# Vulnerabilities published in 2022


- [CVE-2022-37197](https://insights.sbomify.com/CVE-2022-37197/): Privilege escalation in iobit:iotransfer (high 7.8)
- [CVE-2022-37193](https://insights.sbomify.com/CVE-2022-37193/): Auth bypass in chipolo:chipolo (high 7.4)
- [CVE-2022-37191](https://insights.sbomify.com/CVE-2022-37191/): Path traversal in cuppacms:cuppacms (medium 6.5)
- [CVE-2022-37190](https://insights.sbomify.com/CVE-2022-37190/): Code injection in cuppacms:cuppacms (high 8.8)
- [CVE-2022-37189](https://insights.sbomify.com/CVE-2022-37189/): MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS) (high 7.5)
- [CVE-2022-37186](https://insights.sbomify.com/CVE-2022-37186/): Security feature bypass in lemonldap-ng:lemonldap\ (medium 5.9)
- [CVE-2022-37185](https://insights.sbomify.com/CVE-2022-37185/): SQL injection in ems project:ems (high 7.5)
- [CVE-2022-37184](https://insights.sbomify.com/CVE-2022-37184/): File upload in garage management system project:garage management system (high 8.8)
- [CVE-2022-37183](https://insights.sbomify.com/CVE-2022-37183/): Cross-site scripting in piwigo:piwigo (medium 6.1)
- [CVE-2022-37181](https://insights.sbomify.com/CVE-2022-37181/): File upload in 72crm:wukong crm (critical 9.8)
- [CVE-2022-37178](https://insights.sbomify.com/CVE-2022-37178/): SQL injection in 72crm:wukong crm (high 8.8)
- [CVE-2022-37177](https://insights.sbomify.com/CVE-2022-37177/): Weak cryptography in hirevue:hiring platform (high 7.5)
- [CVE-2022-37176](https://insights.sbomify.com/CVE-2022-37176/): Auth bypass in tendacn:ac6 firmware (critical 9.8)
- [CVE-2022-37175](https://insights.sbomify.com/CVE-2022-37175/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2022-37173](https://insights.sbomify.com/CVE-2022-37173/): Privilege escalation in vim:gvim (high 7.8)
- [CVE-2022-37172](https://insights.sbomify.com/CVE-2022-37172/): Misconfiguration in msys2:msys2 (high 7.8)
- [CVE-2022-37164](https://insights.sbomify.com/CVE-2022-37164/): Weak cryptography in ontrack project:ontrack (critical 9.8)
- [CVE-2022-37163](https://insights.sbomify.com/CVE-2022-37163/): Weak cryptography in ihatetobudget project:ihatetobudget (critical 9.8)
- [CVE-2022-37162](https://insights.sbomify.com/CVE-2022-37162/): Cross-site scripting in claroline:claroline (medium 5.4)
- [CVE-2022-37161](https://insights.sbomify.com/CVE-2022-37161/): Cross-site scripting in claroline:claroline (medium 6.1)
- [CVE-2022-37160](https://insights.sbomify.com/CVE-2022-37160/): Privilege escalation in claroline:claroline (medium 5.4)
- [CVE-2022-3716](https://insights.sbomify.com/CVE-2022-3716/): SourceCodester Online Medicine Ordering System cross site scripting (low 3.5)
- [CVE-2022-37159](https://insights.sbomify.com/CVE-2022-37159/): File upload in claroline:claroline (critical 9.8)
- [CVE-2022-37158](https://insights.sbomify.com/CVE-2022-37158/): Weak cryptography in iocoder:ruoyi-vue-pro (critical 9.8)
- [CVE-2022-37155](https://insights.sbomify.com/CVE-2022-37155/): Code injection in spip:spip (high 8.8)
- [CVE-2022-37153](https://insights.sbomify.com/CVE-2022-37153/): Cross-site scripting in articatech:artica proxy (medium 6.1)
- [CVE-2022-37152](https://insights.sbomify.com/CVE-2022-37152/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (critical 9.8)
- [CVE-2022-37151](https://insights.sbomify.com/CVE-2022-37151/): Missing authorization in online diagnostic lab management system project:online diagnostic lab management system (high 7.5)
- [CVE-2022-37150](https://insights.sbomify.com/CVE-2022-37150/): Cross-site scripting in online diagnostic lab management system project:online diagnostic lab management system (medium 5.4)
- [CVE-2022-3715](https://insights.sbomify.com/CVE-2022-3715/): Memory corruption in bash (high 7.8)
- [CVE-2022-37149](https://insights.sbomify.com/CVE-2022-37149/): Command injection in wavlink:wl-wn575a3 firmware (critical 9.8)
- [CVE-2022-37146](https://insights.sbomify.com/CVE-2022-37146/): Information disclosure in plextrac:plextrac (medium 5.3)
