# Vulnerabilities published in 2022


- [CVE-2022-35426](https://insights.sbomify.com/CVE-2022-35426/): File upload in ucms project:ucms (critical 9.8)
- [CVE-2022-35422](https://insights.sbomify.com/CVE-2022-35422/): SQL injection in web based quiz system project:web based quiz system (critical 9.8)
- [CVE-2022-35421](https://insights.sbomify.com/CVE-2022-35421/): SQL injection in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-35416](https://insights.sbomify.com/CVE-2022-35416/): Cross-site scripting in h3c:ssl vpn (medium 6.1)
- [CVE-2022-35415](https://insights.sbomify.com/CVE-2022-35415/): Privilege escalation in ni:configuration manager (high 7.8)
- [CVE-2022-35414](https://insights.sbomify.com/CVE-2022-35414/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2022-35413](https://insights.sbomify.com/CVE-2022-35413/): Hardcoded credentials in pentasecurity:wapples (critical 9.8)
- [CVE-2022-35412](https://insights.sbomify.com/CVE-2022-35412/): Security feature bypass in digitalguardian:digital guardian (medium 5.1)
- [CVE-2022-35411](https://insights.sbomify.com/CVE-2022-35411/): rpc.py vulnerable to Deserialization of Untrusted Data (critical 9.8)
- [CVE-2022-35410](https://insights.sbomify.com/CVE-2022-35410/): mat2 before 0.13.0 allows directory traversal during the ZIP archive cleaning process. (high 7.5)
- [CVE-2022-3541](https://insights.sbomify.com/CVE-2022-3541/): Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after free (medium 5.5)
- [CVE-2022-35409](https://insights.sbomify.com/CVE-2022-35409/): Memory corruption in arm:mbed tls (critical 9.1)
- [CVE-2022-35408](https://insights.sbomify.com/CVE-2022-35408/): Privilege escalation in insyde:insydeh2o (high 8.2)
- [CVE-2022-35407](https://insights.sbomify.com/CVE-2022-35407/): Memory corruption in insyde:kernel (high 7.8)
- [CVE-2022-35406](https://insights.sbomify.com/CVE-2022-35406/): Open redirect in portswigger:burp suite (medium 4.3)
- [CVE-2022-35405](https://insights.sbomify.com/CVE-2022-35405/): Zoho ManageEngine Multiple Products Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-35404](https://insights.sbomify.com/CVE-2022-35404/): Other in zohocorp:manageengine firewall analyzer (high 8.2)
- [CVE-2022-35403](https://insights.sbomify.com/CVE-2022-35403/): Information disclosure in zohocorp:manageengine assetexplorer (high 7.5)
- [CVE-2022-35401](https://insights.sbomify.com/CVE-2022-35401/): Auth bypass in RT-AX82U (critical 9.0)
- [CVE-2022-3540](https://insights.sbomify.com/CVE-2022-3540/): Information disclosure in hunter2 (medium 6.5)
- [CVE-2022-3539](https://insights.sbomify.com/CVE-2022-3539/): Testimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-3538](https://insights.sbomify.com/CVE-2022-3538/): Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation (medium 6.5)
- [CVE-2022-3537](https://insights.sbomify.com/CVE-2022-3537/): Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File Upload (high 8.8)
- [CVE-2022-3536](https://insights.sbomify.com/CVE-2022-3536/): Role Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR Deserialization (high 8.8)
- [CVE-2022-3534](https://insights.sbomify.com/CVE-2022-3534/): Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free (medium 5.1)
- [CVE-2022-3533](https://insights.sbomify.com/CVE-2022-3533/): Linux Kernel BPF usdt.c parse_usdt_arg memory leak (low 3.5)
- [CVE-2022-35299](https://insights.sbomify.com/CVE-2022-35299/): Memory corruption in SAP IQ (critical 9.8)
- [CVE-2022-35298](https://insights.sbomify.com/CVE-2022-35298/): Cross-site scripting in SAP NetWeaver Enterprise Portal (KMC) (medium 6.1)
- [CVE-2022-35297](https://insights.sbomify.com/CVE-2022-35297/): Cross-site scripting in SAP Enable Now (medium 5.4)
- [CVE-2022-35296](https://insights.sbomify.com/CVE-2022-35296/): Information disclosure in SAP BusinessObjects Business Intelligence Platform (Version Management System) (medium 4.9)
- [CVE-2022-35295](https://insights.sbomify.com/CVE-2022-35295/): Privilege escalation in SAP Host Agent (SAPOSCOL) (medium 4.9)
- [CVE-2022-35294](https://insights.sbomify.com/CVE-2022-35294/): Cross-site scripting in SAP NetWeaver AS ABAP (medium 5.4)
- [CVE-2022-35293](https://insights.sbomify.com/CVE-2022-35293/): Auth bypass in SAP Enable Now Manager (critical 9.1)
