# Vulnerabilities published in 2022


- [CVE-2022-36853](https://insights.sbomify.com/CVE-2022-36853/): Information disclosure in Samsung Mobile Devices (low 3.3)
- [CVE-2022-36852](https://insights.sbomify.com/CVE-2022-36852/): Missing authorization in Samsung Mobile Devices (low 1.9)
- [CVE-2022-36851](https://insights.sbomify.com/CVE-2022-36851/): Missing authorization in Samsung pass (low 3.9)
- [CVE-2022-36850](https://insights.sbomify.com/CVE-2022-36850/): Path traversal in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-3685](https://insights.sbomify.com/CVE-2022-3685/): SDM600 software privilege level (high 7.5)
- [CVE-2022-36849](https://insights.sbomify.com/CVE-2022-36849/): Use after free in Samsung Mobile Devices (medium 4.9)
- [CVE-2022-36848](https://insights.sbomify.com/CVE-2022-36848/): Missing authorization in Samsung Mobile Devices (medium 5.1)
- [CVE-2022-36847](https://insights.sbomify.com/CVE-2022-36847/): Use after free in Samsung Mobile Devices (medium 4.9)
- [CVE-2022-36846](https://insights.sbomify.com/CVE-2022-36846/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36845](https://insights.sbomify.com/CVE-2022-36845/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36844](https://insights.sbomify.com/CVE-2022-36844/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36843](https://insights.sbomify.com/CVE-2022-36843/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36842](https://insights.sbomify.com/CVE-2022-36842/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36841](https://insights.sbomify.com/CVE-2022-36841/): Memory corruption in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-36840](https://insights.sbomify.com/CVE-2022-36840/): Other in Samsung Update Setup (medium 4.5)
- [CVE-2022-3684](https://insights.sbomify.com/CVE-2022-3684/): SDM600 endpoint vulnerability (high 7.5)
- [CVE-2022-36839](https://insights.sbomify.com/CVE-2022-36839/): SQL injection in Samsung Checkout (medium 5.9)
- [CVE-2022-36838](https://insights.sbomify.com/CVE-2022-36838/): Information disclosure in Galaxy Wearable (medium 4.0)
- [CVE-2022-36837](https://insights.sbomify.com/CVE-2022-36837/): Information disclosure in Samsung email (medium 6.2)
- [CVE-2022-36836](https://insights.sbomify.com/CVE-2022-36836/): Missing authorization in Charm by Samsung (medium 6.2)
- [CVE-2022-36835](https://insights.sbomify.com/CVE-2022-36835/): Information disclosure in Samsung Internet Browser (low 3.3)
- [CVE-2022-36834](https://insights.sbomify.com/CVE-2022-36834/): Information disclosure in Game Launcher (low 3.3)
- [CVE-2022-36833](https://insights.sbomify.com/CVE-2022-36833/): Privilege escalation in Game Optimizing Service (high 7.3)
- [CVE-2022-36832](https://insights.sbomify.com/CVE-2022-36832/): Missing authorization in Cameralyzer (medium 4.0)
- [CVE-2022-36831](https://insights.sbomify.com/CVE-2022-36831/): Path traversal in Samsung notes (medium 6.2)
- [CVE-2022-36830](https://insights.sbomify.com/CVE-2022-36830/): Missing authorization in Charm by Samsung (medium 6.2)
- [CVE-2022-3683](https://insights.sbomify.com/CVE-2022-3683/): SDM600 API web services authorization validation (high 7.7)
- [CVE-2022-36829](https://insights.sbomify.com/CVE-2022-36829/): Missing authorization in Charm by Samsung (medium 6.2)
- [CVE-2022-3682](https://insights.sbomify.com/CVE-2022-3682/): SDM600 file permission validation (critical 9.9)
- [CVE-2022-3681](https://insights.sbomify.com/CVE-2022-3681/): Auth bypass in MR2600 Router (medium 6.5)
- [CVE-2022-36804](https://insights.sbomify.com/CVE-2022-36804/): Atlassian Bitbucket Server and Data Center Command Injection (high 8.8, exploited in the wild)
- [CVE-2022-36803](https://insights.sbomify.com/CVE-2022-36803/): Privilege escalation in Jira Align (high 8.8)
- [CVE-2022-36802](https://insights.sbomify.com/CVE-2022-36802/): Server-side request forgery in Jira Align (medium 4.9)
- [CVE-2022-36801](https://insights.sbomify.com/CVE-2022-36801/): Cross-site scripting in Jira Data Center (medium 6.1)
- [CVE-2022-36800](https://insights.sbomify.com/CVE-2022-36800/): Missing authorization in Jira Service Management Data Center (medium 4.3)