- [CVE-2022-37145](https://insights.sbomify.com/CVE-2022-37145/): Auth bypass in plextrac:plextrac (high 7.5)
- [CVE-2022-37144](https://insights.sbomify.com/CVE-2022-37144/): Auth bypass in plextrac:plextrac (high 8.8)
- [CVE-2022-37140](https://insights.sbomify.com/CVE-2022-37140/): File upload in techvill:paymoney (high 8.0)
- [CVE-2022-3714](https://insights.sbomify.com/CVE-2022-3714/): SourceCodester Online Medicine Ordering System sql injection (medium 5.0)
- [CVE-2022-37139](https://insights.sbomify.com/CVE-2022-37139/): Cross-site scripting in razormist:loan management system (medium 5.4)
- [CVE-2022-37138](https://insights.sbomify.com/CVE-2022-37138/): SQL injection in razormist:loan management system (critical 9.8)
- [CVE-2022-37137](https://insights.sbomify.com/CVE-2022-37137/): Cross-site scripting in techvill:paymoney (medium 5.4)
- [CVE-2022-37134](https://insights.sbomify.com/CVE-2022-37134/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-37133](https://insights.sbomify.com/CVE-2022-37133/): Missing authorization in dlink:dir-816 firmware (high 7.5)
- [CVE-2022-37130](https://insights.sbomify.com/CVE-2022-37130/): Command injection in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-3713](https://insights.sbomify.com/CVE-2022-3713/): Code injection in Sophos Firewall (high 8.8)
- [CVE-2022-37129](https://insights.sbomify.com/CVE-2022-37129/): Command injection in dlink:dir-816 firmware (high 8.8)
- [CVE-2022-37128](https://insights.sbomify.com/CVE-2022-37128/): Auth bypass in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-37125](https://insights.sbomify.com/CVE-2022-37125/): Command injection in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-37123](https://insights.sbomify.com/CVE-2022-37123/): Command injection in dlink:dir-816 firmware (high 8.8)
- [CVE-2022-37122](https://insights.sbomify.com/CVE-2022-37122/): Path traversal in carel:applica (high 7.5)
- [CVE-2022-37113](https://insights.sbomify.com/CVE-2022-37113/): SQL injection in bluecms project:bluecms (critical 9.8)
- [CVE-2022-37112](https://insights.sbomify.com/CVE-2022-37112/): SQL injection in bluecms project:bluecms (critical 9.8)
- [CVE-2022-37111](https://insights.sbomify.com/CVE-2022-37111/): SQL injection in bluecms project:bluecms (critical 9.8)
- [CVE-2022-3711](https://insights.sbomify.com/CVE-2022-3711/): SQL injection in Sophos Firewall (medium 4.3)
- [CVE-2022-37109](https://insights.sbomify.com/CVE-2022-37109/): Auth bypass in camp project:camp (critical 9.8)
- [CVE-2022-37108](https://insights.sbomify.com/CVE-2022-37108/): Code injection in securonix:snypr (high 8.7)
- [CVE-2022-37100](https://insights.sbomify.com/CVE-2022-37100/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-3710](https://insights.sbomify.com/CVE-2022-3710/): SQL injection in Sophos Firewall (low 2.7)
- [CVE-2022-37099](https://insights.sbomify.com/CVE-2022-37099/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37098](https://insights.sbomify.com/CVE-2022-37098/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37097](https://insights.sbomify.com/CVE-2022-37097/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37096](https://insights.sbomify.com/CVE-2022-37096/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37095](https://insights.sbomify.com/CVE-2022-37095/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37094](https://insights.sbomify.com/CVE-2022-37094/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37093](https://insights.sbomify.com/CVE-2022-37093/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37092](https://insights.sbomify.com/CVE-2022-37092/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37091](https://insights.sbomify.com/CVE-2022-37091/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37090](https://insights.sbomify.com/CVE-2022-37090/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-3709](https://insights.sbomify.com/CVE-2022-3709/): Cross-site scripting in Sophos Firewall (medium 6.8)
