# Vulnerabilities published in 2022


- [CVE-2022-3782](https://insights.sbomify.com/CVE-2022-3782/): Keycloak vulnerable to path traversal via double URL encoding (critical 9.1)
- [CVE-2022-37819](https://insights.sbomify.com/CVE-2022-37819/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37818](https://insights.sbomify.com/CVE-2022-37818/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37817](https://insights.sbomify.com/CVE-2022-37817/): Memory corruption in tenda:ax1803 firmware (high 7.8)
- [CVE-2022-37816](https://insights.sbomify.com/CVE-2022-37816/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37815](https://insights.sbomify.com/CVE-2022-37815/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37814](https://insights.sbomify.com/CVE-2022-37814/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37813](https://insights.sbomify.com/CVE-2022-37813/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37812](https://insights.sbomify.com/CVE-2022-37812/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37811](https://insights.sbomify.com/CVE-2022-37811/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37810](https://insights.sbomify.com/CVE-2022-37810/): Command injection in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-3781](https://insights.sbomify.com/CVE-2022-3781/): Information disclosure in Devolutions Server (medium 6.5)
- [CVE-2022-37809](https://insights.sbomify.com/CVE-2022-37809/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37808](https://insights.sbomify.com/CVE-2022-37808/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37807](https://insights.sbomify.com/CVE-2022-37807/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37806](https://insights.sbomify.com/CVE-2022-37806/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37805](https://insights.sbomify.com/CVE-2022-37805/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37804](https://insights.sbomify.com/CVE-2022-37804/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37803](https://insights.sbomify.com/CVE-2022-37803/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37802](https://insights.sbomify.com/CVE-2022-37802/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37801](https://insights.sbomify.com/CVE-2022-37801/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37800](https://insights.sbomify.com/CVE-2022-37800/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-3780](https://insights.sbomify.com/CVE-2022-3780/): Missing authorization in Remote Desktop Manager (high 7.5)
- [CVE-2022-37799](https://insights.sbomify.com/CVE-2022-37799/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37798](https://insights.sbomify.com/CVE-2022-37798/): Memory corruption in tenda:ac1206 firmware (critical 9.8)
- [CVE-2022-37797](https://insights.sbomify.com/CVE-2022-37797/): Null dereference in debian:debian linux (high 7.5)
- [CVE-2022-37796](https://insights.sbomify.com/CVE-2022-37796/): Cross-site scripting in oretnom23:simple online book store system (medium 5.4)
- [CVE-2022-37794](https://insights.sbomify.com/CVE-2022-37794/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-37787](https://insights.sbomify.com/CVE-2022-37787/): Cross-site scripting in wecube-platform project:wecube-platform (medium 6.1)
- [CVE-2022-37786](https://insights.sbomify.com/CVE-2022-37786/): Code injection in wecube-platform project:wecube-platform (medium 6.3)
- [CVE-2022-37785](https://insights.sbomify.com/CVE-2022-37785/): Information disclosure in wecube-platform project:wecube-platform (high 7.5)
- [CVE-2022-37783](https://insights.sbomify.com/CVE-2022-37783/): Craft CMS discloses password hashes (high 7.5)
- [CVE-2022-37781](https://insights.sbomify.com/CVE-2022-37781/): Memory corruption in fdkaac project:fdkaac (high 7.8)
- [CVE-2022-37780](https://insights.sbomify.com/CVE-2022-37780/): Command injection in phicomm:fir151b firmware (high 7.2)
- [CVE-2022-37779](https://insights.sbomify.com/CVE-2022-37779/): Command injection in phicomm:fir151b firmware (high 7.2)
