# Vulnerabilities published in 2022


- [CVE-2022-36480](https://insights.sbomify.com/CVE-2022-36480/): Memory corruption in totolink:n350rt firmware (high 7.8)
- [CVE-2022-36479](https://insights.sbomify.com/CVE-2022-36479/): Command injection in totolink:n350rt firmware (high 7.8)
- [CVE-2022-36478](https://insights.sbomify.com/CVE-2022-36478/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36477](https://insights.sbomify.com/CVE-2022-36477/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36475](https://insights.sbomify.com/CVE-2022-36475/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36474](https://insights.sbomify.com/CVE-2022-36474/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36473](https://insights.sbomify.com/CVE-2022-36473/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36472](https://insights.sbomify.com/CVE-2022-36472/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36471](https://insights.sbomify.com/CVE-2022-36471/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36470](https://insights.sbomify.com/CVE-2022-36470/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-3647](https://insights.sbomify.com/CVE-2022-3647/): Redis Crash Report debug.c sigsegvHandler denial of service (low 3.1)
- [CVE-2022-36469](https://insights.sbomify.com/CVE-2022-36469/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36468](https://insights.sbomify.com/CVE-2022-36468/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36467](https://insights.sbomify.com/CVE-2022-36467/): Memory corruption in h3c:b5 mini firmware (high 7.8)
- [CVE-2022-36466](https://insights.sbomify.com/CVE-2022-36466/): Memory corruption in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36465](https://insights.sbomify.com/CVE-2022-36465/): Memory corruption in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36464](https://insights.sbomify.com/CVE-2022-36464/): Memory corruption in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36463](https://insights.sbomify.com/CVE-2022-36463/): Memory corruption in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36462](https://insights.sbomify.com/CVE-2022-36462/): Memory corruption in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36461](https://insights.sbomify.com/CVE-2022-36461/): Command injection in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36460](https://insights.sbomify.com/CVE-2022-36460/): Command injection in totolink:a3700r firmware (high 7.8)
- [CVE-2022-3646](https://insights.sbomify.com/CVE-2022-3646/): Linux Kernel BPF segment.c nilfs_attach_log_writer memory leak (low 3.1)
- [CVE-2022-36459](https://insights.sbomify.com/CVE-2022-36459/): Command injection in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36458](https://insights.sbomify.com/CVE-2022-36458/): Command injection in totolink:a3700r firmware (high 7.8)
- [CVE-2022-36456](https://insights.sbomify.com/CVE-2022-36456/): Command injection in totolink:a720r firmware (high 7.8)
- [CVE-2022-36455](https://insights.sbomify.com/CVE-2022-36455/): Command injection in totolink:a3600r firmware (high 7.8)
- [CVE-2022-36454](https://insights.sbomify.com/CVE-2022-36454/): Missing authorization in mitel:micollab (medium 6.5)
- [CVE-2022-36453](https://insights.sbomify.com/CVE-2022-36453/): Missing authorization in mitel:micollab (high 8.8)
- [CVE-2022-36452](https://insights.sbomify.com/CVE-2022-36452/): File upload in mitel:micollab (critical 9.8)
- [CVE-2022-36451](https://insights.sbomify.com/CVE-2022-36451/): Server-side request forgery in mitel:micollab (high 8.8)
- [CVE-2022-36450](https://insights.sbomify.com/CVE-2022-36450/): Code injection in obsidian:obsidian (high 8.0)
- [CVE-2022-36449](https://insights.sbomify.com/CVE-2022-36449/): Use after free in arm:bifrost gpu kernel driver (medium 6.5)
- [CVE-2022-36448](https://insights.sbomify.com/CVE-2022-36448/): Memory corruption in insyde:insydeh2o (high 8.2)
- [CVE-2022-36447](https://insights.sbomify.com/CVE-2022-36447/): chia-blockchain tokens can be inflated to an arbitrary extent (high 7.5)
- [CVE-2022-36446](https://insights.sbomify.com/CVE-2022-36446/): Cross-site scripting in webmin:webmin (critical 9.8)
- [CVE-2022-36444](https://insights.sbomify.com/CVE-2022-36444/): Other in atos:unify openscape bcf (high 8.6)
