# Vulnerabilities published in 2022


- [CVE-2022-34835](https://insights.sbomify.com/CVE-2022-34835/): Memory corruption in denx:u-boot (critical 9.8)
- [CVE-2022-34834](https://insights.sbomify.com/CVE-2022-34834/): Cross-site scripting in vermeg:agile reporter (medium 4.8)
- [CVE-2022-34833](https://insights.sbomify.com/CVE-2022-34833/): Cross-site scripting in vermeg:agile reporter (medium 5.4)
- [CVE-2022-34832](https://insights.sbomify.com/CVE-2022-34832/): XML external entity in vermeg:agile reporter (medium 6.5)
- [CVE-2022-34831](https://insights.sbomify.com/CVE-2022-34831/): Security feature bypass in primekey:ejbca (critical 9.8)
- [CVE-2022-34830](https://insights.sbomify.com/CVE-2022-34830/): Race condition in arm:utgard gpu kernel driver (high 7.5)
- [CVE-2022-3483](https://insights.sbomify.com/CVE-2022-3483/): Information disclosure in GitLab (medium 5.5)
- [CVE-2022-34829](https://insights.sbomify.com/CVE-2022-34829/): Denial of service in zohocorp:manageengine adselfservice plus (high 7.5)
- [CVE-2022-34827](https://insights.sbomify.com/CVE-2022-34827/): Missing authorization in carel:boss mini firmware (high 8.8)
- [CVE-2022-34826](https://insights.sbomify.com/CVE-2022-34826/): Information disclosure in couchbase:couchbase server (medium 5.9)
- [CVE-2022-34825](https://insights.sbomify.com/CVE-2022-34825/): Other in CLUSTERPRO X (critical 9.8)
- [CVE-2022-34824](https://insights.sbomify.com/CVE-2022-34824/): Misconfiguration in CLUSTERPRO X (critical 9.8)
- [CVE-2022-34823](https://insights.sbomify.com/CVE-2022-34823/): Memory corruption in CLUSTERPRO X (critical 9.8)
- [CVE-2022-34822](https://insights.sbomify.com/CVE-2022-34822/): Path traversal in CLUSTERPRO X (critical 9.8)
- [CVE-2022-34821](https://insights.sbomify.com/CVE-2022-34821/): Code injection in RUGGEDCOM RM1224 LTE(4G) EU (high 8.8)
- [CVE-2022-34820](https://insights.sbomify.com/CVE-2022-34820/): Command injection in SIMATIC CP 1242-7 V2 (high 8.4)
- [CVE-2022-3482](https://insights.sbomify.com/CVE-2022-3482/): Missing authorization in GitLab (medium 5.3)
- [CVE-2022-34819](https://insights.sbomify.com/CVE-2022-34819/): Memory corruption in SIMATIC CP 1242-7 V2 (critical 10.0)
- [CVE-2022-34818](https://insights.sbomify.com/CVE-2022-34818/): Jenkins Failed Job Deactivator Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-34817](https://insights.sbomify.com/CVE-2022-34817/): Cross-Site Request Forgery in Jenkins Failed Job Deactivator Plugin (medium 4.3)
- [CVE-2022-34816](https://insights.sbomify.com/CVE-2022-34816/): Passwords stored in plain text by Jenkins hpe-network-virtualization plugin (medium 6.5)
- [CVE-2022-34815](https://insights.sbomify.com/CVE-2022-34815/): Cross-Site Request Forgery in Jenkins Request Rename Or Delete Plugin (medium 4.3)
- [CVE-2022-34814](https://insights.sbomify.com/CVE-2022-34814/): Incorrect Authorization in Jenkins Request Rename Or Delete Plugin (medium 4.3)
- [CVE-2022-34813](https://insights.sbomify.com/CVE-2022-34813/): Jenkins XPath Configuration Viewer Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-34812](https://insights.sbomify.com/CVE-2022-34812/): Cross-Site Request Forgery in Jenkins XPath Configuration Viewer Plugin (medium 4.3)