- [CVE-2022-37778](https://insights.sbomify.com/CVE-2022-37778/): Command injection in phicomm:fir151b firmware (high 7.2)
- [CVE-2022-37777](https://insights.sbomify.com/CVE-2022-37777/): Command injection in phicomm:fir151b firmware (high 7.2)
- [CVE-2022-37775](https://insights.sbomify.com/CVE-2022-37775/): Cross-site scripting in genesys:pureconnect (medium 6.1)
- [CVE-2022-37774](https://insights.sbomify.com/CVE-2022-37774/): Auth bypass in maarch:maarch rm (medium 5.3)
- [CVE-2022-37773](https://insights.sbomify.com/CVE-2022-37773/): SQL injection in maarch:maarch rm (medium 6.5)
- [CVE-2022-37772](https://insights.sbomify.com/CVE-2022-37772/): Auth bypass in maarch:maarch rm (high 7.5)
- [CVE-2022-37771](https://insights.sbomify.com/CVE-2022-37771/): Privilege escalation in iobit:malware fighter (medium 6.7)
- [CVE-2022-37770](https://insights.sbomify.com/CVE-2022-37770/): Memory corruption in jpeg:libjpeg (medium 6.5)
- [CVE-2022-37769](https://insights.sbomify.com/CVE-2022-37769/): Memory corruption in jpeg:libjpeg (medium 6.5)
- [CVE-2022-37768](https://insights.sbomify.com/CVE-2022-37768/): Denial of service in jpeg:libjpeg (high 7.5)
- [CVE-2022-37767](https://insights.sbomify.com/CVE-2022-37767/): Pebble Templates protection mechanism bypass can lead to arbitrary code execution (critical 9.8)
- [CVE-2022-3776](https://insights.sbomify.com/CVE-2022-3776/): Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgery (high 8.8)
- [CVE-2022-3775](https://insights.sbomify.com/CVE-2022-3775/): Memory corruption in grub2 (high 7.1)
- [CVE-2022-3774](https://insights.sbomify.com/CVE-2022-3774/): SourceCodester Train Scheduler App resource injection (medium 5.4)
- [CVE-2022-37734](https://insights.sbomify.com/CVE-2022-37734/): graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources (high 7.5)
- [CVE-2022-37731](https://insights.sbomify.com/CVE-2022-37731/): Cross-site scripting in ftcms:ftcms (medium 6.1)
- [CVE-2022-37730](https://insights.sbomify.com/CVE-2022-37730/): Cross-site request forgery in ftcms:ftcms (high 8.8)
- [CVE-2022-37724](https://insights.sbomify.com/CVE-2022-37724/): Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting (medium 6.1)
- [CVE-2022-37721](https://insights.sbomify.com/CVE-2022-37721/): PyroCMS vulnerable to stored Cross Site Scripting (critical 9.0)
- [CVE-2022-37720](https://insights.sbomify.com/CVE-2022-37720/): Cross-site scripting in orchardcore:orchard cms (critical 9.0)
- [CVE-2022-37719](https://insights.sbomify.com/CVE-2022-37719/): Cross-site request forgery in edgenexus:application delivery controller (high 8.8)
- [CVE-2022-37718](https://insights.sbomify.com/CVE-2022-37718/): Command injection in edgenexus:application delivery controller (high 8.8)
- [CVE-2022-37710](https://insights.sbomify.com/CVE-2022-37710/): Hardcoded credentials in pattersondental:eaglesoft (high 7.8)
- [CVE-2022-3771](https://insights.sbomify.com/CVE-2022-3771/): easyii CMS File Upload Management Upload.php file unrestricted upload (medium 6.3)
- [CVE-2022-37709](https://insights.sbomify.com/CVE-2022-37709/): Auth bypass in tesla:model 3 firmware (medium 5.3)
- [CVE-2022-37706](https://insights.sbomify.com/CVE-2022-37706/): Privilege escalation in enlightenment:enlightenment (high 7.8)
- [CVE-2022-37705](https://insights.sbomify.com/CVE-2022-37705/): Privilege escalation in zmanda:amanda (medium 6.7)
- [CVE-2022-37704](https://insights.sbomify.com/CVE-2022-37704/): Privilege escalation in zmanda:amanda (medium 6.7)
- [CVE-2022-37703](https://insights.sbomify.com/CVE-2022-37703/): Information disclosure in amanda:amanda (low 3.3)
- [CVE-2022-37700](https://insights.sbomify.com/CVE-2022-37700/): Path traversal in easycorp:zentao (high 7.5)
- [CVE-2022-3770](https://insights.sbomify.com/CVE-2022-3770/): Yunjing CMS upload_img.html unrestricted upload (medium 6.3)
- [CVE-2022-3769](https://insights.sbomify.com/CVE-2022-3769/): OWM Weather < 5.6.9 - Contributor+ SQLi (high 8.8)
- [CVE-2022-37681](https://insights.sbomify.com/CVE-2022-37681/): Path traversal in hitachi:hc-ip9100hd firmware (high 7.5)