- [CVE-2022-36443](https://insights.sbomify.com/CVE-2022-36443/): Security feature bypass in zebra:enterprise home screen (high 7.8)
- [CVE-2022-36442](https://insights.sbomify.com/CVE-2022-36442/): Security feature bypass in zebra:enterprise home screen (medium 5.5)
- [CVE-2022-36441](https://insights.sbomify.com/CVE-2022-36441/): Security feature bypass in zebra:enterprise home screen (high 7.1)
- [CVE-2022-36440](https://insights.sbomify.com/CVE-2022-36440/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2022-3644](https://insights.sbomify.com/CVE-2022-3644/): Plaintext storage of tokens in pulp_ansible (medium 5.5)
- [CVE-2022-36439](https://insights.sbomify.com/CVE-2022-36439/): Privilege escalation in asus:asusliveupdate (medium 6.0)
- [CVE-2022-36438](https://insights.sbomify.com/CVE-2022-36438/): Misconfiguration in asus:asusswitch (high 7.8)
- [CVE-2022-36437](https://insights.sbomify.com/CVE-2022-36437/): Hazelcast connection caching (critical 9.1)
- [CVE-2022-36436](https://insights.sbomify.com/CVE-2022-36436/): VNCAuthProxy authentication bypass vulnerability (critical 9.8)
- [CVE-2022-36433](https://insights.sbomify.com/CVE-2022-36433/): Cross-site scripting in amasty:amasty blog pro (medium 6.1)
- [CVE-2022-36432](https://insights.sbomify.com/CVE-2022-36432/): Cross-site scripting in amasty:blog pro (medium 5.4)
- [CVE-2022-36431](https://insights.sbomify.com/CVE-2022-36431/): File upload in rocketsoftware:trufusion (critical 9.8)
- [CVE-2022-3643](https://insights.sbomify.com/CVE-2022-3643/): Denial of service in Linux (medium 6.5)
- [CVE-2022-36429](https://insights.sbomify.com/CVE-2022-36429/): Command injection in Orbi Satellite RBS750 (high 7.2)
- [CVE-2022-36428](https://insights.sbomify.com/CVE-2022-36428/): WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-36427](https://insights.sbomify.com/CVE-2022-36427/): WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerability (high 7.3)
- [CVE-2022-36425](https://insights.sbomify.com/CVE-2022-36425/): WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-36424](https://insights.sbomify.com/CVE-2022-36424/): WordPress Easy Appointments Plugin <= 3.11.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-36423](https://insights.sbomify.com/CVE-2022-36423/): Denial of service in OpenHarmony (high 7.4)
- [CVE-2022-36422](https://insights.sbomify.com/CVE-2022-36422/): WP-PostRatings plugin <= 1.89 - Rating increase/decrease via race condition (medium 4.3)
- [CVE-2022-36418](https://insights.sbomify.com/CVE-2022-36418/): WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken Authentication (medium 6.5)
- [CVE-2022-36417](https://insights.sbomify.com/CVE-2022-36417/): Cross-site request forgery in 3D Tag Cloud (WordPress plugin) (medium 6.1)
- [CVE-2022-36416](https://insights.sbomify.com/CVE-2022-36416/): Privilege escalation in Intel(R) Ethernet 500 Series Controller drivers for VMware (medium 4.4)
- [CVE-2022-36415](https://insights.sbomify.com/CVE-2022-36415/): Privilege escalation in scootersoftware:beyond compare (high 7.8)
- [CVE-2022-36414](https://insights.sbomify.com/CVE-2022-36414/): Privilege escalation in scootersoftware:beyond compare (medium 6.7)
- [CVE-2022-36413](https://insights.sbomify.com/CVE-2022-36413/): Auth bypass in zohocorp:manageengine adselfservice plus (critical 9.1)
- [CVE-2022-36412](https://insights.sbomify.com/CVE-2022-36412/): Auth bypass in zohocorp:manageengine supportcenter plus (critical 9.8)
- [CVE-2022-3641](https://insights.sbomify.com/CVE-2022-3641/): Privilege escalation in Remote Desktop Manager (high 8.8)
- [CVE-2022-36407](https://insights.sbomify.com/CVE-2022-36407/): Information Exposure Vulnerability in Hitachi Disk Array Systems (critical 9.9)
- [CVE-2022-36405](https://insights.sbomify.com/CVE-2022-36405/): WordPress amCharts: Charts and Maps plugin <= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-36404](https://insights.sbomify.com/CVE-2022-36404/): WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2022-36403](https://insights.sbomify.com/CVE-2022-36403/): Other in Installer of Device Software Manager (high 7.8)
- [CVE-2022-36402](https://insights.sbomify.com/CVE-2022-36402/): There is an int overflow vulnerability in vmwgfx driver (medium 6.3)