- [CVE-2022-34811](https://insights.sbomify.com/CVE-2022-34811/): Missing Authorization in Jenkins XPath Configuration Viewer Plugin (medium 4.3)
- [CVE-2022-34810](https://insights.sbomify.com/CVE-2022-34810/): Jenkins RQM Plugin allows enumerating credentials IDs due to missing permission check (medium 6.5)
- [CVE-2022-3481](https://insights.sbomify.com/CVE-2022-3481/): WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-34809](https://insights.sbomify.com/CVE-2022-34809/): Password stored in plain text by Jenkins RQM Plugin (medium 6.5)
- [CVE-2022-34808](https://insights.sbomify.com/CVE-2022-34808/): Token stored in plain text by Jenkins Cisco Spark Plugin (medium 4.3)
- [CVE-2022-34807](https://insights.sbomify.com/CVE-2022-34807/): Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin (medium 6.5)
- [CVE-2022-34806](https://insights.sbomify.com/CVE-2022-34806/): Plaintext Storage of a Password in Jenkins Jigomerge Plugin (medium 6.5)
- [CVE-2022-34805](https://insights.sbomify.com/CVE-2022-34805/): Plaintext Storage of a Password in Jenkins Skype notifier Plugin (medium 6.5)
- [CVE-2022-34804](https://insights.sbomify.com/CVE-2022-34804/): Jenkins OpsGenie Plugin vulnerable to Cleartext Transmission of Sensitive Information (medium 4.3)
- [CVE-2022-34803](https://insights.sbomify.com/CVE-2022-34803/): Jenkins OpsGenie Plugin Plaintext Storage of a Password vulnerability (medium 4.3)
- [CVE-2022-34802](https://insights.sbomify.com/CVE-2022-34802/): Plaintext Storage of a Password in Jenkins RocketChat Notifier Plugin (medium 4.3)
- [CVE-2022-34801](https://insights.sbomify.com/CVE-2022-34801/): Cleartext Storage of Sensitive Information in Jenkins Build Notifications Plugin (medium 4.3)
- [CVE-2022-34800](https://insights.sbomify.com/CVE-2022-34800/): Plaintext Storage of a Password in Jenkins Build Notifications Plugin (medium 4.3)
- [CVE-2022-3480](https://insights.sbomify.com/CVE-2022-3480/): Denial-of-Service vulnerability in PHOENIX CONTACT mGuard product family (high 7.5)
- [CVE-2022-34799](https://insights.sbomify.com/CVE-2022-34799/): Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin (medium 4.3)
- [CVE-2022-34798](https://insights.sbomify.com/CVE-2022-34798/): Missing Authorization in Jenkins Deployment Dashboard Plugin (medium 4.3)
- [CVE-2022-34797](https://insights.sbomify.com/CVE-2022-34797/): Cross-Site Request Forgery in Jenkins Deployment Dashboard Plugin (medium 4.3)
- [CVE-2022-34796](https://insights.sbomify.com/CVE-2022-34796/): Jenkins Deployment Dashboard Plugin has Insufficiently Protected Credentials (medium 4.3)
- [CVE-2022-34795](https://insights.sbomify.com/CVE-2022-34795/): Cross-site Scripting in Jenkins Deployment Dashboard Plugin (medium 5.4)
- [CVE-2022-34794](https://insights.sbomify.com/CVE-2022-34794/): Missing Authorization in Jenkins Recipe Plugin (medium 6.5)
- [CVE-2022-34793](https://insights.sbomify.com/CVE-2022-34793/): XML External Entity Reference in Jenkins Recipe Plugin (high 8.8)
- [CVE-2022-34792](https://insights.sbomify.com/CVE-2022-34792/): Cross-Site Request Forgery in Jenkins Recipe Plugin (high 8.0)
- [CVE-2022-34791](https://insights.sbomify.com/CVE-2022-34791/): Cross-site Scripting in Jenkins Validating Email Parameter Plugin (medium 5.4)
