# Vulnerabilities published in 2022


- [CVE-2022-36258](https://insights.sbomify.com/CVE-2022-36258/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (high 7.5)
- [CVE-2022-36257](https://insights.sbomify.com/CVE-2022-36257/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (high 7.5)
- [CVE-2022-36256](https://insights.sbomify.com/CVE-2022-36256/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (high 7.5)
- [CVE-2022-36255](https://insights.sbomify.com/CVE-2022-36255/): SQL injection in inventorymanagementsystem project:inventorymanagementsystem (high 7.5)
- [CVE-2022-36254](https://insights.sbomify.com/CVE-2022-36254/): Cross-site scripting in hotel management system project:hotel management system (medium 5.4)
- [CVE-2022-36251](https://insights.sbomify.com/CVE-2022-36251/): Cross-site scripting in oretnom23:clinic\'s patient management system (medium 6.1)
- [CVE-2022-36250](https://insights.sbomify.com/CVE-2022-36250/): Cross Site Request Forgery on Shop Beat Services (high 8.8)
- [CVE-2022-3625](https://insights.sbomify.com/CVE-2022-3625/): Linux Kernel IPsec devlink.c devlink_param_get use after free (medium 4.6)
- [CVE-2022-36249](https://insights.sbomify.com/CVE-2022-36249/): Shop Beat Services Vulnerable To Bypass 2FA via APIs (medium 5.4)
- [CVE-2022-36247](https://insights.sbomify.com/CVE-2022-36247/): Shop Beat Services Vulnerable To IDOR (critical 9.1)
- [CVE-2022-36246](https://insights.sbomify.com/CVE-2022-36246/): Shop Beat Services Vulnerable To Insecure Permissions (critical 9.8)
- [CVE-2022-36244](https://insights.sbomify.com/CVE-2022-36244/): Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services (medium 5.4)
- [CVE-2022-36243](https://insights.sbomify.com/CVE-2022-36243/): Directory Traversal on Shop Beat Services (medium 5.3)
- [CVE-2022-36242](https://insights.sbomify.com/CVE-2022-36242/): SQL injection in oretnom23:clinic\'s patient management system (critical 9.8)
- [CVE-2022-3624](https://insights.sbomify.com/CVE-2022-3624/): Linux Kernel IPsec bond_alb.c rlb_arp_xmit memory leak (low 3.5)
- [CVE-2022-36234](https://insights.sbomify.com/CVE-2022-36234/): Memory corruption in simplenetwork project:simplenetwork (high 7.5)
- [CVE-2022-36233](https://insights.sbomify.com/CVE-2022-36233/): Memory corruption in tendacn:ac9 firmware (medium 5.5)
- [CVE-2022-36231](https://insights.sbomify.com/CVE-2022-36231/): Code injection in pdf_info (critical 9.8)
- [CVE-2022-3623](https://insights.sbomify.com/CVE-2022-3623/): Linux Kernel BPF gup.c follow_page_pte race condition (medium 5.0)
- [CVE-2022-36228](https://insights.sbomify.com/CVE-2022-36228/): Missing authorization in janusintl:noke hd\+ smart padlock firmware (high 7.3)
- [CVE-2022-36227](https://insights.sbomify.com/CVE-2022-36227/): Null dereference in debian:debian linux (critical 9.8)
- [CVE-2022-36226](https://insights.sbomify.com/CVE-2022-36226/): Missing authorization in siteservercms project:siteservercms (high 7.2)
- [CVE-2022-36225](https://insights.sbomify.com/CVE-2022-36225/): Cross-site request forgery in eyoucms:eyoucms (high 8.8)
- [CVE-2022-36224](https://insights.sbomify.com/CVE-2022-36224/): Cross-site request forgery in xunruicms:xunruicms (high 8.8)