- [CVE-2022-36799](https://insights.sbomify.com/CVE-2022-36799/): Code injection in Jira Data Center (high 7.2)
- [CVE-2022-36798](https://insights.sbomify.com/CVE-2022-36798/): WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-36797](https://insights.sbomify.com/CVE-2022-36797/): Denial of service in Intel(R) Ethernet 500 Series Controller drivers for VMware (low 3.3)
- [CVE-2022-36796](https://insights.sbomify.com/CVE-2022-36796/): Cross-site request forgery in CallRail Phone Call Tracking (WordPress plugin) (medium 6.1)
- [CVE-2022-36795](https://insights.sbomify.com/CVE-2022-36795/): BIG-IP software SYN cookies vulnerability CVE-2022-36795 (medium 5.3)
- [CVE-2022-36794](https://insights.sbomify.com/CVE-2022-36794/): Denial of service in Intel(R) SPS firmware (medium 6.0)
- [CVE-2022-36793](https://insights.sbomify.com/CVE-2022-36793/): WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities (medium 6.5)
- [CVE-2022-36791](https://insights.sbomify.com/CVE-2022-36791/): WordPress Torro Forms plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-3679](https://insights.sbomify.com/CVE-2022-3679/): Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection (high 8.8)
- [CVE-2022-36789](https://insights.sbomify.com/CVE-2022-36789/): Privilege escalation in Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs (high 7.5)
- [CVE-2022-36788](https://insights.sbomify.com/CVE-2022-36788/): Memory corruption in libslic3r (high 8.1)
- [CVE-2022-36787](https://insights.sbomify.com/CVE-2022-36787/): webvendome - webvendome SQL Injection (critical 9.8)
- [CVE-2022-36786](https://insights.sbomify.com/CVE-2022-36786/): DLINK - DSL-224 Post-auth RCE. (critical 9.9)
- [CVE-2022-36785](https://insights.sbomify.com/CVE-2022-36785/): D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. (high 7.5)
- [CVE-2022-36784](https://insights.sbomify.com/CVE-2022-36784/): Elsight – Elsight Halo Remote Code Execution (RCE) (critical 9.8)
- [CVE-2022-36783](https://insights.sbomify.com/CVE-2022-36783/): AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) (medium 6.5)
- [CVE-2022-36782](https://insights.sbomify.com/CVE-2022-36782/): Pal Electronics Systems - Pal Gate Authorization Errors (medium 5.9)
- [CVE-2022-36781](https://insights.sbomify.com/CVE-2022-36781/): ConnectWise - ScreenConnect Session Code Bypass (medium 5.3)
- [CVE-2022-36780](https://insights.sbomify.com/CVE-2022-36780/): Avdor CIS - crystal quality Credentials Management Errors (medium 4.9)
- [CVE-2022-36779](https://insights.sbomify.com/CVE-2022-36779/): PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection (medium 6.5)
- [CVE-2022-36778](https://insights.sbomify.com/CVE-2022-36778/): Synel - eHarmony Stored XSS (medium 6.5)
- [CVE-2022-36777](https://insights.sbomify.com/CVE-2022-36777/): IBM Cloud Pak for Security information disclosure (medium 4.3)
- [CVE-2022-36776](https://insights.sbomify.com/CVE-2022-36776/): Cross-site scripting in Cloud Pak for Security (medium 5.4)
- [CVE-2022-36775](https://insights.sbomify.com/CVE-2022-36775/): IBM Security Verify Access HOST header injection (medium 6.5)
- [CVE-2022-36774](https://insights.sbomify.com/CVE-2022-36774/): Other in Robotic Process Automation (medium 6.5)
- [CVE-2022-36773](https://insights.sbomify.com/CVE-2022-36773/): XML external entity in Cognos Analytics (high 7.1)
- [CVE-2022-36772](https://insights.sbomify.com/CVE-2022-36772/): Information disclosure in InfoSphere Information Server (medium 4.3)
- [CVE-2022-36771](https://insights.sbomify.com/CVE-2022-36771/): Missing authorization in QRadar User Behavior Analytics (medium 4.3)
- [CVE-2022-3677](https://insights.sbomify.com/CVE-2022-3677/): Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF (medium 6.5)
- [CVE-2022-36769](https://insights.sbomify.com/CVE-2022-36769/): IBM Cloud Pak for Data file upload (high 7.2)
- [CVE-2022-36768](https://insights.sbomify.com/CVE-2022-36768/): Privilege escalation in AIX (high 8.4)
- [CVE-2022-36765](https://insights.sbomify.com/CVE-2022-36765/): Integer Overflow in CreateHob (high 7.0)