- [CVE-2022-37680](https://insights.sbomify.com/CVE-2022-37680/): Auth bypass in hitachi:hc-ip9100hd firmware (high 7.5)
- [CVE-2022-3768](https://insights.sbomify.com/CVE-2022-3768/): WPSmartContracts < 1.3.12 - Author+ SQLi (high 8.8)
- [CVE-2022-37679](https://insights.sbomify.com/CVE-2022-37679/): Cross-site scripting in miniblog.core project:miniblog.core (medium 4.8)
- [CVE-2022-3767](https://insights.sbomify.com/CVE-2022-3767/): Information disclosure in DAST (high 7.7)
- [CVE-2022-37661](https://insights.sbomify.com/CVE-2022-37661/): Command injection in adtran:sr506n firmware (critical 9.8)
- [CVE-2022-37660](https://insights.sbomify.com/CVE-2022-37660/): Weak cryptography in w1.fi:hostapd (medium 6.5)
- [CVE-2022-3766](https://insights.sbomify.com/CVE-2022-3766/): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (high 7.3)
- [CVE-2022-3765](https://insights.sbomify.com/CVE-2022-3765/): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (high 8.2)
- [CVE-2022-3764](https://insights.sbomify.com/CVE-2022-3764/): Form Vibes < 1.4.5 - Admin+ SQLi (high 7.2)
- [CVE-2022-3763](https://insights.sbomify.com/CVE-2022-3763/): Booster for WooCommerce - Checkout Files Deletion via CSRF (high 8.1)
- [CVE-2022-37623](https://insights.sbomify.com/CVE-2022-37623/): thlorenz browserify-shim vulnerable to prototype pollution (critical 9.8)
- [CVE-2022-37621](https://insights.sbomify.com/CVE-2022-37621/): thlorenz browserify-shim vulnerable to prototype pollution (critical 9.8)
- [CVE-2022-37620](https://insights.sbomify.com/CVE-2022-37620/): kangax html-minifier REDoS vulnerability (high 7.5)
- [CVE-2022-3762](https://insights.sbomify.com/CVE-2022-3762/): Booster for WooCommerce - ShopManager+ Arbitrary File Download (medium 6.5)
- [CVE-2022-37617](https://insights.sbomify.com/CVE-2022-37617/): thlorenz browserify-shim vulnerable to prototype pollution (critical 9.8)
- [CVE-2022-37616](https://insights.sbomify.com/CVE-2022-37616/): Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom (critical 9.8)
- [CVE-2022-37614](https://insights.sbomify.com/CVE-2022-37614/): mockery is vulnerable to prototype pollution (critical 9.8)
- [CVE-2022-37611](https://insights.sbomify.com/CVE-2022-37611/): tschaub gh-pages vulnerable to prototype pollution (critical 9.8)
- [CVE-2022-3761](https://insights.sbomify.com/CVE-2022-3761/): Weak cryptography in OpenVPN Connect (medium 5.9)
- [CVE-2022-37609](https://insights.sbomify.com/CVE-2022-37609/): Code injection in js-beautify project:js-beautify (critical 9.8)
- [CVE-2022-37603](https://insights.sbomify.com/CVE-2022-37603/): loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable (high 7.5)
- [CVE-2022-37602](https://insights.sbomify.com/CVE-2022-37602/): Grunt-karma vulnerable to prototype pollution (critical 9.8)
- [CVE-2022-37601](https://insights.sbomify.com/CVE-2022-37601/): Prototype pollution in webpack loader-utils (critical 9.8)
- [CVE-2022-3760](https://insights.sbomify.com/CVE-2022-3760/): SQLi in Mia-Med (critical 9.8)
- [CVE-2022-37599](https://insights.sbomify.com/CVE-2022-37599/): loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) (high 7.5)
- [CVE-2022-37598](https://insights.sbomify.com/CVE-2022-37598/): Code injection in uglifyjs project:uglifyjs (critical 9.8)
- [CVE-2022-3759](https://insights.sbomify.com/CVE-2022-3759/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-3758](https://insights.sbomify.com/CVE-2022-3758/): Missing authorization in GitLab (medium 5.4)
- [CVE-2022-3754](https://insights.sbomify.com/CVE-2022-3754/): Weak Password Requirements in thorsten/phpmyfaq (high 7.5)
- [CVE-2022-3753](https://insights.sbomify.com/CVE-2022-3753/): Evaluate <= 1.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-3752](https://insights.sbomify.com/CVE-2022-3752/): Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack (high 8.6)
- [CVE-2022-3751](https://insights.sbomify.com/CVE-2022-3751/): SQL Injection in owncast/owncast (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/269/