# Vulnerabilities published in 2022


- [CVE-2022-37352](https://insights.sbomify.com/CVE-2022-37352/): Memory corruption in PDF-XChange Editor (low 3.3)
- [CVE-2022-37351](https://insights.sbomify.com/CVE-2022-37351/): Memory corruption in PDF-XChange Editor (low 3.3)
- [CVE-2022-37350](https://insights.sbomify.com/CVE-2022-37350/): Memory corruption in PDF-XChange Editor (high 7.8)
- [CVE-2022-3735](https://insights.sbomify.com/CVE-2022-3735/): seccome Ehoney signup access control (medium 6.3)
- [CVE-2022-37349](https://insights.sbomify.com/CVE-2022-37349/): Memory corruption in PDF-XChange Editor (high 7.8)
- [CVE-2022-37348](https://insights.sbomify.com/CVE-2022-37348/): Memory corruption in Trend Micro Security (Consumer) (medium 5.5)
- [CVE-2022-37347](https://insights.sbomify.com/CVE-2022-37347/): Memory corruption in Trend Micro Security (Consumer) (medium 5.5)
- [CVE-2022-37346](https://insights.sbomify.com/CVE-2022-37346/): File upload in Product Image Bulk Upload Plugin (critical 9.8)
- [CVE-2022-37345](https://insights.sbomify.com/CVE-2022-37345/): Auth bypass in Intel(R) NUC Kits (high 7.8)
- [CVE-2022-37344](https://insights.sbomify.com/CVE-2022-37344/): WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability (high 7.6)
- [CVE-2022-37343](https://insights.sbomify.com/CVE-2022-37343/): Privilege escalation in Intel(R) Processors (high 7.2)
- [CVE-2022-37342](https://insights.sbomify.com/CVE-2022-37342/): Cross-site scripting in Add Shortcodes Actions And Filters (WordPress plugin) (medium 4.8)
- [CVE-2022-37341](https://insights.sbomify.com/CVE-2022-37341/): Privilege escalation in Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware (high 7.2)
- [CVE-2022-37340](https://insights.sbomify.com/CVE-2022-37340/): Privilege escalation in Intel(R) QAT drivers for Windows (medium 6.7)
- [CVE-2022-3734](https://insights.sbomify.com/CVE-2022-3734/): Redis on Windows dbghelp.dll uncontrolled search path (medium 6.3)
- [CVE-2022-37339](https://insights.sbomify.com/CVE-2022-37339/): WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.1)
- [CVE-2022-37338](https://insights.sbomify.com/CVE-2022-37338/): Cross-site scripting in Blossom Recipe Maker (WordPress plugin) (medium 4.1)
- [CVE-2022-37337](https://insights.sbomify.com/CVE-2022-37337/): Command injection in Orbi Router RBR750 (critical 9.1)
- [CVE-2022-37336](https://insights.sbomify.com/CVE-2022-37336/): Privilege escalation in Intel(R) NUC (high 7.9)
- [CVE-2022-37335](https://insights.sbomify.com/CVE-2022-37335/): WordPress Word Search Puzzles game plugin <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-37334](https://insights.sbomify.com/CVE-2022-37334/): Privilege escalation in Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards (high 7.0)
- [CVE-2022-37333](https://insights.sbomify.com/CVE-2022-37333/): exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability (high 8.8)
- [CVE-2022-37332](https://insights.sbomify.com/CVE-2022-37332/): Use after free in Foxit Reader (high 8.8)
- [CVE-2022-37331](https://insights.sbomify.com/CVE-2022-37331/): Open Babel has out-of-bounds write in Gaussian coords_type orientation parser (high 7.3)
- [CVE-2022-37330](https://insights.sbomify.com/CVE-2022-37330/): WordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-3733](https://insights.sbomify.com/CVE-2022-3733/): SourceCodester Web-Based Student Clearance System edit-admin.php sql injection (medium 5.0)
- [CVE-2022-37329](https://insights.sbomify.com/CVE-2022-37329/): Privilege escalation in Intel(R) Quartus(R) Prime Pro and Standard Edition software (medium 6.7)
- [CVE-2022-37328](https://insights.sbomify.com/CVE-2022-37328/): WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2022-37327](https://insights.sbomify.com/CVE-2022-37327/): Information disclosure in Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged (medium 6.1)
- [CVE-2022-37326](https://insights.sbomify.com/CVE-2022-37326/): Privilege escalation in docker:desktop (high 7.8)
- [CVE-2022-37325](https://insights.sbomify.com/CVE-2022-37325/): Memory corruption in sangoma:asterisk (high 7.5)
- [CVE-2022-3732](https://insights.sbomify.com/CVE-2022-3732/): seccome Ehoney set sql injection (medium 6.3)
