# Vulnerabilities published in 2022


- [CVE-2022-35585](https://insights.sbomify.com/CVE-2022-35585/): ForkCMS stored XSS via `start_date` parameter (medium 4.8)
- [CVE-2022-35583](https://insights.sbomify.com/CVE-2022-35583/): Server-side request forgery in wkhtmltopdf:wkhtmltopdf (critical 9.8)
- [CVE-2022-35582](https://insights.sbomify.com/CVE-2022-35582/): Hardcoded credentials in pentasecurity:wapples (high 8.8)
- [CVE-2022-3558](https://insights.sbomify.com/CVE-2022-3558/): Import and export users and customers < 1.20.5 - Subscriber+ CSV Injection (high 8.0)
- [CVE-2022-35572](https://insights.sbomify.com/CVE-2022-35572/): Missing authorization in linksys:e5350 firmware (high 7.5)
- [CVE-2022-35569](https://insights.sbomify.com/CVE-2022-35569/): File upload in blogifier:blogifier (medium 4.8)
- [CVE-2022-35561](https://insights.sbomify.com/CVE-2022-35561/): Memory corruption in tenda:w6 firmware (high 7.5)
- [CVE-2022-35560](https://insights.sbomify.com/CVE-2022-35560/): Memory corruption in tenda:w6 firmware (high 7.5)
- [CVE-2022-3556](https://insights.sbomify.com/CVE-2022-3556/): Cab fare calculator <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2022-35559](https://insights.sbomify.com/CVE-2022-35559/): Memory corruption in tenda:w6 firmware (critical 9.8)
- [CVE-2022-35558](https://insights.sbomify.com/CVE-2022-35558/): Memory corruption in tenda:w6 firmware (high 7.5)
- [CVE-2022-35557](https://insights.sbomify.com/CVE-2022-35557/): Memory corruption in tenda:w6 firmware (high 7.5)
- [CVE-2022-35555](https://insights.sbomify.com/CVE-2022-35555/): Command injection in tenda:w6 firmware (critical 9.8)
- [CVE-2022-35554](https://insights.sbomify.com/CVE-2022-35554/): Cross-site scripting in bpcbt:smartvista (medium 6.1)
- [CVE-2022-35540](https://insights.sbomify.com/CVE-2022-35540/): Use of Hard-coded Credentials in AgileConfig.Client (critical 9.8)
- [CVE-2022-35538](https://insights.sbomify.com/CVE-2022-35538/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35537](https://insights.sbomify.com/CVE-2022-35537/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35536](https://insights.sbomify.com/CVE-2022-35536/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35535](https://insights.sbomify.com/CVE-2022-35535/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35534](https://insights.sbomify.com/CVE-2022-35534/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35533](https://insights.sbomify.com/CVE-2022-35533/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-3553](https://insights.sbomify.com/CVE-2022-3553/): X.org Server xquartz X11Controller.m denial of service (low 3.5)
- [CVE-2022-35526](https://insights.sbomify.com/CVE-2022-35526/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35525](https://insights.sbomify.com/CVE-2022-35525/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35524](https://insights.sbomify.com/CVE-2022-35524/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35523](https://insights.sbomify.com/CVE-2022-35523/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35522](https://insights.sbomify.com/CVE-2022-35522/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35521](https://insights.sbomify.com/CVE-2022-35521/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35520](https://insights.sbomify.com/CVE-2022-35520/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-3552](https://insights.sbomify.com/CVE-2022-3552/): Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling (high 7.2)
- [CVE-2022-35519](https://insights.sbomify.com/CVE-2022-35519/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2022-35518](https://insights.sbomify.com/CVE-2022-35518/): Command injection in wavlink:wn530h4 firmware (medium 4.6)
- [CVE-2022-35517](https://insights.sbomify.com/CVE-2022-35517/): Command injection in wavlink:wn530h4 firmware (high 8.8)
- [CVE-2022-35516](https://insights.sbomify.com/CVE-2022-35516/): Code injection in dedecms:dedecms (critical 9.8)
- [CVE-2022-35513](https://insights.sbomify.com/CVE-2022-35513/): Blink1Control2 uses weak password encryption (high 7.5)
- [CVE-2022-3551](https://insights.sbomify.com/CVE-2022-3551/): X.org Server xkb.c ProcXkbGetKbdByName memory leak (low 3.5)
- [CVE-2022-35509](https://insights.sbomify.com/CVE-2022-35509/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2022-35508](https://insights.sbomify.com/CVE-2022-35508/): Server-side request forgery in proxmox:proxmox mail gateway (critical 9.8)
- [CVE-2022-35507](https://insights.sbomify.com/CVE-2022-35507/): Other in proxmox:proxmox mail gateway (medium 4.3)
- [CVE-2022-35506](https://insights.sbomify.com/CVE-2022-35506/): Memory corruption in triplecross project:triplecross (high 7.5)
- [CVE-2022-35505](https://insights.sbomify.com/CVE-2022-35505/): Denial of service in triplecross project:triplecross (high 7.5)
- [CVE-2022-35503](https://insights.sbomify.com/CVE-2022-35503/): Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM m (high 7.5)
- [CVE-2022-35501](https://insights.sbomify.com/CVE-2022-35501/): Cross-site scripting in amasty:blog pro (medium 5.4)
- [CVE-2022-35500](https://insights.sbomify.com/CVE-2022-35500/): Cross-site scripting in amasty:blog pro (medium 5.4)
- [CVE-2022-3550](https://insights.sbomify.com/CVE-2022-3550/): X.org Server xkb.c _GetCountedString buffer overflow (medium 5.5)
- [CVE-2022-35499](https://insights.sbomify.com/CVE-2022-35499/): In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary p (high 7.1)
- [CVE-2022-35497](https://insights.sbomify.com/CVE-2022-35497/): In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via re (medium 5.4)
- [CVE-2022-35493](https://insights.sbomify.com/CVE-2022-35493/): Cross-site scripting in wrteam:eshop - ecommerce \/ store website (medium 6.1)
- [CVE-2022-35491](https://insights.sbomify.com/CVE-2022-35491/): Hardcoded credentials in totolink:a3002ru firmware (critical 9.8)
