# Vulnerabilities published in 2022


- [CVE-2022-36954](https://insights.sbomify.com/CVE-2022-36954/): Missing authorization in veritas:netbackup (critical 9.9)
- [CVE-2022-36953](https://insights.sbomify.com/CVE-2022-36953/): Information disclosure in veritas:netbackup (medium 4.3)
- [CVE-2022-36952](https://insights.sbomify.com/CVE-2022-36952/): Hardcoded credentials in veritas:netbackup (high 8.4)
- [CVE-2022-36951](https://insights.sbomify.com/CVE-2022-36951/): Other in veritas:netbackup (critical 9.8)
- [CVE-2022-36950](https://insights.sbomify.com/CVE-2022-36950/): Code injection in veritas:netbackup (critical 9.8)
- [CVE-2022-3695](https://insights.sbomify.com/CVE-2022-3695/): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (medium 6.5)
- [CVE-2022-36949](https://insights.sbomify.com/CVE-2022-36949/): Privilege escalation in veritas:netbackup (critical 9.3)
- [CVE-2022-36948](https://insights.sbomify.com/CVE-2022-36948/): Cross-site scripting in veritas:netbackup (medium 5.4)
- [CVE-2022-36947](https://insights.sbomify.com/CVE-2022-36947/): Memory corruption in faststone:image viewer (critical 9.8)
- [CVE-2022-36946](https://insights.sbomify.com/CVE-2022-36946/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2022-36945](https://insights.sbomify.com/CVE-2022-36945/): Auth bypass in mazda:mazda firmware (medium 6.4)
- [CVE-2022-36944](https://insights.sbomify.com/CVE-2022-36944/): Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization (critical 9.8)
- [CVE-2022-36943](https://insights.sbomify.com/CVE-2022-36943/): Path traversal in SSZipArchive (high 8.1)
- [CVE-2022-3694](https://insights.sbomify.com/CVE-2022-3694/): Syncee - Global Dropshipping < 1.0.10 - Authentication Token Disclosure (high 7.5)
- [CVE-2022-36938](https://insights.sbomify.com/CVE-2022-36938/): Memory corruption in Redex (critical 9.8)
- [CVE-2022-36937](https://insights.sbomify.com/CVE-2022-36937/): Weak cryptography in HHVM (critical 9.8)
- [CVE-2022-36934](https://insights.sbomify.com/CVE-2022-36934/): Integer overflow in WhatsApp Business for Android (critical 9.8)
- [CVE-2022-36930](https://insights.sbomify.com/CVE-2022-36930/): Local Privilege Escalation in Zoom Rooms for Windows Installers (high 8.8)
- [CVE-2022-3693](https://insights.sbomify.com/CVE-2022-3693/): Path traversal in FileOrbis File Management System (high 7.5)
- [CVE-2022-36929](https://insights.sbomify.com/CVE-2022-36929/): Local Privilege Escalation in Zoom Rooms for Windows Clients (high 7.8)
- [CVE-2022-36928](https://insights.sbomify.com/CVE-2022-36928/): Path Traversal in Zoom for Android Clients (medium 6.1)
- [CVE-2022-36927](https://insights.sbomify.com/CVE-2022-36927/): Local Privilege Escalation in Zoom Rooms for macOS Clients (high 8.8)
- [CVE-2022-36926](https://insights.sbomify.com/CVE-2022-36926/): Local Privilege Escalation in Zoom Rooms for macOS Clients (high 8.8)
- [CVE-2022-36925](https://insights.sbomify.com/CVE-2022-36925/): Insecure key generation for Zoom Rooms for macOS Clients (medium 4.4)
- [CVE-2022-36924](https://insights.sbomify.com/CVE-2022-36924/): Local Privilege Escalation in Zoom Rooms Installer for Windows (high 8.8)
- [CVE-2022-36923](https://insights.sbomify.com/CVE-2022-36923/): Information disclosure in zohocorp:manageengine firewall analyzer (medium 5.4)
- [CVE-2022-36922](https://insights.sbomify.com/CVE-2022-36922/): Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting (medium 6.1)
- [CVE-2022-36921](https://insights.sbomify.com/CVE-2022-36921/): Missing permission check in Coverity Plugin allows capturing credentials (high 8.1)
- [CVE-2022-36920](https://insights.sbomify.com/CVE-2022-36920/): Jenkins Coverity Plugin vulnerable to cross-site request forgery (CSRF) (high 8.8)
- [CVE-2022-36919](https://insights.sbomify.com/CVE-2022-36919/): Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs (medium 4.3)
- [CVE-2022-36918](https://insights.sbomify.com/CVE-2022-36918/): Jenkins Buckminster Plugin does not perform a permission check in a method implementing form validation (medium 4.3)
- [CVE-2022-36917](https://insights.sbomify.com/CVE-2022-36917/): Jenkins Google Cloud Backup Plugin allows attackers with Overall/Read permission to request a manual backup. (medium 4.3)
- [CVE-2022-36916](https://insights.sbomify.com/CVE-2022-36916/): CSRF vulnerability in Jenkins Google Cloud Backup Plugin (high 8.0)
- [CVE-2022-36915](https://insights.sbomify.com/CVE-2022-36915/): Jenkins Android Signing Plugin allows attackers to check whether attacker-specified file patterns match workspace contents (medium 4.3)
