# Vulnerabilities published in 2022


- [CVE-2022-38162](https://insights.sbomify.com/CVE-2022-38162/): Cross-site scripting in withsecure:f-secure policy manager (medium 6.1)
- [CVE-2022-38161](https://insights.sbomify.com/CVE-2022-38161/): Security feature bypass in gumstix:overo sbc (high 7.5)
- [CVE-2022-3816](https://insights.sbomify.com/CVE-2022-3816/): Axiomatic Bento4 mp4decrypt memory leak (medium 4.3)
- [CVE-2022-38156](https://insights.sbomify.com/CVE-2022-38156/): Command injection in kratosdefense:spectralnet narrowband firmware (high 7.2)
- [CVE-2022-38155](https://insights.sbomify.com/CVE-2022-38155/): Denial of service in samsung:mtower (high 7.5)
- [CVE-2022-38153](https://insights.sbomify.com/CVE-2022-38153/): Memory corruption in wolfssl:wolfssl (medium 5.9)
- [CVE-2022-38152](https://insights.sbomify.com/CVE-2022-38152/): Memory corruption in wolfssl:wolfssl (high 7.5)
- [CVE-2022-38150](https://insights.sbomify.com/CVE-2022-38150/): Denial of service in fedoraproject:fedora (medium 6.5)
- [CVE-2022-3815](https://insights.sbomify.com/CVE-2022-3815/): Axiomatic Bento4 mp4decrypt memory leak (medium 4.3)
- [CVE-2022-38149](https://insights.sbomify.com/CVE-2022-38149/): HashiCorp Consul Template could reveal Vault secret contents in error messages (high 7.5)
- [CVE-2022-38148](https://insights.sbomify.com/CVE-2022-38148/): Blind SQL Injection via GridFieldSortableHeader (high 8.8)
- [CVE-2022-38147](https://insights.sbomify.com/CVE-2022-38147/): XSS via uploaded gpx file (medium 5.4)
- [CVE-2022-38146](https://insights.sbomify.com/CVE-2022-38146/): URL XSS vulnerability due to outdated jquery in CMS (medium 5.4)
- [CVE-2022-38145](https://insights.sbomify.com/CVE-2022-38145/): Stored XSS in Compare Mode (medium 5.4)
- [CVE-2022-38144](https://insights.sbomify.com/CVE-2022-38144/): WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2022-38143](https://insights.sbomify.com/CVE-2022-38143/): Memory corruption in OpenImageIO (critical 9.8)
- [CVE-2022-38142](https://insights.sbomify.com/CVE-2022-38142/): Deserialization in InfraSuite Device Master (critical 9.8)
- [CVE-2022-38141](https://insights.sbomify.com/CVE-2022-38141/): WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control (medium 4.3)
- [CVE-2022-38140](https://insights.sbomify.com/CVE-2022-38140/): WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload (high 7.6)
- [CVE-2022-3814](https://insights.sbomify.com/CVE-2022-3814/): Axiomatic Bento4 mp4decrypt memory leak (medium 4.3)
- [CVE-2022-38139](https://insights.sbomify.com/CVE-2022-38139/): WordPress RD Station plugin <= 5.2.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-38138](https://insights.sbomify.com/CVE-2022-38138/): Memory corruption in Library: IEC 60870-6 (ICCP/Tase.2) (high 7.5)
- [CVE-2022-38137](https://insights.sbomify.com/CVE-2022-38137/): WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-38136](https://insights.sbomify.com/CVE-2022-38136/): Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel® Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits (medium 6.7)
- [CVE-2022-38135](https://insights.sbomify.com/CVE-2022-38135/): WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-38134](https://insights.sbomify.com/CVE-2022-38134/): WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability (medium 4.3)
- [CVE-2022-38133](https://insights.sbomify.com/CVE-2022-38133/): Information disclosure in TeamCity (low 3.2)
- [CVE-2022-38132](https://insights.sbomify.com/CVE-2022-38132/): Command injection in MR8300 Router (high 8.2)
- [CVE-2022-38131](https://insights.sbomify.com/CVE-2022-38131/): Open redirect in RStudio Connect (medium 6.1)
- [CVE-2022-38130](https://insights.sbomify.com/CVE-2022-38130/): Path traversal in Keysight Technologies Sensor Management Server (critical 9.8)
- [CVE-2022-3813](https://insights.sbomify.com/CVE-2022-3813/): Axiomatic Bento4 mp4edit memory leak (medium 4.3)
- [CVE-2022-38129](https://insights.sbomify.com/CVE-2022-38129/): Path traversal in Keysight Technologies Sensor Management Server (high 8.1)
- [CVE-2022-38125](https://insights.sbomify.com/CVE-2022-38125/): FTP Agent forwards traffic on inactive ports to LinkManager (low 2.9)