- [CVE-2022-34790](https://insights.sbomify.com/CVE-2022-34790/): Cross-site Scripting in Jenkins eXtreme Feedback Panel Plugin (medium 5.4)
- [CVE-2022-3479](https://insights.sbomify.com/CVE-2022-3479/): Denial of service in nss (high 7.5)
- [CVE-2022-34789](https://insights.sbomify.com/CVE-2022-34789/): Jenkins Matrix Reloaded Plugin vulnerable to CSRF (medium 6.5)
- [CVE-2022-34788](https://insights.sbomify.com/CVE-2022-34788/): Jenkins Matrix Reloaded Plugin vulnerable to Stored XSS (medium 5.4)
- [CVE-2022-34787](https://insights.sbomify.com/CVE-2022-34787/): Jenkins Project Inheritance Plugin vulnerable to cross site scripting (medium 5.4)
- [CVE-2022-34786](https://insights.sbomify.com/CVE-2022-34786/): Cross-site Scripting in Jenkins Rich Text Publisher Plugin (medium 5.4)
- [CVE-2022-34785](https://insights.sbomify.com/CVE-2022-34785/): Jenkins build-metrics Plugin Missing Authorization vulnerability (medium 4.3)
- [CVE-2022-34784](https://insights.sbomify.com/CVE-2022-34784/): Cross site scripting in Jenkins build-metrics Plugin (medium 5.4)
- [CVE-2022-34783](https://insights.sbomify.com/CVE-2022-34783/): Cross-site Scripting in Jenkins Plot Plugin (medium 5.4)
- [CVE-2022-34782](https://insights.sbomify.com/CVE-2022-34782/): Incorrect Authorization in Jenkins requests-plugin (medium 4.3)
- [CVE-2022-34781](https://insights.sbomify.com/CVE-2022-34781/): Missing permission checks in Jenkins XebiaLabs XL Release Plugin allow capturing credentials (medium 6.5)
- [CVE-2022-34780](https://insights.sbomify.com/CVE-2022-34780/): CSRF vulnerability in Jenkins XebiaLabs XL Release Plugin allow capturing credentials (medium 6.5)
- [CVE-2022-3478](https://insights.sbomify.com/CVE-2022-3478/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-34779](https://insights.sbomify.com/CVE-2022-34779/): Missing permission checks in Jenkins XebiaLabs XL Release Plugin allow enumerating credentials IDs (medium 4.3)
- [CVE-2022-34778](https://insights.sbomify.com/CVE-2022-34778/): Cross-site Scripting in Jenkins TestNG Results Plugin (medium 5.4)
- [CVE-2022-34777](https://insights.sbomify.com/CVE-2022-34777/): Cross-site Scripting in Jenkins GitLab Plugin (medium 5.4)
- [CVE-2022-34776](https://insights.sbomify.com/CVE-2022-34776/): Tabit - giftcard stealth (medium 5.5)
- [CVE-2022-34775](https://insights.sbomify.com/CVE-2022-34775/): Tabit - Excessive data exposure (medium 6.3)
- [CVE-2022-34774](https://insights.sbomify.com/CVE-2022-34774/): Tabit - Arbitrary account modification (medium 6.3)
- [CVE-2022-34773](https://insights.sbomify.com/CVE-2022-34773/): Tabit - HTTP Method manipulation (medium 4.9)
- [CVE-2022-34772](https://insights.sbomify.com/CVE-2022-34772/): Tabit - password enumeration (medium 4.3)
- [CVE-2022-34771](https://insights.sbomify.com/CVE-2022-34771/): Tabit - arbitrary SMS send on Tabits behalf (medium 5.5)
- [CVE-2022-34770](https://insights.sbomify.com/CVE-2022-34770/): Tabit - sensitive information disclosure (medium 4.6)
- [CVE-2022-3477](https://insights.sbomify.com/CVE-2022-3477/): tagDiv Composer < 3.5 - Unauthenticated Account Takeover (critical 9.8)
- [CVE-2022-34769](https://insights.sbomify.com/CVE-2022-34769/): Michlol - rashim web interface Insecure direct object references (IDOR) (medium 6.3)