- [CVE-2022-36914](https://insights.sbomify.com/CVE-2022-36914/): Jenkins Files Found Trigger Plugin allows attackers to check for existence of attacker-specified file path on Jenkins controller file system (medium 4.3)
- [CVE-2022-36913](https://insights.sbomify.com/CVE-2022-36913/): Jenkins Openstack Heat Plugin does not perform permission checks in methods implementing form validation (medium 4.3)
- [CVE-2022-36912](https://insights.sbomify.com/CVE-2022-36912/): Missing permission checks in Jenkins openstack-heat Plugin (medium 4.3)
- [CVE-2022-36911](https://insights.sbomify.com/CVE-2022-36911/): CSRF vulnerability in Jenkins openstack-heat Plugin (medium 6.5)
- [CVE-2022-36910](https://insights.sbomify.com/CVE-2022-36910/): Lucene-Search Plugin does not perform permission checks in several HTTP endpoints (medium 5.4)
- [CVE-2022-3691](https://insights.sbomify.com/CVE-2022-3691/): DeepL Pro API Translation < 1.7.5 - API Key Disclosure (high 7.5)
- [CVE-2022-36909](https://insights.sbomify.com/CVE-2022-36909/): Missing permission check in Jenkins OpenShift Deployer Plugin (medium 6.5)
- [CVE-2022-36908](https://insights.sbomify.com/CVE-2022-36908/): CSRF vulnerability in Jenkins OpenShift Deployer Plugin (medium 6.5)
- [CVE-2022-36907](https://insights.sbomify.com/CVE-2022-36907/): Missing permission check in Jenkins OpenShift Deployer Plugin (medium 6.5)
- [CVE-2022-36906](https://insights.sbomify.com/CVE-2022-36906/): CSRF vulnerability in Jenkins OpenShift Deployer Plugin (medium 6.5)
- [CVE-2022-36905](https://insights.sbomify.com/CVE-2022-36905/): Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin (medium 5.4)
- [CVE-2022-36904](https://insights.sbomify.com/CVE-2022-36904/): Jenkins Repository Connector Plugin does not perform a permission check in a method implementing form validation (medium 4.3)
- [CVE-2022-36903](https://insights.sbomify.com/CVE-2022-36903/): Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs (medium 4.3)
- [CVE-2022-36902](https://insights.sbomify.com/CVE-2022-36902/): Stored XSS vulnerability in Jenkins Dynamic Extended Choice Parameter plugin (medium 5.4)
- [CVE-2022-36901](https://insights.sbomify.com/CVE-2022-36901/): Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted (medium 6.5)
- [CVE-2022-36900](https://insights.sbomify.com/CVE-2022-36900/): Jenkins Compuware zAdviser API Plugin vulnerable to protection mechanism failure (high 8.2)
- [CVE-2022-3690](https://insights.sbomify.com/CVE-2022-3690/): Popup Maker < 1.16.11 - Contributor+ Stored Cross Site Scripting (medium 5.5)
- [CVE-2022-36899](https://insights.sbomify.com/CVE-2022-36899/): Agent-to-controller security bypass in Jenkins BMC Compuware ISPW Operations plugin (high 8.2)
- [CVE-2022-36898](https://insights.sbomify.com/CVE-2022-36898/): Jenkins Compuware ISPW Operations Plugin does not perform permission checks in several HTTP endpoints (medium 4.3)
- [CVE-2022-36897](https://insights.sbomify.com/CVE-2022-36897/): Jenkins Compuware Xpediter Code Coverage Plugin Missing Authorization (medium 4.3)
- [CVE-2022-36896](https://insights.sbomify.com/CVE-2022-36896/): Jenkins Compuware Source Code Download is missing authorization (medium 6.5)
- [CVE-2022-36895](https://insights.sbomify.com/CVE-2022-36895/): Jenkins Compuware Topaz Utilities Plugin is missing authorization (medium 4.3)
- [CVE-2022-36894](https://insights.sbomify.com/CVE-2022-36894/): Arbitrary file write vulnerability in Jenkins CLIF Performance Testing plugin (medium 6.5)
- [CVE-2022-36893](https://insights.sbomify.com/CVE-2022-36893/): Jenkins rpmsign-plugin does not perform a permission check in a method implementing form validation (medium 4.3)
- [CVE-2022-36892](https://insights.sbomify.com/CVE-2022-36892/): Jenkins rhnpush-plugin does not perform a permission check in a method implementing form validation (medium 4.3)
- [CVE-2022-36891](https://insights.sbomify.com/CVE-2022-36891/): Jenkins Deployer Framework Plugin allows attackers with Item/Read permission to read deployment logs (medium 4.3)
- [CVE-2022-36890](https://insights.sbomify.com/CVE-2022-36890/): Jenkins Deployer Framework Plugin vulnerable to Path Traversal (medium 4.3)
- [CVE-2022-3689](https://insights.sbomify.com/CVE-2022-3689/): HTML Forms < 1.3.25 - Admin+ SQLi (high 7.2)
- [CVE-2022-36889](https://insights.sbomify.com/CVE-2022-36889/): Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment (high 8.8)
- [CVE-2022-36888](https://insights.sbomify.com/CVE-2022-36888/): Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests (medium 6.5)
