# Vulnerabilities published in 2022


- [CVE-2022-3637](https://insights.sbomify.com/CVE-2022-3637/): Linux Kernel BlueZ jlink.c jlink_init denial of service (low 2.6)
- [CVE-2022-36369](https://insights.sbomify.com/CVE-2022-36369/): Privilege escalation in QATzip software maintained by Intel(R) (high 7.8)
- [CVE-2022-36368](https://insights.sbomify.com/CVE-2022-36368/): Cross-site scripting in IPFire (medium 4.8)
- [CVE-2022-36367](https://insights.sbomify.com/CVE-2022-36367/): Misconfiguration in Intel(R) Support Android application (medium 4.4)
- [CVE-2022-36365](https://insights.sbomify.com/CVE-2022-36365/): WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (medium 5.4)
- [CVE-2022-36364](https://insights.sbomify.com/CVE-2022-36364/): Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector (high 8.8)
- [CVE-2022-36363](https://insights.sbomify.com/CVE-2022-36363/): Information disclosure in LOGO! 12/24RCE (medium 5.3)
- [CVE-2022-36362](https://insights.sbomify.com/CVE-2022-36362/): Other in LOGO! 12/24RCE (high 7.5)
- [CVE-2022-36361](https://insights.sbomify.com/CVE-2022-36361/): Memory corruption in LOGO! 12/24RCE (critical 9.8)
- [CVE-2022-36360](https://insights.sbomify.com/CVE-2022-36360/): Security feature bypass in LOGO! 8 BM (incl. SIPLUS variants) (high 7.5)
- [CVE-2022-3636](https://insights.sbomify.com/CVE-2022-3636/): Linux Kernel Ethernet mtk_ppe.c __mtk_ppe_check_skb use after free (medium 5.1)
- [CVE-2022-36359](https://insights.sbomify.com/CVE-2022-36359/): Django vulnerable to Reflected File Download attack (high 8.8)
- [CVE-2022-36358](https://insights.sbomify.com/CVE-2022-36358/): WordPress SEO Scout plugin <= 0.9.83 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-36357](https://insights.sbomify.com/CVE-2022-36357/): WordPress ULTIMATE TABLES plugin <= 1.6.5 - Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2022-36356](https://insights.sbomify.com/CVE-2022-36356/): WordPress Culture Object plugin <= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-36355](https://insights.sbomify.com/CVE-2022-36355/): WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-36354](https://insights.sbomify.com/CVE-2022-36354/): Memory corruption in OpenImageIO (medium 5.3)
- [CVE-2022-36352](https://insights.sbomify.com/CVE-2022-36352/): WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control (medium 6.3)
- [CVE-2022-36351](https://insights.sbomify.com/CVE-2022-36351/): Denial of service in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software (medium 4.3)
- [CVE-2022-36350](https://insights.sbomify.com/CVE-2022-36350/): Cross-site scripting in PukiWiki (medium 6.1)
- [CVE-2022-3635](https://insights.sbomify.com/CVE-2022-3635/): Linux Kernel IPsec idt77252.c tst_timer use after free (medium 5.5)
- [CVE-2022-36349](https://insights.sbomify.com/CVE-2022-36349/): Misconfiguration in Intel(R) NUC Boards and Intel(R) NUC Kits (medium 5.2)
- [CVE-2022-36348](https://insights.sbomify.com/CVE-2022-36348/): Privilege escalation in Intel (R) SPS firmware (high 8.8)
- [CVE-2022-36347](https://insights.sbomify.com/CVE-2022-36347/): Cross-site scripting in Alpine PhotoTile for Pinterest (WordPress plugin) (medium 4.8)
- [CVE-2022-36346](https://insights.sbomify.com/CVE-2022-36346/): WordPress MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 4.3)
- [CVE-2022-36345](https://insights.sbomify.com/CVE-2022-36345/): WordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-36344](https://insights.sbomify.com/CVE-2022-36344/): Privilege escalation in JustSystems JUST Online Update for J-License' (critical 9.8)
- [CVE-2022-36343](https://insights.sbomify.com/CVE-2022-36343/): WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2022-36341](https://insights.sbomify.com/CVE-2022-36341/): Cross-site scripting in AS – Create Pinterest Pinboard Pages (WordPress plugin) (medium 5.4)
- [CVE-2022-36340](https://insights.sbomify.com/CVE-2022-36340/): WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerability (medium 6.5)
- [CVE-2022-3634](https://insights.sbomify.com/CVE-2022-3634/): Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection (critical 9.8)
- [CVE-2022-36339](https://insights.sbomify.com/CVE-2022-36339/): Privilege escalation in Intel(R) NUC 8 Compute Element, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element (high 7.5)
