# Vulnerabilities published in 2022


- [CVE-2022-3363](https://insights.sbomify.com/CVE-2022-3363/): Business Logic Errors in ikus060/rdiffweb (low 2.8)
- [CVE-2022-3362](https://insights.sbomify.com/CVE-2022-3362/): Insufficient Session Expiration in ikus060/rdiffweb (medium 6.1)
- [CVE-2022-3361](https://insights.sbomify.com/CVE-2022-3361/): Path traversal in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (medium 4.3)
- [CVE-2022-3360](https://insights.sbomify.com/CVE-2022-3360/): LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API (high 8.1)
- [CVE-2022-3359](https://insights.sbomify.com/CVE-2022-3359/): Shortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection (high 8.8)
- [CVE-2022-3358](https://insights.sbomify.com/CVE-2022-3358/): Using a Custom Cipher with NID_undef may lead to NULL encryption (high 7.5)
- [CVE-2022-3357](https://insights.sbomify.com/CVE-2022-3357/): Smart Slider 3 < 3.5.1.11 - PHP Object Injection (high 8.8)
- [CVE-2022-3355](https://insights.sbomify.com/CVE-2022-3355/): Cross-site Scripting (XSS) - Stored in inventree/inventree (high 8.2)
- [CVE-2022-3354](https://insights.sbomify.com/CVE-2022-3354/): Open5GS UDP Packet ogs-tlv-msg.c denial of service (low 3.5)
- [CVE-2022-3353](https://insights.sbomify.com/CVE-2022-3353/): IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy Products (medium 5.9)
- [CVE-2022-3352](https://insights.sbomify.com/CVE-2022-3352/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-3351](https://insights.sbomify.com/CVE-2022-3351/): Information disclosure in GitLab (medium 4.3)
- [CVE-2022-3350](https://insights.sbomify.com/CVE-2022-3350/): Contact Bank <= 3.0.30 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-3349](https://insights.sbomify.com/CVE-2022-3349/): Sony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflow (medium 6.8)
- [CVE-2022-3348](https://insights.sbomify.com/CVE-2022-3348/): Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljet (medium 6.5)
- [CVE-2022-3347](https://insights.sbomify.com/CVE-2022-3347/): Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolver (high 7.5)
- [CVE-2022-3346](https://insights.sbomify.com/CVE-2022-3346/): Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver (medium 6.5)
- [CVE-2022-3344](https://insights.sbomify.com/CVE-2022-3344/): Denial of service in Linux kernel (medium 5.5)
- [CVE-2022-3343](https://insights.sbomify.com/CVE-2022-3343/): WPQA < 5.9.3 - Missing validation lead to functionality abuse (low 3.5)
- [CVE-2022-3342](https://insights.sbomify.com/CVE-2022-3342/): Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization (high 7.5)
- [CVE-2022-3341](https://insights.sbomify.com/CVE-2022-3341/): Null dereference in FFmpeg (medium 5.3)
- [CVE-2022-3340](https://insights.sbomify.com/CVE-2022-3340/): Trellix IPS Manager vulnerable to XXE (medium 5.9)
- [CVE-2022-3339](https://insights.sbomify.com/CVE-2022-3339/): Reflected XSS in Trellix ePO server (medium 5.4)
- [CVE-2022-3338](https://insights.sbomify.com/CVE-2022-3338/): XXE in Trellix ePO server (medium 5.4)
- [CVE-2022-3337](https://insights.sbomify.com/CVE-2022-3337/): Lock WARP switch bypass by removing VPN profile on iOS mobile client (medium 6.7)
- [CVE-2022-3336](https://insights.sbomify.com/CVE-2022-3336/): Event Monster < 1.2.0 - Visitors Deletion via CSRF (medium 4.3)
- [CVE-2022-3335](https://insights.sbomify.com/CVE-2022-3335/): Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection (high 7.2)
- [CVE-2022-3334](https://insights.sbomify.com/CVE-2022-3334/): Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection (high 7.2)
- [CVE-2022-3333](https://insights.sbomify.com/CVE-2022-3333/): Zephyr Project Manager REST Call cross site scripting (low 3.5)