- [CVE-2022-37089](https://insights.sbomify.com/CVE-2022-37089/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37088](https://insights.sbomify.com/CVE-2022-37088/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37087](https://insights.sbomify.com/CVE-2022-37087/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37086](https://insights.sbomify.com/CVE-2022-37086/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37085](https://insights.sbomify.com/CVE-2022-37085/): Memory corruption in h3c:h200 firmware (critical 9.8)
- [CVE-2022-37084](https://insights.sbomify.com/CVE-2022-37084/): Memory corruption in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37083](https://insights.sbomify.com/CVE-2022-37083/): Command injection in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37082](https://insights.sbomify.com/CVE-2022-37082/): Command injection in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37081](https://insights.sbomify.com/CVE-2022-37081/): Command injection in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37080](https://insights.sbomify.com/CVE-2022-37080/): Memory corruption in totolink:a7000r firmware (high 7.8)
- [CVE-2022-3708](https://insights.sbomify.com/CVE-2022-3708/): Web Stories <= 1.24.0 - Server Side Request Forgery (critical 9.6)
- [CVE-2022-37079](https://insights.sbomify.com/CVE-2022-37079/): Command injection in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37078](https://insights.sbomify.com/CVE-2022-37078/): Command injection in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37077](https://insights.sbomify.com/CVE-2022-37077/): Memory corruption in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37076](https://insights.sbomify.com/CVE-2022-37076/): Command injection in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37075](https://insights.sbomify.com/CVE-2022-37075/): Memory corruption in totolink:a7000r firmware (high 7.8)
- [CVE-2022-37074](https://insights.sbomify.com/CVE-2022-37074/): Memory corruption in h3c:gr-1200w firmware (high 7.8)
- [CVE-2022-37073](https://insights.sbomify.com/CVE-2022-37073/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37072](https://insights.sbomify.com/CVE-2022-37072/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37071](https://insights.sbomify.com/CVE-2022-37071/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37070](https://insights.sbomify.com/CVE-2022-37070/): Command injection in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-3707](https://insights.sbomify.com/CVE-2022-3707/): Memory corruption in kernel (medium 5.5)
- [CVE-2022-37069](https://insights.sbomify.com/CVE-2022-37069/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37068](https://insights.sbomify.com/CVE-2022-37068/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37067](https://insights.sbomify.com/CVE-2022-37067/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37066](https://insights.sbomify.com/CVE-2022-37066/): Memory corruption in h3c:gr-1200w firmware (critical 9.8)
- [CVE-2022-37063](https://insights.sbomify.com/CVE-2022-37063/): Cross-site scripting in flir:flir ax8 firmware (medium 5.4)
- [CVE-2022-37062](https://insights.sbomify.com/CVE-2022-37062/): Missing authorization in flir:flir ax8 firmware (high 7.5)
- [CVE-2022-37061](https://insights.sbomify.com/CVE-2022-37061/): Command injection in flir:flir ax8 firmware (critical 9.8)
- [CVE-2022-37060](https://insights.sbomify.com/CVE-2022-37060/): Path traversal in flir:flir ax8 firmware (high 7.5)
- [CVE-2022-3706](https://insights.sbomify.com/CVE-2022-3706/): Missing authorization in GitLab (low 3.1)
- [CVE-2022-37059](https://insights.sbomify.com/CVE-2022-37059/): Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel (medium 4.8)
- [CVE-2022-37057](https://insights.sbomify.com/CVE-2022-37057/): Command injection in dlink:go-rt-ac750 firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/272/