- [CVE-2022-35292](https://insights.sbomify.com/CVE-2022-35292/): Privilege escalation in SAP Business One (high 7.8)
- [CVE-2022-35291](https://insights.sbomify.com/CVE-2022-35291/): Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS) (high 8.1)
- [CVE-2022-35290](https://insights.sbomify.com/CVE-2022-35290/): Information disclosure in SAP Authenticator for Android (high 7.5)
- [CVE-2022-35289](https://insights.sbomify.com/CVE-2022-35289/): Integer overflow in Hermes (critical 9.8)
- [CVE-2022-35288](https://insights.sbomify.com/CVE-2022-35288/): Information disclosure in Security Verify Information Queue (medium 5.3)
- [CVE-2022-35287](https://insights.sbomify.com/CVE-2022-35287/): Hardcoded credentials in Security Verify Information Queue (medium 6.8)
- [CVE-2022-35286](https://insights.sbomify.com/CVE-2022-35286/): Cross-site request forgery in Security Verify Information Queue (low 3.1)
- [CVE-2022-35285](https://insights.sbomify.com/CVE-2022-35285/): Cross-site request forgery in Security Verify Information Queue (medium 6.5)
- [CVE-2022-35284](https://insights.sbomify.com/CVE-2022-35284/): Information disclosure in Security Verify Information Queue (medium 5.3)
- [CVE-2022-35283](https://insights.sbomify.com/CVE-2022-35283/): Denial of service in Security Verify Information Queue (medium 6.5)
- [CVE-2022-35282](https://insights.sbomify.com/CVE-2022-35282/): Server-side request forgery in WebSphere Application Server (medium 4.3)
- [CVE-2022-35281](https://insights.sbomify.com/CVE-2022-35281/): IBM Maximo Application Suite command injection (medium 5.5)
- [CVE-2022-35280](https://insights.sbomify.com/CVE-2022-35280/): Misconfiguration in Robotic Process Automation (medium 4.6)
- [CVE-2022-35279](https://insights.sbomify.com/CVE-2022-35279/): Information disclosure in IBM Business Automation Workflow (medium 4.3)
- [CVE-2022-35278](https://insights.sbomify.com/CVE-2022-35278/): HTML Injection in ActiveMQ Artemis Web Console (medium 6.1)
- [CVE-2022-35277](https://insights.sbomify.com/CVE-2022-35277/): WordPress GetResponse plugin <= 5.5.20 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-35276](https://insights.sbomify.com/CVE-2022-35276/): Privilege escalation in Intel(R) NUC 8 Compute Elements (high 7.5)
- [CVE-2022-35275](https://insights.sbomify.com/CVE-2022-35275/): Cross-site scripting in Advanced Order Export For WooCommerce (WordPress plugin) (medium 4.8)
- [CVE-2022-35273](https://insights.sbomify.com/CVE-2022-35273/): Command injection in CentreCOM AR260S V2 (high 8.8)
- [CVE-2022-35272](https://insights.sbomify.com/CVE-2022-35272/): BIG-IP HTTP MRF vulnerability CVE-2022-35272 (high 7.5)
- [CVE-2022-35271](https://insights.sbomify.com/CVE-2022-35271/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35270](https://insights.sbomify.com/CVE-2022-35270/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35269](https://insights.sbomify.com/CVE-2022-35269/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35268](https://insights.sbomify.com/CVE-2022-35268/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35267](https://insights.sbomify.com/CVE-2022-35267/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35266](https://insights.sbomify.com/CVE-2022-35266/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35265](https://insights.sbomify.com/CVE-2022-35265/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35264](https://insights.sbomify.com/CVE-2022-35264/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35263](https://insights.sbomify.com/CVE-2022-35263/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35262](https://insights.sbomify.com/CVE-2022-35262/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35261](https://insights.sbomify.com/CVE-2022-35261/): Denial of service in R1510 (medium 4.9)
- [CVE-2022-35260](https://insights.sbomify.com/CVE-2022-35260/): Memory corruption in https://github.com/curl/curl (medium 6.5)
- [CVE-2022-3526](https://insights.sbomify.com/CVE-2022-3526/): Linux Kernel skb macvlan.c macvlan_handle_frame memory leak (medium 5.3)
- [CVE-2022-35259](https://insights.sbomify.com/CVE-2022-35259/): Code injection in Ivanti Endpoint Manager (high 7.8)
