# Vulnerabilities published in 2022


- [CVE-2022-34031](https://insights.sbomify.com/CVE-2022-34031/): Memory corruption in f5:njs (high 7.5)
- [CVE-2022-34030](https://insights.sbomify.com/CVE-2022-34030/): Memory corruption in f5:njs (high 7.5)
- [CVE-2022-34029](https://insights.sbomify.com/CVE-2022-34029/): Memory corruption in f5:njs (critical 9.1)
- [CVE-2022-34028](https://insights.sbomify.com/CVE-2022-34028/): Memory corruption in f5:njs (high 7.5)
- [CVE-2022-34027](https://insights.sbomify.com/CVE-2022-34027/): Memory corruption in f5:njs (high 7.5)
- [CVE-2022-34026](https://insights.sbomify.com/CVE-2022-34026/): ICEcoder vulnerable to Path Traversal (high 7.5)
- [CVE-2022-34025](https://insights.sbomify.com/CVE-2022-34025/): Cross-site scripting in vestacp:vesta control panel (medium 6.1)
- [CVE-2022-34024](https://insights.sbomify.com/CVE-2022-34024/): File upload in barangay management system project:barangay management system (high 7.2)
- [CVE-2022-34023](https://insights.sbomify.com/CVE-2022-34023/): SQL injection in barangay management system project:barangay management system (critical 9.8)
- [CVE-2022-34022](https://insights.sbomify.com/CVE-2022-34022/): SQL injection in resiot:iot platform and lorawan network server (high 7.2)
- [CVE-2022-34021](https://insights.sbomify.com/CVE-2022-34021/): Cross-site scripting in resiot:iot platform and lorawan network server (medium 5.4)
- [CVE-2022-34020](https://insights.sbomify.com/CVE-2022-34020/): Cross-site request forgery in resiot:iot platform and lorawan network server (high 8.8)
- [CVE-2022-3402](https://insights.sbomify.com/CVE-2022-3402/): Log HTTP Requests <= 1.3.1 - Stored Cross-Site Scripting (medium 6.1)
- [CVE-2022-34013](https://insights.sbomify.com/CVE-2022-34013/): Server-side request forgery in zhyd:oneblog (medium 4.3)
- [CVE-2022-34012](https://insights.sbomify.com/CVE-2022-34012/): Privilege escalation in zhyd:oneblog (medium 6.5)
- [CVE-2022-34011](https://insights.sbomify.com/CVE-2022-34011/): Server-side request forgery in zhyd:oneblog (medium 4.3)
- [CVE-2022-3401](https://insights.sbomify.com/CVE-2022-3401/): Code injection in Bricks (high 8.8)
- [CVE-2022-34009](https://insights.sbomify.com/CVE-2022-34009/): Denial of service in fossil-scm:fossil (medium 5.5)
- [CVE-2022-34008](https://insights.sbomify.com/CVE-2022-34008/): Privilege escalation in comodo:antivirus (high 7.8)
- [CVE-2022-34007](https://insights.sbomify.com/CVE-2022-34007/): Cross-site scripting in eqs:integrity line (medium 6.1)
- [CVE-2022-34006](https://insights.sbomify.com/CVE-2022-34006/): Misconfiguration in southrivertech:titan ftp server nextgen (high 7.8)
- [CVE-2022-34005](https://insights.sbomify.com/CVE-2022-34005/): Hardcoded credentials in southrivertech:titan ftp server nextgen (critical 9.8)
- [CVE-2022-34002](https://insights.sbomify.com/CVE-2022-34002/): Path traversal in pdssoftware:pds vista 7 (medium 6.5)
- [CVE-2022-34001](https://insights.sbomify.com/CVE-2022-34001/): XML external entity in unit4:enterprise resource planning (medium 6.5)
- [CVE-2022-34000](https://insights.sbomify.com/CVE-2022-34000/): Denial of service in libjxl project:libjxl (medium 6.5)
- [CVE-2022-3400](https://insights.sbomify.com/CVE-2022-3400/): Missing authorization in Bricks (medium 6.5)
- [CVE-2022-33996](https://insights.sbomify.com/CVE-2022-33996/): Privilege escalation in devolutions:devolutions server (high 8.8)
- [CVE-2022-33995](https://insights.sbomify.com/CVE-2022-33995/): Path traversal in devolutions:remote desktop manager (high 7.5)
- [CVE-2022-33994](https://insights.sbomify.com/CVE-2022-33994/): Cross-site scripting in gutenberg project:gutenberg (low 3.0)
- [CVE-2022-33993](https://insights.sbomify.com/CVE-2022-33993/): Other in domain name relay daemon project:domain name relay daemon (medium 5.3)
- [CVE-2022-33992](https://insights.sbomify.com/CVE-2022-33992/): Security feature bypass in domain name relay daemon project:domain name relay daemon (high 7.5)
- [CVE-2022-33991](https://insights.sbomify.com/CVE-2022-33991/): Security feature bypass in dproxy-nexgen project:dproxy-nexgen (medium 5.3)
- [CVE-2022-33990](https://insights.sbomify.com/CVE-2022-33990/): Other in dproxy-nexgen project:dproxy-nexgen (high 7.5)
