSEC verification code (high 7.5) - [CVE-2022-38177](https://insights.sbomify.com/CVE-2022-38177/): Memory leak in ECDSA DNSSEC verification code (high 7.5) - [CVE-2022-38176](https://insights.sbomify.com/CVE-2022-38176/): Privilege escalation in ysoft:safeq (high 7.8) - [CVE-2022-38172](https://insights.sbomify.com/CVE-2022-38172/): Cross-site scripting in servicenow:servicenow (medium 6.1) - [CVE-2022-38171](https://insights.sbomify.com/CVE-2022-38171/): Integer overflow in freedesktop:poppler (high 7.8) - [CVE-2022-38170](https://insights.sbomify.com/CVE-2022-38170/): Overly permissive umask for daemons (medium 4.7) - [CVE-2022-3817](https://insights.sbomify.com/CVE-2022-3817/): Axiomatic Bento4 mp4mux memory leak (medium 4.3) - [CVE-2022-38168](https://insights.sbomify.com/CVE-2022-38168/): Auth bypass in avaya:scopia pathfinder 10 pts firmware (critical 9.1) - [CVE-2022-38167](https://insights.sbomify.com/CVE-2022-38167/): Cross-site scripting in nintex:workflow (medium 6.1) - [CVE-2022-38166](https://insights.sbomify.com/CVE-2022-38166/): Denial of service in f-secure:elements endpoint protection (high 7.5) - [CVE-2022-38165](https://insights.sbomify.com/CVE-2022-38165/): Path traversal in withsecure:f-secure policy manager (critical 9.8) - [CVE-2022-38164](https://insights.sbomify.com/CVE-2022-38164/): Other in f-secure:safe (medium 6.5) - [CVE-2022-38163](https://insights.sbomify.com/CVE-2022-38163/): Other in f-secure:safe (low 3.5) --- From sbomify Insights: https://insights.sbomify.com/years/2022/page/265/