- [CVE-2022-36223](https://insights.sbomify.com/CVE-2022-36223/): Cross-site scripting in emby:emby (medium 6.1)
- [CVE-2022-36222](https://insights.sbomify.com/CVE-2022-36222/): Hardcoded credentials in nokia:fastmile firmware (high 8.4)
- [CVE-2022-36221](https://insights.sbomify.com/CVE-2022-36221/): Path traversal in nokia:fastmile firmware (medium 6.5)
- [CVE-2022-36220](https://insights.sbomify.com/CVE-2022-36220/): Security feature bypass in ethz:safe exam browser (critical 9.8)
- [CVE-2022-3622](https://insights.sbomify.com/CVE-2022-3622/): Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 4.1)
- [CVE-2022-36216](https://insights.sbomify.com/CVE-2022-36216/): Code injection in dedecms:dedecms (high 7.2)
- [CVE-2022-36215](https://insights.sbomify.com/CVE-2022-36215/): Code injection in dedebiz:dedecmsv6 (high 7.2)
- [CVE-2022-3621](https://insights.sbomify.com/CVE-2022-3621/): Linux Kernel nilfs2 inode.c nilfs_bmap_lookup_at_level null pointer dereference (medium 4.3)
- [CVE-2022-36203](https://insights.sbomify.com/CVE-2022-36203/): Cross-site scripting in doctor\'s appointment system project:doctor\'s appointment system (medium 6.1)
- [CVE-2022-36202](https://insights.sbomify.com/CVE-2022-36202/): Missing authorization in doctor\'s appointment system project:doctor\'s appointment system (critical 9.8)
- [CVE-2022-36201](https://insights.sbomify.com/CVE-2022-36201/): SQL injection in doctor\'s appointment system project:doctor\'s appointment system (critical 9.8)
- [CVE-2022-36200](https://insights.sbomify.com/CVE-2022-36200/): Information disclosure in fiberhome:hg150-ub firmware (high 7.5)
- [CVE-2022-3620](https://insights.sbomify.com/CVE-2022-3620/): Exim DMARC dmarc.c dmarc_dns_lookup use after free (medium 5.6)
- [CVE-2022-36198](https://insights.sbomify.com/CVE-2022-36198/): SQL injection in phpgurukul:bus pass management system (critical 9.8)
- [CVE-2022-36197](https://insights.sbomify.com/CVE-2022-36197/): File upload in bigtreecms:bigtree cms (medium 5.4)
- [CVE-2022-36194](https://insights.sbomify.com/CVE-2022-36194/): Cross-site scripting in centreon:centreon (medium 5.4)
- [CVE-2022-36193](https://insights.sbomify.com/CVE-2022-36193/): SQL injection in lahirudanushka:school management system (critical 9.8)
- [CVE-2022-36191](https://insights.sbomify.com/CVE-2022-36191/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-36190](https://insights.sbomify.com/CVE-2022-36190/): Use after free in gpac:gpac (critical 9.8)
- [CVE-2022-3619](https://insights.sbomify.com/CVE-2022-3619/): Linux Kernel Bluetooth l2cap_core.c l2cap_recv_acldata memory leak (low 3.5)
- [CVE-2022-36186](https://insights.sbomify.com/CVE-2022-36186/): Null dereference in gpac:gpac (high 7.5)
- [CVE-2022-36182](https://insights.sbomify.com/CVE-2022-36182/): Hashicorp Boundary vulnerable to clickjacking (medium 6.1)
- [CVE-2022-36180](https://insights.sbomify.com/CVE-2022-36180/): Cross-site scripting in fusiondirectory:fusiondirectory (critical 9.6)
- [CVE-2022-3618](https://insights.sbomify.com/CVE-2022-3618/): Spacer < 3.0.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-36179](https://insights.sbomify.com/CVE-2022-36179/): Other in fusiondirectory:fusiondirectory (critical 9.8)