- [CVE-2022-3399](https://insights.sbomify.com/CVE-2022-3399/): Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2022-33989](https://insights.sbomify.com/CVE-2022-33989/): Weak cryptography in dproxy-nexgen project:dproxy-nexgen (medium 5.3)
- [CVE-2022-33988](https://insights.sbomify.com/CVE-2022-33988/): Other in dproxy-nexgen project:dproxy-nexgen (high 7.5)
- [CVE-2022-33987](https://insights.sbomify.com/CVE-2022-33987/): Got allows a redirect to a UNIX socket (medium 5.3)
- [CVE-2022-33986](https://insights.sbomify.com/CVE-2022-33986/): Race condition in insyde:kernel (medium 6.4)
- [CVE-2022-33985](https://insights.sbomify.com/CVE-2022-33985/): Race condition in insyde:kernel (high 7.0)
- [CVE-2022-33984](https://insights.sbomify.com/CVE-2022-33984/): Race condition in insyde:kernel (high 7.0)
- [CVE-2022-33983](https://insights.sbomify.com/CVE-2022-33983/): Race condition in insyde:kernel (high 7.0)
- [CVE-2022-33982](https://insights.sbomify.com/CVE-2022-33982/): Race condition in insyde:kernel (medium 6.4)
- [CVE-2022-33981](https://insights.sbomify.com/CVE-2022-33981/): Use after free in debian:debian linux (low 3.3)
- [CVE-2022-33980](https://insights.sbomify.com/CVE-2022-33980/): Apache Commons Configuration insecure interpolation defaults (critical 9.8)
- [CVE-2022-3398](https://insights.sbomify.com/CVE-2022-3398/): OMRON CX-Programmer Out-of-bounds Write (high 7.8)
- [CVE-2022-33978](https://insights.sbomify.com/CVE-2022-33978/): WordPress FontMeister plugin <= 1.08 - Reflected Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2022-33977](https://insights.sbomify.com/CVE-2022-33977/): untangle vulnerable to XML Entity Expansion (high 7.5)
- [CVE-2022-33974](https://insights.sbomify.com/CVE-2022-33974/): WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-33973](https://insights.sbomify.com/CVE-2022-33973/): Information disclosure in Intel(R) WAPI Security software for Windows 10/11 (low 3.3)
- [CVE-2022-33972](https://insights.sbomify.com/CVE-2022-33972/): Weak cryptography in 3rd Generation Intel(R) Xeon(R) Scalable Processors (medium 6.1)
- [CVE-2022-33971](https://insights.sbomify.com/CVE-2022-33971/): Auth bypass in Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series (high 8.3)
- [CVE-2022-33970](https://insights.sbomify.com/CVE-2022-33970/): WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability (high 7.2)
- [CVE-2022-3397](https://insights.sbomify.com/CVE-2022-3397/): OMRON CX-Programmer Out-of-bounds Write (high 7.8)
- [CVE-2022-33969](https://insights.sbomify.com/CVE-2022-33969/): WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability (high 7.2)
- [CVE-2022-33968](https://insights.sbomify.com/CVE-2022-33968/): BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968 (low 3.7)
- [CVE-2022-33967](https://insights.sbomify.com/CVE-2022-33967/): Memory corruption in U-Boot (high 7.8)
- [CVE-2022-33965](https://insights.sbomify.com/CVE-2022-33965/): WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities (critical 9.3)
- [CVE-2022-33964](https://insights.sbomify.com/CVE-2022-33964/): Other in Intel(R) SUR software (high 7.4)
- [CVE-2022-33963](https://insights.sbomify.com/CVE-2022-33963/): Misconfiguration in software installer for Intel(R) Unite(R) Client software for Windows (medium 6.7)
- [CVE-2022-33962](https://insights.sbomify.com/CVE-2022-33962/): BIG-IP iRule vulnerability CVE-2022-33962 (medium 6.7)
- [CVE-2022-33961](https://insights.sbomify.com/CVE-2022-33961/): WordPress YellowPencil Visual CSS Style Editor Plugin <= 7.5.8 is vulnerable to Cross Site Scripting (XSS) (medium 4.0)
- [CVE-2022-33960](https://insights.sbomify.com/CVE-2022-33960/): SQL injection in Social Share Buttons by Supsystic (WordPress plugin) (high 8.5)
- [CVE-2022-3396](https://insights.sbomify.com/CVE-2022-3396/): OMRON CX-Programmer Out-of-bounds Write (high 7.8)
- [CVE-2022-33959](https://insights.sbomify.com/CVE-2022-33959/): IBM Sterling Order Management privilege escalation (medium 5.4)
- [CVE-2022-33955](https://insights.sbomify.com/CVE-2022-33955/): Command injection in CICS TX Advanced (medium 4.3)
- [CVE-2022-33954](https://insights.sbomify.com/CVE-2022-33954/): IBM Robotic Process Automation information disclosure (medium 4.6)