- [CVE-2022-36764](https://insights.sbomify.com/CVE-2022-36764/): Heap Buffer Overflow in Tcg2MeasurePeImage (high 7.0)
- [CVE-2022-36763](https://insights.sbomify.com/CVE-2022-36763/): Heap Buffer Overflow in Tcg2MeasureGptTable (high 7.0)
- [CVE-2022-36760](https://insights.sbomify.com/CVE-2022-36760/): Apache HTTP Server: mod_proxy_ajp Possible request smuggling (critical 9.0)
- [CVE-2022-3676](https://insights.sbomify.com/CVE-2022-3676/): Memory corruption in Eclipse OpenJ9 (medium 6.5)
- [CVE-2022-36759](https://insights.sbomify.com/CVE-2022-36759/): SQL injection in oretnom23:online food ordering system (critical 9.8)
- [CVE-2022-36756](https://insights.sbomify.com/CVE-2022-36756/): Command injection in dlink:dir-845l firmware (critical 9.8)
- [CVE-2022-36755](https://insights.sbomify.com/CVE-2022-36755/): Auth bypass in dlink:dir-845l firmware (critical 9.8)
- [CVE-2022-36754](https://insights.sbomify.com/CVE-2022-36754/): SQL injection in oretnom23:expense management system (high 7.2)
- [CVE-2022-36752](https://insights.sbomify.com/CVE-2022-36752/): Memory corruption in png2webp project:png2webp (medium 5.5)
- [CVE-2022-36750](https://insights.sbomify.com/CVE-2022-36750/): SQL injection in oretnom23:clinic\'s patient management system (critical 9.8)
- [CVE-2022-3675](https://insights.sbomify.com/CVE-2022-3675/): Auth bypass in CoreOS (low 2.6)
- [CVE-2022-36749](https://insights.sbomify.com/CVE-2022-36749/): Command injection in sourcefabric:rpi-jukebox-rfid (critical 9.8)
- [CVE-2022-36748](https://insights.sbomify.com/CVE-2022-36748/): Cross-site scripting in picuploader project:picuploader (medium 6.1)
- [CVE-2022-36747](https://insights.sbomify.com/CVE-2022-36747/): Cross-site scripting in cobub:razor (medium 6.1)
- [CVE-2022-36746](https://insights.sbomify.com/CVE-2022-36746/): LibreNMS vulnerable to Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-36745](https://insights.sbomify.com/CVE-2022-36745/): LibreNMS vulnerable to Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-3674](https://insights.sbomify.com/CVE-2022-3674/): SourceCodester Sanitization Management System missing authentication (high 7.3)
- [CVE-2022-36736](https://insights.sbomify.com/CVE-2022-36736/): Other in jitsi:jitsi (medium 6.1)
- [CVE-2022-36735](https://insights.sbomify.com/CVE-2022-36735/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36734](https://insights.sbomify.com/CVE-2022-36734/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36733](https://insights.sbomify.com/CVE-2022-36733/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36732](https://insights.sbomify.com/CVE-2022-36732/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36731](https://insights.sbomify.com/CVE-2022-36731/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36730](https://insights.sbomify.com/CVE-2022-36730/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-3673](https://insights.sbomify.com/CVE-2022-3673/): SourceCodester Sanitization Management System Master.php cross site scripting (low 3.5)
- [CVE-2022-36729](https://insights.sbomify.com/CVE-2022-36729/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36728](https://insights.sbomify.com/CVE-2022-36728/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36727](https://insights.sbomify.com/CVE-2022-36727/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36725](https://insights.sbomify.com/CVE-2022-36725/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36722](https://insights.sbomify.com/CVE-2022-36722/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2022-36721](https://insights.sbomify.com/CVE-2022-36721/): SQL injection in library management system project:library management system (high 8.8)
- [CVE-2022-36720](https://insights.sbomify.com/CVE-2022-36720/): SQL injection in library management system project:library management system (high 8.8)
- [CVE-2022-3672](https://insights.sbomify.com/CVE-2022-3672/): SourceCodester Sanitization Management System SystemSettings.php cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/275/