- [CVE-2022-36174](https://insights.sbomify.com/CVE-2022-36174/): Security feature bypass in freshworks:freshservice agent (high 8.1)
- [CVE-2022-36173](https://insights.sbomify.com/CVE-2022-36173/): Weak cryptography in freshworks:freshservice agent (high 8.1)
- [CVE-2022-36171](https://insights.sbomify.com/CVE-2022-36171/): Hardcoded credentials in mapgis:mapgis igserver (high 8.1)
- [CVE-2022-36170](https://insights.sbomify.com/CVE-2022-36170/): Hardcoded credentials in mapgis:igserver (high 8.8)
- [CVE-2022-36168](https://insights.sbomify.com/CVE-2022-36168/): Path traversal in wuzhicms:wuzhicms (low 2.7)
- [CVE-2022-36161](https://insights.sbomify.com/CVE-2022-36161/): SQL injection in garage management system project:garage management system (critical 9.8)
- [CVE-2022-3616](https://insights.sbomify.com/CVE-2022-3616/): OctoRPKI crash when maximum iterations number is reached (medium 5.4)
- [CVE-2022-36159](https://insights.sbomify.com/CVE-2022-36159/): Hardcoded credentials in contec:fxa2000 firmware (high 8.8)
- [CVE-2022-36158](https://insights.sbomify.com/CVE-2022-36158/): Command injection in contec:fxa2000 firmware (high 8.8)
- [CVE-2022-36157](https://insights.sbomify.com/CVE-2022-36157/): Improper Privilege Management in com.xuxueli:xxl-job (high 8.8)
- [CVE-2022-36155](https://insights.sbomify.com/CVE-2022-36155/): Denial of service in monostream:tifig (medium 5.5)
- [CVE-2022-36153](https://insights.sbomify.com/CVE-2022-36153/): Null dereference in monostream:tifig (medium 5.5)
- [CVE-2022-36152](https://insights.sbomify.com/CVE-2022-36152/): Denial of service in monostream:tifig (medium 5.5)
- [CVE-2022-36151](https://insights.sbomify.com/CVE-2022-36151/): Null dereference in monostream:tifig (medium 5.5)
- [CVE-2022-36150](https://insights.sbomify.com/CVE-2022-36150/): Memory corruption in monostream:tifig (medium 5.5)
- [CVE-2022-36149](https://insights.sbomify.com/CVE-2022-36149/): Use after free in monostream:tifig (medium 5.5)
- [CVE-2022-36148](https://insights.sbomify.com/CVE-2022-36148/): Denial of service in fdkaac project:fdkaac (medium 5.5)
- [CVE-2022-36146](https://insights.sbomify.com/CVE-2022-36146/): Denial of service in swfmill:swfmill (medium 5.5)
- [CVE-2022-36145](https://insights.sbomify.com/CVE-2022-36145/): Denial of service in swfmill:swfmill (medium 5.5)
- [CVE-2022-36144](https://insights.sbomify.com/CVE-2022-36144/): Memory corruption in swfmill:swfmill (high 7.8)
- [CVE-2022-36143](https://insights.sbomify.com/CVE-2022-36143/): Memory corruption in swfmill:swfmill (high 7.8)
- [CVE-2022-36142](https://insights.sbomify.com/CVE-2022-36142/): Memory corruption in swfmill:swfmill (high 7.8)
- [CVE-2022-36141](https://insights.sbomify.com/CVE-2022-36141/): Memory corruption in swfmill:swfmill (medium 5.5)
- [CVE-2022-36140](https://insights.sbomify.com/CVE-2022-36140/): Denial of service in swfmill:swfmill (medium 5.5)
- [CVE-2022-3614](https://insights.sbomify.com/CVE-2022-3614/): Auth bypass in Octopus Server (medium 6.1)
- [CVE-2022-36139](https://insights.sbomify.com/CVE-2022-36139/): Memory corruption in swfmill:swfmill (high 7.8)