- [CVE-2022-33953](https://insights.sbomify.com/CVE-2022-33953/): Information disclosure in Robotic Process Automation (medium 4.6)
- [CVE-2022-3395](https://insights.sbomify.com/CVE-2022-3395/): WP All Export Pro < 1.7.9 - Authenticated SQLi (high 8.8)
- [CVE-2022-33948](https://insights.sbomify.com/CVE-2022-33948/): Command injection in HOME SPOT CUBE2 (high 8.8)
- [CVE-2022-33947](https://insights.sbomify.com/CVE-2022-33947/): BIG-IP DNS TMUI Vulnerability CVE-2022-33947 (medium 5.4)
- [CVE-2022-33946](https://insights.sbomify.com/CVE-2022-33946/): Auth bypass in Intel(R) SUR software (medium 5.6)
- [CVE-2022-33945](https://insights.sbomify.com/CVE-2022-33945/): Privilege escalation in Intel(R) Server board and Intel(R) Server System BIOS firmware (high 8.2)
- [CVE-2022-33944](https://insights.sbomify.com/CVE-2022-33944/): ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key (medium 6.5)
- [CVE-2022-33943](https://insights.sbomify.com/CVE-2022-33943/): WordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-33942](https://insights.sbomify.com/CVE-2022-33942/): Security feature bypass in Intel(R) DCM software (high 8.8)
- [CVE-2022-33941](https://insights.sbomify.com/CVE-2022-33941/): Command injection in PowerCMS XMLRPC API (critical 9.8)
- [CVE-2022-3394](https://insights.sbomify.com/CVE-2022-3394/): WP All Export Pro < 1.7.9 - Authenticated Code Injection (high 7.2)
- [CVE-2022-33939](https://insights.sbomify.com/CVE-2022-33939/): Denial of service in CENTUM VP / CS 3000 controller FCS (high 7.5)
- [CVE-2022-33938](https://insights.sbomify.com/CVE-2022-33938/): Memory corruption in iota All-In-One Security Kit (high 8.2)
- [CVE-2022-33937](https://insights.sbomify.com/CVE-2022-33937/): Path traversal in GeoDrive (high 7.1)
- [CVE-2022-33936](https://insights.sbomify.com/CVE-2022-33936/): Command injection in Cloud Mobility for Dell Storage (high 8.0)
- [CVE-2022-33935](https://insights.sbomify.com/CVE-2022-33935/): Cross-site scripting in Data Protection Advisor (medium 5.4)
- [CVE-2022-33934](https://insights.sbomify.com/CVE-2022-33934/): Cross-site scripting in PowerScale OneFS (high 7.7)
- [CVE-2022-33932](https://insights.sbomify.com/CVE-2022-33932/): Denial of service in PowerScale OneFS (medium 5.3)
- [CVE-2022-33931](https://insights.sbomify.com/CVE-2022-33931/): Missing authorization in Wyse Management Suite (medium 6.3)
- [CVE-2022-33930](https://insights.sbomify.com/CVE-2022-33930/): Information disclosure in Wyse Management Suite (medium 4.3)
- [CVE-2022-3393](https://insights.sbomify.com/CVE-2022-3393/): Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection (critical 9.8)
- [CVE-2022-33929](https://insights.sbomify.com/CVE-2022-33929/): Cross-site scripting in Wyse Management Suite (medium 6.1)
- [CVE-2022-33928](https://insights.sbomify.com/CVE-2022-33928/): Information disclosure in Wyse Management Suite (medium 6.4)
- [CVE-2022-33927](https://insights.sbomify.com/CVE-2022-33927/): Auth bypass in Wyse Management Suite (medium 5.4)
- [CVE-2022-33926](https://insights.sbomify.com/CVE-2022-33926/): Missing authorization in Wyse Management Suite (high 7.1)
- [CVE-2022-33925](https://insights.sbomify.com/CVE-2022-33925/): Missing authorization in Wyse Management Suite (medium 6.5)
- [CVE-2022-33924](https://insights.sbomify.com/CVE-2022-33924/): Missing authorization in Wyse Management Suite (medium 4.3)
- [CVE-2022-33923](https://insights.sbomify.com/CVE-2022-33923/): Command injection in PowerStore (medium 6.4)
- [CVE-2022-33922](https://insights.sbomify.com/CVE-2022-33922/): Misconfiguration in GeoDrive (high 7.0)
- [CVE-2022-33921](https://insights.sbomify.com/CVE-2022-33921/): Privilege escalation in GeoDrive (high 7.0)
- [CVE-2022-33920](https://insights.sbomify.com/CVE-2022-33920/): Privilege escalation in GeoDrive (high 7.8)
- [CVE-2022-3392](https://insights.sbomify.com/CVE-2022-3392/): WP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-33919](https://insights.sbomify.com/CVE-2022-33919/): Information disclosure in GeoDrive (high 7.8)
- [CVE-2022-33918](https://insights.sbomify.com/CVE-2022-33918/): Information disclosure in GeoDrive (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/298/