# Vulnerabilities published in 2022


- [CVE-2022-34185](https://insights.sbomify.com/CVE-2022-34185/): Cross-site Scripting in Jenkins Date Parameter Plugin (medium 5.4)
- [CVE-2022-34184](https://insights.sbomify.com/CVE-2022-34184/): Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin (medium 5.4)
- [CVE-2022-34183](https://insights.sbomify.com/CVE-2022-34183/): Cross-site Scripting in Jenkins Agent Server Parameter Plugin (medium 5.4)
- [CVE-2022-34182](https://insights.sbomify.com/CVE-2022-34182/): Reflected Cross-site Scripting in Jenkins Nested View Plugin (medium 6.1)
- [CVE-2022-34181](https://insights.sbomify.com/CVE-2022-34181/): Agent-to-controller security bypass in Jenkins xUnit Plugin (critical 9.1)
- [CVE-2022-34180](https://insights.sbomify.com/CVE-2022-34180/): Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement (high 7.5)
- [CVE-2022-3418](https://insights.sbomify.com/CVE-2022-3418/): WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE (high 7.2)
- [CVE-2022-34179](https://insights.sbomify.com/CVE-2022-34179/): Path Traversal vulnerability in Jenkins Embeddable Build Status Plugin (high 7.5)
- [CVE-2022-34178](https://insights.sbomify.com/CVE-2022-34178/): Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin (medium 6.1)
- [CVE-2022-34177](https://insights.sbomify.com/CVE-2022-34177/): Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin (high 7.5)
- [CVE-2022-34176](https://insights.sbomify.com/CVE-2022-34176/): Cross-site Scripting in Jenkins JUnit Plugin (medium 5.4)
- [CVE-2022-34175](https://insights.sbomify.com/CVE-2022-34175/): Unauthorized view fragment access in Jenkins (high 7.5)
- [CVE-2022-34174](https://insights.sbomify.com/CVE-2022-34174/): Observable timing discrepancy allows determining username validity in Jenkins (high 7.5)
- [CVE-2022-34173](https://insights.sbomify.com/CVE-2022-34173/): Cross-site Scripting vulnerability in Jenkins (medium 5.4)
- [CVE-2022-34172](https://insights.sbomify.com/CVE-2022-34172/): Cross-site Scripting vulnerability in Jenkins (medium 5.4)
- [CVE-2022-34171](https://insights.sbomify.com/CVE-2022-34171/): Cross-site Scripting vulnerability in Jenkins (medium 5.4)
- [CVE-2022-34170](https://insights.sbomify.com/CVE-2022-34170/): Cross-site Scripting vulnerability in Jenkins (medium 5.4)
- [CVE-2022-3417](https://insights.sbomify.com/CVE-2022-3417/): WPtouch < 4.3.45 - Admin+ PHP Object Injection (high 8.8)
- [CVE-2022-34169](https://insights.sbomify.com/CVE-2022-34169/): Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets (high 7.5)
- [CVE-2022-34167](https://insights.sbomify.com/CVE-2022-34167/): Cross-site scripting in CICS TX Advanced (medium 5.4)
- [CVE-2022-34166](https://insights.sbomify.com/CVE-2022-34166/): Cross-site scripting in CICS TX Advanced (medium 5.4)
- [CVE-2022-34165](https://insights.sbomify.com/CVE-2022-34165/): Other in WebSphere Application Server (medium 5.4)
- [CVE-2022-34164](https://insights.sbomify.com/CVE-2022-34164/): Auth bypass in CICS TX Advanced (medium 5.9)
- [CVE-2022-34163](https://insights.sbomify.com/CVE-2022-34163/): Cross-site scripting in CICS TX Advanced (medium 5.4)
- [CVE-2022-34162](https://insights.sbomify.com/CVE-2022-34162/): Other in CICS TX Advanced (medium 5.4)
- [CVE-2022-34161](https://insights.sbomify.com/CVE-2022-34161/): Cross-site request forgery in CICS TX Advanced (medium 4.3)
- [CVE-2022-34160](https://insights.sbomify.com/CVE-2022-34160/): Cross-site scripting in CICS TX Advanced (medium 5.4)
- [CVE-2022-3416](https://insights.sbomify.com/CVE-2022-3416/): WPtouch < 4.3.45 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2022-34159](https://insights.sbomify.com/CVE-2022-34159/): Denial of service in CV81-WDM FW (high 7.5)
- [CVE-2022-34158](https://insights.sbomify.com/CVE-2022-34158/): User Group Privilege Escalation (high 8.8)
- [CVE-2022-34157](https://insights.sbomify.com/CVE-2022-34157/): Privilege escalation in Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software (medium 6.7)
- [CVE-2022-34156](https://insights.sbomify.com/CVE-2022-34156/): Weak cryptography in 'Hulu / フールー' App for iOS (medium 4.8)
- [CVE-2022-34155](https://insights.sbomify.com/CVE-2022-34155/): WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication (high 8.8)