- [CVE-2022-36338](https://insights.sbomify.com/CVE-2022-36338/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2022-36337](https://insights.sbomify.com/CVE-2022-36337/): Memory corruption in insyde:kernel (high 8.2)
- [CVE-2022-36336](https://insights.sbomify.com/CVE-2022-36336/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2022-36331](https://insights.sbomify.com/CVE-2022-36331/): Impersonation attack causing an Authentication Bypass on Western Digital devices (critical 10.0)
- [CVE-2022-36330](https://insights.sbomify.com/CVE-2022-36330/): Buffer Overflow Vulnerability in Western Digital My Cloud Home and ibi devices (low 1.9)
- [CVE-2022-3633](https://insights.sbomify.com/CVE-2022-3633/): Linux Kernel transport.c j1939_session_destroy memory leak (low 3.5)
- [CVE-2022-36329](https://insights.sbomify.com/CVE-2022-36329/): Denial of Service over OTA mechanism in Western Digital My Cloud Home and ibi devices (medium 4.4)
- [CVE-2022-36328](https://insights.sbomify.com/CVE-2022-36328/): Path Traversal Vulnerability leading to an arbitrary file read in Western Digital devices (medium 5.8)
- [CVE-2022-36327](https://insights.sbomify.com/CVE-2022-36327/): Path traversal vulnerability leading to an arbitrary file write in Western Digital devices (medium 5.8)
- [CVE-2022-36326](https://insights.sbomify.com/CVE-2022-36326/): Resource Exhaustion Vulnerability in Western Digital devices (medium 4.4)
- [CVE-2022-36325](https://insights.sbomify.com/CVE-2022-36325/): Cross-site scripting in RUGGEDCOM RM1224 LTE(4G) EU (medium 6.8)
- [CVE-2022-36324](https://insights.sbomify.com/CVE-2022-36324/): Denial of service in RUGGEDCOM RM1224 LTE(4G) EU (high 7.5)
- [CVE-2022-36323](https://insights.sbomify.com/CVE-2022-36323/): Code injection in RUGGEDCOM RM1224 LTE(4G) EU (critical 9.1)
- [CVE-2022-36322](https://insights.sbomify.com/CVE-2022-36322/): Code injection in TeamCity (medium 5.4)
- [CVE-2022-36321](https://insights.sbomify.com/CVE-2022-36321/): Information disclosure in TeamCity (medium 4.1)
- [CVE-2022-36320](https://insights.sbomify.com/CVE-2022-36320/): Memory corruption in Firefox (critical 9.8)
- [CVE-2022-3632](https://insights.sbomify.com/CVE-2022-3632/): OAuth Client by DigitialPixies <= 1.1.0 - CSRF (medium 6.5)
- [CVE-2022-36319](https://insights.sbomify.com/CVE-2022-36319/): Other in Firefox (high 7.5)
- [CVE-2022-36318](https://insights.sbomify.com/CVE-2022-36318/): Cross-site scripting in Firefox (medium 5.3)
- [CVE-2022-36317](https://insights.sbomify.com/CVE-2022-36317/): Denial of service in Firefox (medium 6.5)
- [CVE-2022-36316](https://insights.sbomify.com/CVE-2022-36316/): Information disclosure in Firefox (medium 6.1)
- [CVE-2022-36315](https://insights.sbomify.com/CVE-2022-36315/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2022-36314](https://insights.sbomify.com/CVE-2022-36314/): Server-side request forgery in Firefox (medium 5.5)
- [CVE-2022-36313](https://insights.sbomify.com/CVE-2022-36313/): file-type vulnerable to Infinite Loop via malformed MKV file (medium 5.5)
- [CVE-2022-36312](https://insights.sbomify.com/CVE-2022-36312/): Cross-site request forgery in AirVelocity (high 8.8)
- [CVE-2022-36311](https://insights.sbomify.com/CVE-2022-36311/): Cross-site scripting in AirVelocity (medium 6.1)
- [CVE-2022-36310](https://insights.sbomify.com/CVE-2022-36310/): Misconfiguration in AirVelocity (high 8.8)
- [CVE-2022-3631](https://insights.sbomify.com/CVE-2022-3631/): OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-36309](https://insights.sbomify.com/CVE-2022-36309/): Command injection in AirVelocity (high 8.8)
- [CVE-2022-36308](https://insights.sbomify.com/CVE-2022-36308/): Information disclosure in AirVelocity (critical 9.1)
- [CVE-2022-36307](https://insights.sbomify.com/CVE-2022-36307/): Information disclosure in AirVelocity (medium 6.8)
- [CVE-2022-36306](https://insights.sbomify.com/CVE-2022-36306/): Information disclosure in AirVelocity (medium 6.5)
- [CVE-2022-36305](https://insights.sbomify.com/CVE-2022-36305/): Cross-site scripting in vestacp:vesta control panel (medium 6.1)
- [CVE-2022-36304](https://insights.sbomify.com/CVE-2022-36304/): Cross-site scripting in vestacp:vesta control panel (medium 6.1)