- [CVE-2022-38124](https://insights.sbomify.com/CVE-2022-38124/): Unwanted debug tool (medium 5.7)
- [CVE-2022-38123](https://insights.sbomify.com/CVE-2022-38123/): Insufficient validation of plugin files (high 8.7)
- [CVE-2022-38122](https://insights.sbomify.com/CVE-2022-38122/): POWERCOM CO., LTD. UPSMON PRO - Cleartext Transmission of Sensitive Information (high 7.5)
- [CVE-2022-38121](https://insights.sbomify.com/CVE-2022-38121/): POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials (medium 6.5)
- [CVE-2022-38120](https://insights.sbomify.com/CVE-2022-38120/): POWERCOM CO., LTD. UPSMON PRO - Path Traversal (medium 6.5)
- [CVE-2022-3812](https://insights.sbomify.com/CVE-2022-3812/): Axiomatic Bento4 mp4encrypt AP4_ContainerAtom memory leak (medium 4.3)
- [CVE-2022-38119](https://insights.sbomify.com/CVE-2022-38119/): POWERCOM CO., LTD. UPSMON PRO - Broken Authentication (critical 9.8)
- [CVE-2022-38118](https://insights.sbomify.com/CVE-2022-38118/): HGiga OAKlouds - SQL Injection (high 8.8)
- [CVE-2022-38117](https://insights.sbomify.com/CVE-2022-38117/): Juiker app - Hard-coded Credentials (medium 5.5)
- [CVE-2022-38116](https://insights.sbomify.com/CVE-2022-38116/): Le-yan Co., Ltd. Personnel and Salary Management System - Hard-coded password (critical 9.8)
- [CVE-2022-38115](https://insights.sbomify.com/CVE-2022-38115/): Insecure Methods Vulnerability (medium 5.3)
- [CVE-2022-38114](https://insights.sbomify.com/CVE-2022-38114/): Client-Side Desync Vulnerability (medium 6.1)
- [CVE-2022-38113](https://insights.sbomify.com/CVE-2022-38113/): Information Disclosure Vulnerability (medium 5.3)
- [CVE-2022-38112](https://insights.sbomify.com/CVE-2022-38112/): Sensitive Information Disclosure Vulnerability (high 7.5)
- [CVE-2022-38111](https://insights.sbomify.com/CVE-2022-38111/): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (high 7.2)
- [CVE-2022-38110](https://insights.sbomify.com/CVE-2022-38110/): Reflected Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2022-3811](https://insights.sbomify.com/CVE-2022-3811/): EU Cookie Law <= 3.1.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-38108](https://insights.sbomify.com/CVE-2022-38108/): SolarWinds Platform Deserialization of Untrusted Data (high 7.2)
- [CVE-2022-38107](https://insights.sbomify.com/CVE-2022-38107/): Sensitive Data Disclosure Vulnerability (medium 5.3)
- [CVE-2022-38106](https://insights.sbomify.com/CVE-2022-38106/): Cross-Site Scripting Vulnerability in Serv-U Web Client (medium 5.4)
- [CVE-2022-38105](https://insights.sbomify.com/CVE-2022-38105/): Information disclosure in RT-AX82U (high 7.5)
- [CVE-2022-38104](https://insights.sbomify.com/CVE-2022-38104/): WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability (high 7.2)
- [CVE-2022-38103](https://insights.sbomify.com/CVE-2022-38103/): Privilege escalation in Intel(R) NUC Software Studio Service installer (medium 6.7)
- [CVE-2022-38102](https://insights.sbomify.com/CVE-2022-38102/): Denial of service in Intel(R) Converged Security and Management Engine (high 7.2)
- [CVE-2022-38101](https://insights.sbomify.com/CVE-2022-38101/): Privilege escalation in Intel(R) NUC Chaco Canyon BIOS update software (medium 6.7)
- [CVE-2022-38100](https://insights.sbomify.com/CVE-2022-38100/): Contec Health CMS8000 (high 7.5)
- [CVE-2022-3810](https://insights.sbomify.com/CVE-2022-3810/): Axiomatic Bento4 mp42hevc Mp42Hevc.cpp AP4_File denial of service (medium 4.3)
- [CVE-2022-38099](https://insights.sbomify.com/CVE-2022-38099/): Privilege escalation in Intel(R) NUC 11 Compute Elements (high 7.5)
- [CVE-2022-38097](https://insights.sbomify.com/CVE-2022-38097/): Use after free in Foxit Reader (high 8.8)
- [CVE-2022-38096](https://insights.sbomify.com/CVE-2022-38096/): There is a NULL pointer vulnerability in vmwgfx driver (medium 6.3)
- [CVE-2022-38095](https://insights.sbomify.com/CVE-2022-38095/): WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-38094](https://insights.sbomify.com/CVE-2022-38094/): Command injection in CentreCOM AR260S V2 (high 8.8)
- [CVE-2022-38093](https://insights.sbomify.com/CVE-2022-38093/): WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-38090](https://insights.sbomify.com/CVE-2022-38090/): Information disclosure in Intel(R) Processors with Intel(R) Software Guard Extensions (SGX) (medium 6.0)