- [CVE-2022-36137](https://insights.sbomify.com/CVE-2022-36137/): Cross-site scripting in churchcrm:churchcrm (medium 4.8)
- [CVE-2022-36136](https://insights.sbomify.com/CVE-2022-36136/): Cross-site scripting in churchcrm:churchcrm (medium 4.8)
- [CVE-2022-36133](https://insights.sbomify.com/CVE-2022-36133/): Auth bypass in epson:tm-c3500 firmware (critical 9.1)
- [CVE-2022-36131](https://insights.sbomify.com/CVE-2022-36131/): Cross-site scripting in midori-global:better pdf exporter (medium 6.1)
- [CVE-2022-36130](https://insights.sbomify.com/CVE-2022-36130/): Privilege escalation in hashicorp:boundary (critical 9.9)
- [CVE-2022-3613](https://insights.sbomify.com/CVE-2022-3613/): Denial of service in GitLab (medium 5.8)
- [CVE-2022-36129](https://insights.sbomify.com/CVE-2022-36129/): Missing authorization in hashicorp:vault (critical 9.1)
- [CVE-2022-36127](https://insights.sbomify.com/CVE-2022-36127/): Service unavailability impact in NodeJS agent(version <= 0.5.0) (high 7.5)
- [CVE-2022-36126](https://insights.sbomify.com/CVE-2022-36126/): Code injection in inductiveautomation:ignition (high 7.2)
- [CVE-2022-36125](https://insights.sbomify.com/CVE-2022-36125/): Integer overflow when reading corrupted .avro file in Avro Rust SDK (high 7.5)
- [CVE-2022-36124](https://insights.sbomify.com/CVE-2022-36124/): Memory overconsumption in Avro Rust SDK (high 7.5)
- [CVE-2022-36123](https://insights.sbomify.com/CVE-2022-36123/): Privilege escalation in linux:linux kernel (high 7.8)
- [CVE-2022-36122](https://insights.sbomify.com/CVE-2022-36122/): Misconfiguration in automox:automox (high 7.8)
- [CVE-2022-36121](https://insights.sbomify.com/CVE-2022-36121/): Missing authorization in ssctech:blue prism enterprise (medium 5.3)
- [CVE-2022-36120](https://insights.sbomify.com/CVE-2022-36120/): Missing authorization in ssctech:blue prism enterprise (high 8.1)
- [CVE-2022-36119](https://insights.sbomify.com/CVE-2022-36119/): Deserialization in ssctech:blue prism (high 8.8)
- [CVE-2022-36118](https://insights.sbomify.com/CVE-2022-36118/): Missing authorization in ssctech:blue prism (medium 5.3)
- [CVE-2022-36117](https://insights.sbomify.com/CVE-2022-36117/): Auth bypass in ssctech:blue prism (low 3.1)
- [CVE-2022-36116](https://insights.sbomify.com/CVE-2022-36116/): Missing authorization in ssctech:blue prism (medium 5.3)
- [CVE-2022-36115](https://insights.sbomify.com/CVE-2022-36115/): Code injection in ssctech:blue prism (high 7.1)
- [CVE-2022-36114](https://insights.sbomify.com/CVE-2022-36114/): Extracting malicious crates can fill the file system (medium 4.8)
- [CVE-2022-36113](https://insights.sbomify.com/CVE-2022-36113/): Extracting malicious crates can corrupt arbitrary files (medium 4.6)
- [CVE-2022-36112](https://insights.sbomify.com/CVE-2022-36112/): Blind Server-Side Request Forgery (SSRF) in GLPI (low 3.5)
- [CVE-2022-36111](https://insights.sbomify.com/CVE-2022-36111/): immundb has insufficient verification of data authenticity (medium 5.4)
- [CVE-2022-36110](https://insights.sbomify.com/CVE-2022-36110/): Netmaker vulnerable to Insufficient Granularity of Access Control (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/280/