- [CVE-2022-36401](https://insights.sbomify.com/CVE-2022-36401/): WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-36400](https://insights.sbomify.com/CVE-2022-36400/): Path traversal in Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 (medium 6.7)
- [CVE-2022-3640](https://insights.sbomify.com/CVE-2022-3640/): Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free (medium 5.5)
- [CVE-2022-36399](https://insights.sbomify.com/CVE-2022-36399/): WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2022-36398](https://insights.sbomify.com/CVE-2022-36398/): Privilege escalation in Intel(R) Battery Life Diagnostic Tool software (medium 6.7)
- [CVE-2022-36397](https://insights.sbomify.com/CVE-2022-36397/): Misconfiguration in Intel(R) QAT drivers for Linux (high 7.3)
- [CVE-2022-36396](https://insights.sbomify.com/CVE-2022-36396/): Privilege escalation in Intel(R) Aptio* V UEFI Firmware Integrator Tools (high 8.2)
- [CVE-2022-36394](https://insights.sbomify.com/CVE-2022-36394/): WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability (high 7.6)
- [CVE-2022-36392](https://insights.sbomify.com/CVE-2022-36392/): Denial of service in Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME (high 8.6)
- [CVE-2022-36391](https://insights.sbomify.com/CVE-2022-36391/): Misconfiguration in Intel(R) NUC Pro Software Suite (medium 6.7)
- [CVE-2022-36390](https://insights.sbomify.com/CVE-2022-36390/): WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.1)
- [CVE-2022-3639](https://insights.sbomify.com/CVE-2022-3639/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-36389](https://insights.sbomify.com/CVE-2022-36389/): WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-36388](https://insights.sbomify.com/CVE-2022-36388/): WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-36387](https://insights.sbomify.com/CVE-2022-36387/): WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability (high 7.6)
- [CVE-2022-36386](https://insights.sbomify.com/CVE-2022-36386/): Code injection in Import any XML or CSV File to WordPress (WordPress plugin) (critical 9.1)
- [CVE-2022-36385](https://insights.sbomify.com/CVE-2022-36385/): Contec Health CMS8000 (medium 6.8)
- [CVE-2022-36384](https://insights.sbomify.com/CVE-2022-36384/): Privilege escalation in Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 (medium 6.7)
- [CVE-2022-36383](https://insights.sbomify.com/CVE-2022-36383/): Cross-site scripting in Word Search Puzzles game (WordPress plugin) (medium 5.4)
- [CVE-2022-36382](https://insights.sbomify.com/CVE-2022-36382/): Memory corruption in Intel(R) Ethernet Network Controllers and Adapters E810 Series and some Intel(R) Ethernet 700 Series Controllers and Adapters (medium 6.0)
- [CVE-2022-36381](https://insights.sbomify.com/CVE-2022-36381/): Command injection in Nintendo Wi-Fi Network Adaptor WAP-001 (high 7.2)
- [CVE-2022-36380](https://insights.sbomify.com/CVE-2022-36380/): Privilege escalation in Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 (medium 6.7)
- [CVE-2022-36379](https://insights.sbomify.com/CVE-2022-36379/): WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update (high 8.8)
- [CVE-2022-36378](https://insights.sbomify.com/CVE-2022-36378/): WordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-36377](https://insights.sbomify.com/CVE-2022-36377/): Privilege escalation in Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs (medium 6.7)
- [CVE-2022-36376](https://insights.sbomify.com/CVE-2022-36376/): WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability (medium 6.8)
- [CVE-2022-36375](https://insights.sbomify.com/CVE-2022-36375/): WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability (high 7.2)
- [CVE-2022-36374](https://insights.sbomify.com/CVE-2022-36374/): Privilege escalation in Intel(R) Aptio* V UEFI Firmware Integrator Tools (high 7.5)
- [CVE-2022-36373](https://insights.sbomify.com/CVE-2022-36373/): WordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-36372](https://insights.sbomify.com/CVE-2022-36372/): Memory corruption in Intel(R) NUC BIOS firmware (high 7.5)
- [CVE-2022-36370](https://insights.sbomify.com/CVE-2022-36370/): Auth bypass in Intel(R) NUC Boards and Intel(R) NUC Kits (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/278/