- [CVE-2022-35258](https://insights.sbomify.com/CVE-2022-35258/): Denial of service in Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access Gateway (high 7.5)
- [CVE-2022-35257](https://insights.sbomify.com/CVE-2022-35257/): Privilege escalation in UI Desktop for Windows (high 7.8)
- [CVE-2022-35256](https://insights.sbomify.com/CVE-2022-35256/): Other in Node (medium 6.5)
- [CVE-2022-35255](https://insights.sbomify.com/CVE-2022-35255/): Weak cryptography in Node (critical 9.1)
- [CVE-2022-35254](https://insights.sbomify.com/CVE-2022-35254/): Denial of service in Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access Gateway (high 7.5)
- [CVE-2022-35252](https://insights.sbomify.com/CVE-2022-35252/): Denial of service in https://github.com/curl/curl (low 3.7)
- [CVE-2022-35251](https://insights.sbomify.com/CVE-2022-35251/): Cross-site scripting in Rocket.chat (medium 5.4)
- [CVE-2022-35250](https://insights.sbomify.com/CVE-2022-35250/): Missing authorization in Rocket.chat (medium 4.3)
- [CVE-2022-3525](https://insights.sbomify.com/CVE-2022-3525/): Deserialization of Untrusted Data in librenms/librenms (critical 9.0)
- [CVE-2022-35249](https://insights.sbomify.com/CVE-2022-35249/): Missing authorization in Rocket.Chat (medium 4.3)
- [CVE-2022-35248](https://insights.sbomify.com/CVE-2022-35248/): Auth bypass in Rocket.Chat (high 8.8)
- [CVE-2022-35247](https://insights.sbomify.com/CVE-2022-35247/): Missing authorization in Rocket.Chat (medium 4.3)
- [CVE-2022-35246](https://insights.sbomify.com/CVE-2022-35246/): Information disclosure in Rocket.Chat (medium 4.3)
- [CVE-2022-35245](https://insights.sbomify.com/CVE-2022-35245/): BIG-IP APM access policy vulnerability CVE-2022-35245 (high 7.5)
- [CVE-2022-35244](https://insights.sbomify.com/CVE-2022-35244/): Memory corruption in iota All-In-One Security Kit (critical 9.8)
- [CVE-2022-35243](https://insights.sbomify.com/CVE-2022-35243/): Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243 (high 8.7)
- [CVE-2022-35242](https://insights.sbomify.com/CVE-2022-35242/): Missing authorization in THE Leads Management System: 59sec LITE (WordPress plugin) (medium 6.5)
- [CVE-2022-35241](https://insights.sbomify.com/CVE-2022-35241/): NGINX Instance Manager vulnerability CVE-2022-35241 (medium 6.5)
- [CVE-2022-35240](https://insights.sbomify.com/CVE-2022-35240/): BIG-IP Message Routing MQTT vulnerability CVE-2022-35240 (high 7.5)
- [CVE-2022-3524](https://insights.sbomify.com/CVE-2022-3524/): Linux Kernel IPv6 ipv6_renew_options memory leak (medium 4.3)
- [CVE-2022-35239](https://insights.sbomify.com/CVE-2022-35239/): File upload in SolarView Compact (high 8.8)
- [CVE-2022-35238](https://insights.sbomify.com/CVE-2022-35238/): WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability (medium 6.5)
- [CVE-2022-35236](https://insights.sbomify.com/CVE-2022-35236/): HTTP2 profile vulnerability CVE-2022-35236 (high 7.5)
- [CVE-2022-35235](https://insights.sbomify.com/CVE-2022-35235/): WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability (medium 4.9)
- [CVE-2022-35234](https://insights.sbomify.com/CVE-2022-35234/): Memory corruption in Trend Micro Security(Consumer) (high 7.1)
- [CVE-2022-35230](https://insights.sbomify.com/CVE-2022-35230/): Reflected XSS in graphs page of Zabbix Frontend (low 3.7)
- [CVE-2022-3523](https://insights.sbomify.com/CVE-2022-3523/): Linux Kernel Driver memory.c use after free (medium 5.3)
- [CVE-2022-35229](https://insights.sbomify.com/CVE-2022-35229/): Reflected XSS in discovery page of Zabbix Frontend (low 3.7)
- [CVE-2022-35228](https://insights.sbomify.com/CVE-2022-35228/): Cross-site request forgery in SAP BusinessObjects Business Intelligence Platform (Central management Console) (high 8.8)
- [CVE-2022-35227](https://insights.sbomify.com/CVE-2022-35227/): Cross-site scripting in SAP NetWeaver Enterprise Portal (WPC) (medium 6.1)
- [CVE-2022-35226](https://insights.sbomify.com/CVE-2022-35226/): Cross-site scripting in SAP Data Services Management Console (medium 6.1)
- [CVE-2022-35225](https://insights.sbomify.com/CVE-2022-35225/): Cross-site scripting in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2022-35224](https://insights.sbomify.com/CVE-2022-35224/): Cross-site scripting in SAP Enterprise Portal (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/287/