- [CVE-2022-34768](https://insights.sbomify.com/CVE-2022-34768/): Synel - eHarmony Stored XSS (medium 6.5)
- [CVE-2022-34767](https://insights.sbomify.com/CVE-2022-34767/): ALLNET Gmbh - ADSL/VDSL Router inkl. Modem and Wlan Authorization Bypass (medium 5.9)
- [CVE-2022-34765](https://insights.sbomify.com/CVE-2022-34765/): Other in OPC UA Modicon Communication Module (medium 5.5)
- [CVE-2022-34764](https://insights.sbomify.com/CVE-2022-34764/): Memory corruption in OPC UA Modicon Communication Module (medium 5.9)
- [CVE-2022-34763](https://insights.sbomify.com/CVE-2022-34763/): Security feature bypass in OPC UA Modicon Communication Module (medium 5.9)
- [CVE-2022-34762](https://insights.sbomify.com/CVE-2022-34762/): Path traversal in OPC UA Modicon Communication Module (medium 5.9)
- [CVE-2022-34761](https://insights.sbomify.com/CVE-2022-34761/): Null dereference in OPC UA Modicon Communication Module (high 7.5)
- [CVE-2022-34760](https://insights.sbomify.com/CVE-2022-34760/): Denial of service in OPC UA Modicon Communication Module (high 7.5)
- [CVE-2022-34759](https://insights.sbomify.com/CVE-2022-34759/): Memory corruption in OPC UA Modicon Communication Module (high 7.5)
- [CVE-2022-34758](https://insights.sbomify.com/CVE-2022-34758/): Security feature bypass in Easergy P5 (medium 5.1)
- [CVE-2022-34757](https://insights.sbomify.com/CVE-2022-34757/): Weak cryptography in Easergy P5 (medium 6.7)
- [CVE-2022-34756](https://insights.sbomify.com/CVE-2022-34756/): Memory corruption in Easergy P5 (high 8.8)
- [CVE-2022-34755](https://insights.sbomify.com/CVE-2022-34755/): Other in Easergy Builder Installer (medium 6.3)
- [CVE-2022-34754](https://insights.sbomify.com/CVE-2022-34754/): Privilege escalation in Acti9 PowerTag Link C (medium 6.8)
- [CVE-2022-34753](https://insights.sbomify.com/CVE-2022-34753/): Command injection in SpaceLogic C-Bus Home Controller (high 8.8)
- [CVE-2022-34750](https://insights.sbomify.com/CVE-2022-34750/): Denial of service in mediawiki:mediawiki (high 7.5)
- [CVE-2022-34749](https://insights.sbomify.com/CVE-2022-34749/): Mistune vulnerable to catastrophic backtracking (high 7.5)
- [CVE-2022-34748](https://insights.sbomify.com/CVE-2022-34748/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2022-34747](https://insights.sbomify.com/CVE-2022-34747/): Memory corruption in Zyxel NAS326 firmware (critical 9.8)
- [CVE-2022-34746](https://insights.sbomify.com/CVE-2022-34746/): Weak cryptography in Zyxel GS1900 series firmware (medium 5.9)
- [CVE-2022-34743](https://insights.sbomify.com/CVE-2022-34743/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-34742](https://insights.sbomify.com/CVE-2022-34742/): Memory corruption in EMUI (high 7.5)
- [CVE-2022-34741](https://insights.sbomify.com/CVE-2022-34741/): Memory corruption in EMUI (medium 6.5)
- [CVE-2022-34740](https://insights.sbomify.com/CVE-2022-34740/): Memory corruption in EMUI (medium 6.5)
- [CVE-2022-3474](https://insights.sbomify.com/CVE-2022-3474/): Bazel leaks user credentials through the remote assets API (medium 5.1)
- [CVE-2022-34739](https://insights.sbomify.com/CVE-2022-34739/): Integer overflow in EMUI (high 7.5)
- [CVE-2022-34738](https://insights.sbomify.com/CVE-2022-34738/): Missing authorization in EMUI (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/291/