- [CVE-2022-3809](https://insights.sbomify.com/CVE-2022-3809/): Axiomatic Bento4 mp4tag Mp4Tag.cpp ParseCommandLine denial of service (medium 4.3)
- [CVE-2022-38089](https://insights.sbomify.com/CVE-2022-38089/): Cross-site scripting in Exment (medium 5.4)
- [CVE-2022-38088](https://insights.sbomify.com/CVE-2022-38088/): Path traversal in QUARTZ-GOLD (medium 4.9)
- [CVE-2022-38087](https://insights.sbomify.com/CVE-2022-38087/): Information disclosure in Intel(R) Processors (medium 4.1)
- [CVE-2022-38086](https://insights.sbomify.com/CVE-2022-38086/): WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-38085](https://insights.sbomify.com/CVE-2022-38085/): WordPress Read more By Adam plugin <= 1.1.8 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-38083](https://insights.sbomify.com/CVE-2022-38083/): Information disclosure in Intel(R) Processors (medium 6.1)
- [CVE-2022-38081](https://insights.sbomify.com/CVE-2022-38081/): Auth bypass in OpenHarmony (medium 6.2)
- [CVE-2022-38080](https://insights.sbomify.com/CVE-2022-38080/): exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2022-38079](https://insights.sbomify.com/CVE-2022-38079/): WordPress Backup Scheduler plugin <= 1.5.13 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-38078](https://insights.sbomify.com/CVE-2022-38078/): Command injection in Movable Type XMLRPC API (critical 9.8)
- [CVE-2022-38077](https://insights.sbomify.com/CVE-2022-38077/): WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-38076](https://insights.sbomify.com/CVE-2022-38076/): Privilege escalation in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software (low 3.8)
- [CVE-2022-38075](https://insights.sbomify.com/CVE-2022-38075/): Cross-site request forgery in Mantenimiento web (WordPress plugin) (medium 6.1)
- [CVE-2022-38074](https://insights.sbomify.com/CVE-2022-38074/): WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection (critical 9.9)
- [CVE-2022-38073](https://insights.sbomify.com/CVE-2022-38073/): WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties) (medium 5.4)
- [CVE-2022-38072](https://insights.sbomify.com/CVE-2022-38072/): ADMesh improper array index validation (medium 6.5)
- [CVE-2022-38070](https://insights.sbomify.com/CVE-2022-38070/): WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability (medium 5.4)
- [CVE-2022-3807](https://insights.sbomify.com/CVE-2022-3807/): Axiomatic Bento4 Incomplete Fix CVE-2019-13238 resource consumption (medium 4.3)
- [CVE-2022-38069](https://insights.sbomify.com/CVE-2022-38069/): Contec Health CMS8000 (medium 4.3)
- [CVE-2022-38068](https://insights.sbomify.com/CVE-2022-38068/): WordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-38067](https://insights.sbomify.com/CVE-2022-38067/): WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability (medium 6.5)
- [CVE-2022-38066](https://insights.sbomify.com/CVE-2022-38066/): Command injection in QUARTZ-GOLD (high 7.2)
- [CVE-2022-38065](https://insights.sbomify.com/CVE-2022-38065/): Privilege escalation in OpenStack (high 8.8)
- [CVE-2022-38064](https://insights.sbomify.com/CVE-2022-38064/): Auth bypass in OpenHarmony (medium 6.2)
- [CVE-2022-38063](https://insights.sbomify.com/CVE-2022-38063/): WordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-38062](https://insights.sbomify.com/CVE-2022-38062/): WordPress Download Theme Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-38061](https://insights.sbomify.com/CVE-2022-38061/): WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability (medium 6.2)
- [CVE-2022-38060](https://insights.sbomify.com/CVE-2022-38060/): OpenStack Kolla sudo privilege escalation vulnerability (high 8.8)
- [CVE-2022-3806](https://insights.sbomify.com/CVE-2022-3806/): Bluetooth HCI Error Handling Double Free (critical 9.8)
- [CVE-2022-38059](https://insights.sbomify.com/CVE-2022-38059/): WordPress Access Code Feeder plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.5)
- [CVE-2022-38058](https://insights.sbomify.com/CVE-2022-38058/): WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability (medium 4.3)
- [CVE-2022-38057](https://insights.sbomify.com/CVE-2022-38057/): WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/266/