- [CVE-2022-35490](https://insights.sbomify.com/CVE-2022-35490/): Security feature bypass in zammad:zammad (critical 9.8)
- [CVE-2022-3549](https://insights.sbomify.com/CVE-2022-3549/): SourceCodester Simple Cold Storage Management System Avatar unrestricted upload (medium 4.7)
- [CVE-2022-35489](https://insights.sbomify.com/CVE-2022-35489/): Missing authorization in zammad:zammad (medium 6.5)
- [CVE-2022-35488](https://insights.sbomify.com/CVE-2022-35488/): Business logic in zammad:zammad (high 7.5)
- [CVE-2022-35487](https://insights.sbomify.com/CVE-2022-35487/): Missing authorization in zammad:zammad (high 7.5)
- [CVE-2022-35486](https://insights.sbomify.com/CVE-2022-35486/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35485](https://insights.sbomify.com/CVE-2022-35485/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35484](https://insights.sbomify.com/CVE-2022-35484/): Null dereference in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35483](https://insights.sbomify.com/CVE-2022-35483/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35482](https://insights.sbomify.com/CVE-2022-35482/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35481](https://insights.sbomify.com/CVE-2022-35481/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-3548](https://insights.sbomify.com/CVE-2022-3548/): SourceCodester Simple Cold Storage Management System Add New Storage cross site scripting (low 2.4)
- [CVE-2022-35479](https://insights.sbomify.com/CVE-2022-35479/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35478](https://insights.sbomify.com/CVE-2022-35478/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35477](https://insights.sbomify.com/CVE-2022-35477/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35476](https://insights.sbomify.com/CVE-2022-35476/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35475](https://insights.sbomify.com/CVE-2022-35475/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35474](https://insights.sbomify.com/CVE-2022-35474/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35473](https://insights.sbomify.com/CVE-2022-35473/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35472](https://insights.sbomify.com/CVE-2022-35472/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35471](https://insights.sbomify.com/CVE-2022-35471/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35470](https://insights.sbomify.com/CVE-2022-35470/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-3547](https://insights.sbomify.com/CVE-2022-3547/): SourceCodester Simple Cold Storage Management System Setting cross site scripting (low 2.4)
- [CVE-2022-35469](https://insights.sbomify.com/CVE-2022-35469/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35468](https://insights.sbomify.com/CVE-2022-35468/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35467](https://insights.sbomify.com/CVE-2022-35467/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35466](https://insights.sbomify.com/CVE-2022-35466/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35465](https://insights.sbomify.com/CVE-2022-35465/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35464](https://insights.sbomify.com/CVE-2022-35464/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35463](https://insights.sbomify.com/CVE-2022-35463/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35462](https://insights.sbomify.com/CVE-2022-35462/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35461](https://insights.sbomify.com/CVE-2022-35461/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35460](https://insights.sbomify.com/CVE-2022-35460/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-3546](https://insights.sbomify.com/CVE-2022-3546/): SourceCodester Simple Cold Storage Management System Create User cross site scripting (low 2.4)
- [CVE-2022-35459](https://insights.sbomify.com/CVE-2022-35459/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35458](https://insights.sbomify.com/CVE-2022-35458/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35456](https://insights.sbomify.com/CVE-2022-35456/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35455](https://insights.sbomify.com/CVE-2022-35455/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35454](https://insights.sbomify.com/CVE-2022-35454/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35453](https://insights.sbomify.com/CVE-2022-35453/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35452](https://insights.sbomify.com/CVE-2022-35452/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35451](https://insights.sbomify.com/CVE-2022-35451/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35450](https://insights.sbomify.com/CVE-2022-35450/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-3545](https://insights.sbomify.com/CVE-2022-3545/): Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free (medium 5.5)
- [CVE-2022-35449](https://insights.sbomify.com/CVE-2022-35449/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35448](https://insights.sbomify.com/CVE-2022-35448/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-35447](https://insights.sbomify.com/CVE-2022-35447/): Memory corruption in otfcc project:otfcc (medium 6.5)
- [CVE-2022-3544](https://insights.sbomify.com/CVE-2022-3544/): Linux Kernel Netfilter sysfs.c damon_sysfs_add_target memory leak (low 3.5)
- [CVE-2022-35434](https://insights.sbomify.com/CVE-2022-35434/): Denial of service in jpeg quant smooth project:jpeg quant smooth (medium 5.5)
- [CVE-2022-35433](https://insights.sbomify.com/CVE-2022-35433/): Denial of service in ffjpeg project:ffjpeg (medium 6.5)
- [CVE-2022-3543](https://insights.sbomify.com/CVE-2022-3543/): Linux Kernel BPF af_unix.c unix_release_sock memory leak (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/286/