- [CVE-2022-34154](https://insights.sbomify.com/CVE-2022-34154/): WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerability (high 7.2)
- [CVE-2022-34153](https://insights.sbomify.com/CVE-2022-34153/): Privilege escalation in Intel(R) Battery Life Diagnostic Tool software (high 8.2)
- [CVE-2022-34152](https://insights.sbomify.com/CVE-2022-34152/): Privilege escalation in Intel(R) NUC Boards, Intel(R) NUC Kits (high 7.7)
- [CVE-2022-34151](https://insights.sbomify.com/CVE-2022-34151/): Hardcoded credentials in Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series (critical 9.4)
- [CVE-2022-34150](https://insights.sbomify.com/CVE-2022-34150/): ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key (high 7.1)
- [CVE-2022-3415](https://insights.sbomify.com/CVE-2022-3415/): Chat Bubble < 2.3 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2022-34149](https://insights.sbomify.com/CVE-2022-34149/): WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability (critical 9.8)
- [CVE-2022-34148](https://insights.sbomify.com/CVE-2022-34148/): WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-34147](https://insights.sbomify.com/CVE-2022-34147/): Privilege escalation in Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element (high 7.5)
- [CVE-2022-34146](https://insights.sbomify.com/CVE-2022-34146/): Improper input validation in WLAN Host (high 7.5)
- [CVE-2022-34145](https://insights.sbomify.com/CVE-2022-34145/): Buffer over-read in WLAN Host (high 7.5)
- [CVE-2022-34144](https://insights.sbomify.com/CVE-2022-34144/): Reachable assertion in Modem (high 7.5)
- [CVE-2022-34140](https://insights.sbomify.com/CVE-2022-34140/): Feehi CMS Cross-site Scripting (medium 5.4)
- [CVE-2022-3414](https://insights.sbomify.com/CVE-2022-3414/): SourceCodester Web-Based Student Clearance System POST Parameter login.php sql injection (medium 5.0)
- [CVE-2022-34138](https://insights.sbomify.com/CVE-2022-34138/): Missing authorization in biltema:baby camera firmware (high 7.5)
- [CVE-2022-34134](https://insights.sbomify.com/CVE-2022-34134/): Cross-site request forgery in jorani:jorani (high 8.8)
- [CVE-2022-34133](https://insights.sbomify.com/CVE-2022-34133/): Cross-site scripting in jorani:jorani (medium 6.1)
- [CVE-2022-34132](https://insights.sbomify.com/CVE-2022-34132/): SQL injection in jorani:jorani (critical 9.8)
- [CVE-2022-3413](https://insights.sbomify.com/CVE-2022-3413/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-34128](https://insights.sbomify.com/CVE-2022-34128/): File upload in glpi-project:positions (critical 9.8)
- [CVE-2022-34127](https://insights.sbomify.com/CVE-2022-34127/): Path traversal in glpi-project:manageentities (high 7.5)
- [CVE-2022-34126](https://insights.sbomify.com/CVE-2022-34126/): Path traversal in glpi-project:activity (high 7.5)
- [CVE-2022-34125](https://insights.sbomify.com/CVE-2022-34125/): Path traversal in glpi-project:cmdb (medium 6.5)
- [CVE-2022-34121](https://insights.sbomify.com/CVE-2022-34121/): Path traversal in cuppacms:cuppacms (high 7.5)
- [CVE-2022-34120](https://insights.sbomify.com/CVE-2022-34120/): File upload in barangay management system project:barangay management system (high 7.2)
- [CVE-2022-34115](https://insights.sbomify.com/CVE-2022-34115/): Dataease v1.11.1 SQL Injection via parameter dataSourceId (critical 9.8)
- [CVE-2022-34114](https://insights.sbomify.com/CVE-2022-34114/): SQL Injection found in Dataease (high 8.8)
- [CVE-2022-34113](https://insights.sbomify.com/CVE-2022-34113/): Dataease before 1.11.2 allows arbitrary code execution via crafter plugin (critical 9.8)
- [CVE-2022-34112](https://insights.sbomify.com/CVE-2022-34112/): Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin (medium 6.5)
- [CVE-2022-34110](https://insights.sbomify.com/CVE-2022-34110/): Path traversal in msi:micro-star international feature navigator (medium 5.5)
- [CVE-2022-3411](https://insights.sbomify.com/CVE-2022-3411/): Denial of service in GitLab (medium 6.5)
- [CVE-2022-34109](https://insights.sbomify.com/CVE-2022-34109/): Other in msi:micro-star international feature navigator (high 7.1)
- [CVE-2022-34108](https://insights.sbomify.com/CVE-2022-34108/): Denial of service in msi:micro-star international feature navigator (high 7.1)