- [CVE-2022-37318](https://insights.sbomify.com/CVE-2022-37318/): Cross-site scripting in rsa:archer (high 7.0)
- [CVE-2022-37317](https://insights.sbomify.com/CVE-2022-37317/): Cross-site scripting in rsa:archer (high 7.6)
- [CVE-2022-37316](https://insights.sbomify.com/CVE-2022-37316/): Missing authorization in rsa:archer (medium 6.5)
- [CVE-2022-37315](https://insights.sbomify.com/CVE-2022-37315/): graphql-go has infinite recursion in the type definition parser (high 7.5)
- [CVE-2022-37313](https://insights.sbomify.com/CVE-2022-37313/): Server-side request forgery in open-xchange:open-xchange appsuite (medium 5.3)
- [CVE-2022-37312](https://insights.sbomify.com/CVE-2022-37312/): Denial of service in open-xchange:open-xchange appsuite (medium 5.3)
- [CVE-2022-37311](https://insights.sbomify.com/CVE-2022-37311/): Denial of service in open-xchange:open-xchange appsuite (medium 5.3)
- [CVE-2022-37310](https://insights.sbomify.com/CVE-2022-37310/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2022-3731](https://insights.sbomify.com/CVE-2022-3731/): seccome Ehoney token sql injection (medium 6.3)
- [CVE-2022-37309](https://insights.sbomify.com/CVE-2022-37309/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2022-37308](https://insights.sbomify.com/CVE-2022-37308/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2022-37307](https://insights.sbomify.com/CVE-2022-37307/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2022-37306](https://insights.sbomify.com/CVE-2022-37306/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2022-37305](https://insights.sbomify.com/CVE-2022-37305/): Auth bypass in honda:honda firmware (medium 6.4)
- [CVE-2022-37302](https://insights.sbomify.com/CVE-2022-37302/): Memory corruption in EcoStruxure Control Expert (medium 5.5)
- [CVE-2022-37301](https://insights.sbomify.com/CVE-2022-37301/): Integer overflow in Legacy Modicon Quantum/Premium (high 7.5)
- [CVE-2022-37300](https://insights.sbomify.com/CVE-2022-37300/): Auth bypass in EcoStruxure Control Expert (critical 9.8)
- [CVE-2022-3730](https://insights.sbomify.com/CVE-2022-3730/): seccome Ehoney falco sql injection (medium 6.3)
- [CVE-2022-37299](https://insights.sbomify.com/CVE-2022-37299/): Path traversal in shirne cms project:shirne cms (medium 6.5)
- [CVE-2022-37298](https://insights.sbomify.com/CVE-2022-37298/): Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control (critical 9.8)
- [CVE-2022-37292](https://insights.sbomify.com/CVE-2022-37292/): Memory corruption in tenda:ax12 firmware (medium 5.5)
- [CVE-2022-37290](https://insights.sbomify.com/CVE-2022-37290/): Null dereference in fedoraproject:fedora (medium 5.5)
- [CVE-2022-3729](https://insights.sbomify.com/CVE-2022-3729/): seccome Ehoney attack sql injection (medium 6.3)
- [CVE-2022-3728](https://insights.sbomify.com/CVE-2022-3728/): Security feature bypass in ThinkPad T14s Gen 3 BIOS (medium 6.1)
- [CVE-2022-37266](https://insights.sbomify.com/CVE-2022-37266/): steal vulnerable to Prototype Pollution via key variable in babel.js (critical 9.8)
- [CVE-2022-37265](https://insights.sbomify.com/CVE-2022-37265/): steal vulnerable to Prototype Pollution via alias variable (critical 9.8)
- [CVE-2022-37264](https://insights.sbomify.com/CVE-2022-37264/): steal vulnerable to Prototype Pollution via optionName variable (critical 9.8)
- [CVE-2022-37262](https://insights.sbomify.com/CVE-2022-37262/): steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments (high 7.5)
- [CVE-2022-37260](https://insights.sbomify.com/CVE-2022-37260/): steal vulnerable to Regular Expression Denial of Service via input variable (high 7.5)
- [CVE-2022-3726](https://insights.sbomify.com/CVE-2022-3726/): Cross-site scripting in GitLab (medium 4.8)
- [CVE-2022-37259](https://insights.sbomify.com/CVE-2022-37259/): steal Inefficient Regular Expression Complexity vulnerability via string variable (high 7.5)
- [CVE-2022-37258](https://insights.sbomify.com/CVE-2022-37258/): steal vulnerable to Prototype Pollution (critical 9.8)
- [CVE-2022-37257](https://insights.sbomify.com/CVE-2022-37257/): steal vulnerable to Prototype Pollution via requestedVersion variable (critical 9.8)
- [CVE-2022-37255](https://insights.sbomify.com/CVE-2022-37255/): Hardcoded credentials in tp-link:tapo c310 firmware (high 7.5)