- [CVE-2022-33329](https://insights.sbomify.com/CVE-2022-33329/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33328](https://insights.sbomify.com/CVE-2022-33328/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33327](https://insights.sbomify.com/CVE-2022-33327/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33326](https://insights.sbomify.com/CVE-2022-33326/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33325](https://insights.sbomify.com/CVE-2022-33325/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33324](https://insights.sbomify.com/CVE-2022-33324/): Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC Series (high 7.5)
- [CVE-2022-33323](https://insights.sbomify.com/CVE-2022-33323/): Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-series (high 7.5)
- [CVE-2022-33322](https://insights.sbomify.com/CVE-2022-33322/): Cross-site scripting in Air Conditioning MFZ-GXT50/60/73VFK (medium 6.1)
- [CVE-2022-33321](https://insights.sbomify.com/CVE-2022-33321/): Information disclosure in Air Conditioning MFZ-GXT50/60/73VFK (critical 9.8)
- [CVE-2022-33320](https://insights.sbomify.com/CVE-2022-33320/): Deserialization in GENESIS64 (high 7.8)
- [CVE-2022-3332](https://insights.sbomify.com/CVE-2022-3332/): SourceCodester Food Ordering Management System POST Parameter router.php sql injection (medium 6.3)
- [CVE-2022-33319](https://insights.sbomify.com/CVE-2022-33319/): Memory corruption in GENESIS32 (high 8.2)
- [CVE-2022-33318](https://insights.sbomify.com/CVE-2022-33318/): Deserialization in GENESIS32 (critical 9.8)
- [CVE-2022-33317](https://insights.sbomify.com/CVE-2022-33317/): Code injection in GENESIS64 (high 7.8)
- [CVE-2022-33316](https://insights.sbomify.com/CVE-2022-33316/): Deserialization in GENESIS64 (high 7.8)
- [CVE-2022-33315](https://insights.sbomify.com/CVE-2022-33315/): Deserialization in GENESIS64 (high 7.8)
- [CVE-2022-33314](https://insights.sbomify.com/CVE-2022-33314/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33313](https://insights.sbomify.com/CVE-2022-33313/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33312](https://insights.sbomify.com/CVE-2022-33312/): Command injection in R1510 (critical 9.1)
- [CVE-2022-33311](https://insights.sbomify.com/CVE-2022-33311/): Missing authorization in Cybozu Office (medium 4.3)
- [CVE-2022-3331](https://insights.sbomify.com/CVE-2022-3331/): Missing authorization in GitLab (low 3.5)
- [CVE-2022-33309](https://insights.sbomify.com/CVE-2022-33309/): Buiffer over-read in WLAN Firmware. (high 7.5)
- [CVE-2022-33307](https://insights.sbomify.com/CVE-2022-33307/): Double free in Automotive (high 8.4)
- [CVE-2022-33306](https://insights.sbomify.com/CVE-2022-33306/): Buffer over-read in WLAN (high 7.5)
- [CVE-2022-33305](https://insights.sbomify.com/CVE-2022-33305/): Null pointer dereference in Modem (high 7.5)
- [CVE-2022-33304](https://insights.sbomify.com/CVE-2022-33304/): NULL pointers dereference in Modem (high 7.5)
- [CVE-2022-33303](https://insights.sbomify.com/CVE-2022-33303/): Uncontrolled resource consumption in Linux kernel (medium 5.5)
- [CVE-2022-33302](https://insights.sbomify.com/CVE-2022-33302/): Improper validation of array index in User Identity Module (medium 6.8)
- [CVE-2022-33301](https://insights.sbomify.com/CVE-2022-33301/): Incorrect type conversion or cast in Audio (medium 6.7)
- [CVE-2022-33300](https://insights.sbomify.com/CVE-2022-33300/): Improper input validation in Automotive Android OS (high 8.4)
- [CVE-2022-3330](https://insights.sbomify.com/CVE-2022-3330/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-33299](https://insights.sbomify.com/CVE-2022-33299/): Null pointer dereference in Bluetooth HOST (high 7.5)
- [CVE-2022-33298](https://insights.sbomify.com/CVE-2022-33298/): Use after free in Modem (medium 6.7)
- [CVE-2022-33297](https://insights.sbomify.com/CVE-2022-33297/): Buffer overread in Linux Sensors (medium 6.8)
- [CVE-2022-33296](https://insights.sbomify.com/CVE-2022-33296/): Integer overflow to buffer overflow in Modem (medium 5.9)
- [CVE-2022-33295](https://insights.sbomify.com/CVE-2022-33295/): Buffer over-read in Modem (high 8.2)
- [CVE-2022-33294](https://insights.sbomify.com/CVE-2022-33294/): NULL pointer dereference in Modem (high 7.5)