- [CVE-2022-36303](https://insights.sbomify.com/CVE-2022-36303/): Cross-site scripting in vestacp:vesta control panel (medium 6.1)
- [CVE-2022-36302](https://insights.sbomify.com/CVE-2022-36302/): Path traversal in BF-OS (high 8.8)
- [CVE-2022-36301](https://insights.sbomify.com/CVE-2022-36301/): Weak cryptography in BF-OS (critical 9.8)
- [CVE-2022-3630](https://insights.sbomify.com/CVE-2022-3630/): Linux Kernel IPsec cookie.c memory leak (low 3.1)
- [CVE-2022-36296](https://insights.sbomify.com/CVE-2022-36296/): WordPress ActiveDEMAND plugin <= 0.2.27 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2022-36293](https://insights.sbomify.com/CVE-2022-36293/): Memory corruption in Nintendo Wi-Fi Network Adaptor WAP-001 (high 7.2)
- [CVE-2022-36292](https://insights.sbomify.com/CVE-2022-36292/): WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-3629](https://insights.sbomify.com/CVE-2022-3629/): Linux Kernel af_vsock.c vsock_connect memory leak (low 2.6)
- [CVE-2022-36289](https://insights.sbomify.com/CVE-2022-36289/): Denial of service in Intel(R) Media SDK software (low 2.8)
- [CVE-2022-36288](https://insights.sbomify.com/CVE-2022-36288/): WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-36287](https://insights.sbomify.com/CVE-2022-36287/): Denial of service in FCS Server software maintained by Intel (medium 4.0)
- [CVE-2022-36285](https://insights.sbomify.com/CVE-2022-36285/): WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability (high 7.2)
- [CVE-2022-36284](https://insights.sbomify.com/CVE-2022-36284/): Missing authorization in Affiliate For WooCommerce (WordPress plugin) (medium 6.4)
- [CVE-2022-36282](https://insights.sbomify.com/CVE-2022-36282/): WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-36280](https://insights.sbomify.com/CVE-2022-36280/): There is an out-of-bounds write vulnerability in vmwgfx driver (medium 6.3)
- [CVE-2022-3628](https://insights.sbomify.com/CVE-2022-3628/): Memory corruption in Kernel (medium 6.6)
- [CVE-2022-36279](https://insights.sbomify.com/CVE-2022-36279/): Memory corruption in QUARTZ-GOLD (high 7.2)
- [CVE-2022-36278](https://insights.sbomify.com/CVE-2022-36278/): Privilege escalation in Intel(R) Battery Life Diagnostic Tool software (high 8.2)
- [CVE-2022-36277](https://insights.sbomify.com/CVE-2022-36277/): SQL injection vulnerability in TCMAN GIM (medium 6.5)
- [CVE-2022-36276](https://insights.sbomify.com/CVE-2022-36276/): SQL injection vulnerability in TCMAN GIM (critical 9.9)
- [CVE-2022-36273](https://insights.sbomify.com/CVE-2022-36273/): Command injection in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-36272](https://insights.sbomify.com/CVE-2022-36272/): Mingsoft MCMS SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter (critical 9.8)
- [CVE-2022-36271](https://insights.sbomify.com/CVE-2022-36271/): Privilege escalation in outbyte:pc repair (high 7.8)
- [CVE-2022-36270](https://insights.sbomify.com/CVE-2022-36270/): Code injection in oretnom23:clinic\'s patient management system (critical 9.8)
- [CVE-2022-3627](https://insights.sbomify.com/CVE-2022-3627/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-36267](https://insights.sbomify.com/CVE-2022-36267/): Command injection in airspan:airspot 5410 firmware (critical 9.8)
- [CVE-2022-36266](https://insights.sbomify.com/CVE-2022-36266/): Cross-site scripting in airspan:airspot 5410 firmware (medium 6.1)
- [CVE-2022-36265](https://insights.sbomify.com/CVE-2022-36265/): Command injection in airspan:airspot 5410 firmware (high 7.2)
- [CVE-2022-36264](https://insights.sbomify.com/CVE-2022-36264/): File upload in airspan:airspot 5410 firmware (critical 9.1)
- [CVE-2022-36263](https://insights.sbomify.com/CVE-2022-36263/): Privilege escalation in logitech:streamlabs desktop (high 7.3)
- [CVE-2022-36262](https://insights.sbomify.com/CVE-2022-36262/): Code injection in taogogo:taocms (critical 9.8)
- [CVE-2022-36261](https://insights.sbomify.com/CVE-2022-36261/): Path traversal in taogogo:taocms (critical 9.1)
- [CVE-2022-3626](https://insights.sbomify.com/CVE-2022-3626/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-36259](https://insights.sbomify.com/CVE-2022-36259/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/279/