- [CVE-2022-37254](https://insights.sbomify.com/CVE-2022-37254/): Cross-site scripting in dolphinphp project:dolphinphp (medium 5.4)
- [CVE-2022-37253](https://insights.sbomify.com/CVE-2022-37253/): Cross-site scripting in crime reporting system project:crime reporting system (medium 5.4)
- [CVE-2022-37251](https://insights.sbomify.com/CVE-2022-37251/): Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts (medium 5.4)
- [CVE-2022-37250](https://insights.sbomify.com/CVE-2022-37250/): Craft CMS Stored Cross-site Scripting in User Addresses Title (medium 5.4)
- [CVE-2022-3725](https://insights.sbomify.com/CVE-2022-3725/): Memory corruption in Wireshark (medium 6.3)
- [CVE-2022-37248](https://insights.sbomify.com/CVE-2022-37248/): Craft CMS Cross site Scripting vulnerability (medium 5.4)
- [CVE-2022-37247](https://insights.sbomify.com/CVE-2022-37247/): Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page (medium 5.4)
- [CVE-2022-37246](https://insights.sbomify.com/CVE-2022-37246/): Craft CMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2022-37245](https://insights.sbomify.com/CVE-2022-37245/): Cross-site scripting in altn:security gateway for email servers (medium 5.4)
- [CVE-2022-37244](https://insights.sbomify.com/CVE-2022-37244/): Cross-site scripting in altn:security gateway for email servers (medium 5.4)
- [CVE-2022-37243](https://insights.sbomify.com/CVE-2022-37243/): Cross-site scripting in altn:security gateway for email servers (medium 5.4)
- [CVE-2022-37242](https://insights.sbomify.com/CVE-2022-37242/): Other in altn:security gateway for email servers (critical 9.8)
- [CVE-2022-37241](https://insights.sbomify.com/CVE-2022-37241/): Cross-site scripting in altn:security gateway for email servers (medium 5.4)
- [CVE-2022-37240](https://insights.sbomify.com/CVE-2022-37240/): Other in altn:security gateway for email servers (critical 9.8)
- [CVE-2022-3724](https://insights.sbomify.com/CVE-2022-3724/): Denial of service in Wireshark (medium 6.3)
- [CVE-2022-37239](https://insights.sbomify.com/CVE-2022-37239/): Cross-site scripting in altn:security gateway for email servers (medium 5.4)
- [CVE-2022-37238](https://insights.sbomify.com/CVE-2022-37238/): Cross-site scripting in altn:security gateway for email servers (medium 5.4)
- [CVE-2022-37237](https://insights.sbomify.com/CVE-2022-37237/): Denial of service in zlmediakit:zlmediakit (high 7.5)
- [CVE-2022-37235](https://insights.sbomify.com/CVE-2022-37235/): Memory corruption in netgear:r7000 firmware (critical 9.8)
- [CVE-2022-37234](https://insights.sbomify.com/CVE-2022-37234/): Memory corruption in netgear:r7000 firmware (high 7.8)
- [CVE-2022-37232](https://insights.sbomify.com/CVE-2022-37232/): Memory corruption in netgear:wnr2000v4 firmware (critical 9.8)
- [CVE-2022-3723](https://insights.sbomify.com/CVE-2022-3723/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2022-37223](https://insights.sbomify.com/CVE-2022-37223/): SQL injection in jflyfox jfinal (critical 9.8)
- [CVE-2022-3721](https://insights.sbomify.com/CVE-2022-3721/): Code Injection in froxlor/froxlor (high 7.6)
- [CVE-2022-37209](https://insights.sbomify.com/CVE-2022-37209/): SQL injection in jflyfox:jfinal cms (high 8.8)
- [CVE-2022-37208](https://insights.sbomify.com/CVE-2022-37208/): SQL injection in jflyfox:jfinal cms (high 8.8)
- [CVE-2022-37207](https://insights.sbomify.com/CVE-2022-37207/): SQL injection in jflyfox:jfinal cms (high 8.8)
- [CVE-2022-37205](https://insights.sbomify.com/CVE-2022-37205/): SQL injection in jflyfox:jfinal cms (high 8.8)
- [CVE-2022-37204](https://insights.sbomify.com/CVE-2022-37204/): SQL injection in jflyfox:jfinal cms (critical 9.8)
- [CVE-2022-37203](https://insights.sbomify.com/CVE-2022-37203/): SQL injection in jflyfox:jfinal cms (critical 9.8)
- [CVE-2022-37202](https://insights.sbomify.com/CVE-2022-37202/): SQL injection in jflyfox:jfinal cms (high 8.8)
- [CVE-2022-37201](https://insights.sbomify.com/CVE-2022-37201/): SQL injection in jflyfox:jfinal cms (high 8.8)
- [CVE-2022-3720](https://insights.sbomify.com/CVE-2022-3720/): Event Monster < 1.2.1 - Admin+ SQLi (high 7.2)
- [CVE-2022-37199](https://insights.sbomify.com/CVE-2022-37199/): SQL injection in jflyfox jfinal (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/271/