- [CVE-2022-36887](https://insights.sbomify.com/CVE-2022-36887/): Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints (medium 4.3)
- [CVE-2022-36886](https://insights.sbomify.com/CVE-2022-36886/): External Monitor Job Type Plugin does not require POST requests for an HTTP endpoint (medium 4.3)
- [CVE-2022-36885](https://insights.sbomify.com/CVE-2022-36885/): Jenkins GitHub plugin uses weak webhook signature function (medium 5.3)
- [CVE-2022-36884](https://insights.sbomify.com/CVE-2022-36884/): Lack of authentication mechanism in Jenkins Git Plugin webhook (medium 5.3)
- [CVE-2022-36883](https://insights.sbomify.com/CVE-2022-36883/): Lack of authentication mechanism in Jenkins Git Plugin webhook (high 7.5)
- [CVE-2022-36882](https://insights.sbomify.com/CVE-2022-36882/): Lack of authentication mechanism in Jenkins Git Plugin webhook (high 8.8)
- [CVE-2022-36881](https://insights.sbomify.com/CVE-2022-36881/): Jenkins Git client plugin 3.11.0 does not perform SSH host key verification (high 8.1)
- [CVE-2022-36880](https://insights.sbomify.com/CVE-2022-36880/): Cross-site scripting in webmin:usermin (medium 6.1)
- [CVE-2022-3688](https://insights.sbomify.com/CVE-2022-3688/): WPQA < 5.9 - Follow/Unfollow via CSRF (high 8.8)
- [CVE-2022-36879](https://insights.sbomify.com/CVE-2022-36879/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-36878](https://insights.sbomify.com/CVE-2022-36878/): Information disclosure in Find My Mobile (low 3.3)
- [CVE-2022-36877](https://insights.sbomify.com/CVE-2022-36877/): Information disclosure in Samsung Members (low 2.8)
- [CVE-2022-36876](https://insights.sbomify.com/CVE-2022-36876/): Missing authorization in Samsung Pass (low 1.8)
- [CVE-2022-36875](https://insights.sbomify.com/CVE-2022-36875/): Missing authorization in com.samsung.android.waterplugin (medium 6.6)
- [CVE-2022-36874](https://insights.sbomify.com/CVE-2022-36874/): Missing authorization in Waterplugin (medium 5.9)
- [CVE-2022-36873](https://insights.sbomify.com/CVE-2022-36873/): Information disclosure in com.samsung.android.waterplugin (medium 5.9)
- [CVE-2022-36872](https://insights.sbomify.com/CVE-2022-36872/): Missing authorization in Samsung Pay (medium 5.0)
- [CVE-2022-36871](https://insights.sbomify.com/CVE-2022-36871/): Missing authorization in Samsung Pay (medium 5.0)
- [CVE-2022-36870](https://insights.sbomify.com/CVE-2022-36870/): Missing authorization in Samsung Pay (medium 5.0)
- [CVE-2022-36869](https://insights.sbomify.com/CVE-2022-36869/): Missing authorization in com.android.providers.contacts (medium 6.6)
- [CVE-2022-36868](https://insights.sbomify.com/CVE-2022-36868/): Information disclosure in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-36867](https://insights.sbomify.com/CVE-2022-36867/): Missing authorization in Editor Lite (medium 5.9)
- [CVE-2022-36866](https://insights.sbomify.com/CVE-2022-36866/): Missing authorization in Group Sharing (medium 4.0)
- [CVE-2022-36865](https://insights.sbomify.com/CVE-2022-36865/): Missing authorization in Group Sharing (medium 4.0)
- [CVE-2022-36864](https://insights.sbomify.com/CVE-2022-36864/): Missing authorization in Samsung Email (medium 4.0)
- [CVE-2022-36863](https://insights.sbomify.com/CVE-2022-36863/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36862](https://insights.sbomify.com/CVE-2022-36862/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36861](https://insights.sbomify.com/CVE-2022-36861/): Privilege escalation in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-36860](https://insights.sbomify.com/CVE-2022-36860/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-3686](https://insights.sbomify.com/CVE-2022-3686/): SDM600 API permission check (medium 4.8)
- [CVE-2022-36859](https://insights.sbomify.com/CVE-2022-36859/): Cross-site scripting in SmartTagPlugin (medium 5.7)
- [CVE-2022-36858](https://insights.sbomify.com/CVE-2022-36858/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36857](https://insights.sbomify.com/CVE-2022-36857/): Missing authorization in Samsung Mobile Devices (low 1.9)
- [CVE-2022-36856](https://insights.sbomify.com/CVE-2022-36856/): Missing authorization in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-36855](https://insights.sbomify.com/CVE-2022-36855/): Use after free in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36854](https://insights.sbomify.com/CVE-2022-36854/): Memory corruption in Samsung Mobile Devices (medium 4.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/274/