- [CVE-2022-34102](https://insights.sbomify.com/CVE-2022-34102/): Privilege escalation in crestron:airmedia (high 8.8)
- [CVE-2022-34101](https://insights.sbomify.com/CVE-2022-34101/): Privilege escalation in crestron:airmedia (high 7.8)
- [CVE-2022-34100](https://insights.sbomify.com/CVE-2022-34100/): Privilege escalation in crestron:airmedia (high 8.8)
- [CVE-2022-34094](https://insights.sbomify.com/CVE-2022-34094/): Cross-site scripting in softwarepublico:i3geo (medium 6.1)
- [CVE-2022-34093](https://insights.sbomify.com/CVE-2022-34093/): Cross-site scripting in softwarepublico:i3geo (medium 6.1)
- [CVE-2022-34092](https://insights.sbomify.com/CVE-2022-34092/): Cross-site scripting in softwarepublico:i3geo (medium 6.1)
- [CVE-2022-3409](https://insights.sbomify.com/CVE-2022-3409/): Unauthenticated out of bounds stack write in bmcweb (high 8.2)
- [CVE-2022-3408](https://insights.sbomify.com/CVE-2022-3408/): WP Word Count <= 3.2.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-3407](https://insights.sbomify.com/CVE-2022-3407/): Denial of service in Motorola smartphones (medium 4.9)
- [CVE-2022-34067](https://insights.sbomify.com/CVE-2022-34067/): SQL injection in oretnom23:warehouse management system (high 7.5)
- [CVE-2022-34066](https://insights.sbomify.com/CVE-2022-34066/): Supply chain in texercise project:texercise (critical 9.8)
- [CVE-2022-34065](https://insights.sbomify.com/CVE-2022-34065/): Supply chain in rondolu-yt-concate project:rondolu-yt-concate (critical 9.8)
- [CVE-2022-34064](https://insights.sbomify.com/CVE-2022-34064/): Supply chain in zibal project:zibal (critical 9.8)
- [CVE-2022-34061](https://insights.sbomify.com/CVE-2022-34061/): Supply chain in catly translate project:catly translate (critical 9.8)
- [CVE-2022-34060](https://insights.sbomify.com/CVE-2022-34060/): Supply chain in togglee:togglee (critical 9.8)
- [CVE-2022-34059](https://insights.sbomify.com/CVE-2022-34059/): Supply chain in sixfab-tool project:sixfab-tool (critical 9.8)
- [CVE-2022-34057](https://insights.sbomify.com/CVE-2022-34057/): Supply chain in scoptrial project:scoptrial (critical 9.8)
- [CVE-2022-34056](https://insights.sbomify.com/CVE-2022-34056/): Supply chain in pypi:watertools (critical 9.8)
- [CVE-2022-34055](https://insights.sbomify.com/CVE-2022-34055/): Supply chain in pypi:drxhello (critical 9.8)
- [CVE-2022-34054](https://insights.sbomify.com/CVE-2022-34054/): Supply chain in pypi:perdido (critical 9.8)
- [CVE-2022-34053](https://insights.sbomify.com/CVE-2022-34053/): Supply chain in pypi:dr-web-engine (critical 9.8)
- [CVE-2022-3405](https://insights.sbomify.com/CVE-2022-3405/): Privilege escalation in Acronis Cyber Backup 12.5 (critical 9.3)
- [CVE-2022-34049](https://insights.sbomify.com/CVE-2022-34049/): Missing authorization in wavlink:wl-wn530hg4 firmware (medium 5.3)
- [CVE-2022-34048](https://insights.sbomify.com/CVE-2022-34048/): Cross-site scripting in wavlink:wn533a8 firmware (medium 6.1)
- [CVE-2022-34047](https://insights.sbomify.com/CVE-2022-34047/): Information disclosure in wavlink:wl-wn530hg4 firmware (high 7.5)
- [CVE-2022-34046](https://insights.sbomify.com/CVE-2022-34046/): Information disclosure in wavlink:wn533a8 firmware (high 7.5)
- [CVE-2022-34045](https://insights.sbomify.com/CVE-2022-34045/): Hardcoded credentials in wavlink:wl-wn530hg4 firmware (critical 9.8)
- [CVE-2022-34043](https://insights.sbomify.com/CVE-2022-34043/): Misconfiguration in nomachine:nomachine (high 7.3)
- [CVE-2022-34042](https://insights.sbomify.com/CVE-2022-34042/): SQL injection in barangay management system project:barangay management system (high 7.2)
- [CVE-2022-34038](https://insights.sbomify.com/CVE-2022-34038/): Memory corruption in etcd:etcd (high 7.5)
- [CVE-2022-34037](https://insights.sbomify.com/CVE-2022-34037/): Denial of service in caddyserver:caddy (high 7.5)
- [CVE-2022-34035](https://insights.sbomify.com/CVE-2022-34035/): Memory corruption in htmldoc project:htmldoc (high 7.5)
- [CVE-2022-34033](https://insights.sbomify.com/CVE-2022-34033/): Memory corruption in htmldoc project:htmldoc (high 7.5)
- [CVE-2022-34032](https://insights.sbomify.com/CVE-2022-34032/): Memory corruption in f5:njs (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/297/