- [CVE-2022-33292](https://insights.sbomify.com/CVE-2022-33292/): Use after free in Qualcomm IPC (high 7.8)
- [CVE-2022-33291](https://insights.sbomify.com/CVE-2022-33291/): Buffer over-read in Modem (high 8.2)
- [CVE-2022-33290](https://insights.sbomify.com/CVE-2022-33290/): Null pointer dereference in Bluetooth HOST (high 7.5)
- [CVE-2022-33289](https://insights.sbomify.com/CVE-2022-33289/): Improper validation of array index in Modem (medium 6.8)
- [CVE-2022-33288](https://insights.sbomify.com/CVE-2022-33288/): Buffer copy without checking the size of input in Core (critical 9.3)
- [CVE-2022-33287](https://insights.sbomify.com/CVE-2022-33287/): Buffer over-read in Modem (high 8.2)
- [CVE-2022-33286](https://insights.sbomify.com/CVE-2022-33286/): Buffer over-read in WLAN (high 7.5)
- [CVE-2022-33285](https://insights.sbomify.com/CVE-2022-33285/): Buffer over-read in WLAN (high 7.5)
- [CVE-2022-33284](https://insights.sbomify.com/CVE-2022-33284/): Buffer over-read in WLAN (high 8.2)
- [CVE-2022-33283](https://insights.sbomify.com/CVE-2022-33283/): Buffer over-read in WLAN (high 8.2)
- [CVE-2022-33282](https://insights.sbomify.com/CVE-2022-33282/): Integer overflow to buffer overflow in Automotive Multimedia (high 8.4)
- [CVE-2022-33281](https://insights.sbomify.com/CVE-2022-33281/): Improper validation of array index in computer vision. (medium 6.7)
- [CVE-2022-33280](https://insights.sbomify.com/CVE-2022-33280/): Access of uninitialized pointer in Bluetooth HOST (high 7.3)
- [CVE-2022-3328](https://insights.sbomify.com/CVE-2022-3328/): snapd Race Condition vulnerability (high 7.8)
- [CVE-2022-33279](https://insights.sbomify.com/CVE-2022-33279/): Stack based buffer overflow in WLAN (critical 9.8)
- [CVE-2022-33278](https://insights.sbomify.com/CVE-2022-33278/): Buffer copy without checking the size of input in HLOS (high 7.8)
- [CVE-2022-33277](https://insights.sbomify.com/CVE-2022-33277/): Buffer copy without checking size of input in modem (high 8.4)
- [CVE-2022-33276](https://insights.sbomify.com/CVE-2022-33276/): Buffer copy without checking size of input in Modem (high 8.4)
- [CVE-2022-33275](https://insights.sbomify.com/CVE-2022-33275/): Improper validation of array index in WLAN HAL (high 8.4)
- [CVE-2022-33274](https://insights.sbomify.com/CVE-2022-33274/): Improper validation of array index in Android Core (high 8.4)
- [CVE-2022-33273](https://insights.sbomify.com/CVE-2022-33273/): Buffer over-read in Trusted Execution Environment (high 7.3)
- [CVE-2022-33272](https://insights.sbomify.com/CVE-2022-33272/): Reachable assertion in Modem (high 7.5)
- [CVE-2022-33271](https://insights.sbomify.com/CVE-2022-33271/): Buffer over-read in WLAN (high 8.2)
- [CVE-2022-33270](https://insights.sbomify.com/CVE-2022-33270/): Time-of-check time-of-use race condition in Modem (high 7.5)
- [CVE-2022-3327](https://insights.sbomify.com/CVE-2022-3327/): Missing Authentication for Critical Function in ikus060/rdiffweb (medium 4.5)
- [CVE-2022-33269](https://insights.sbomify.com/CVE-2022-33269/): Integer overflow or wraparound in Core (critical 9.3)
- [CVE-2022-33268](https://insights.sbomify.com/CVE-2022-33268/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 8.2)
- [CVE-2022-33267](https://insights.sbomify.com/CVE-2022-33267/): Improper restriction of operations within the bounds of memory buffer in Linux (medium 6.7)
- [CVE-2022-33266](https://insights.sbomify.com/CVE-2022-33266/): Integer overflow to buffer overflow in Audio (medium 5.9)
- [CVE-2022-33265](https://insights.sbomify.com/CVE-2022-33265/): Information exposure in Powerline Communication Firmware (high 7.3)
- [CVE-2022-33264](https://insights.sbomify.com/CVE-2022-33264/): Stack-based buffer overflow in Modem (high 7.9)
- [CVE-2022-33263](https://insights.sbomify.com/CVE-2022-33263/): Use after free in Core (medium 6.7)
- [CVE-2022-33260](https://insights.sbomify.com/CVE-2022-33260/): Stack based buffer overflow in Core (medium 5.9)
- [CVE-2022-3326](https://insights.sbomify.com/CVE-2022-3326/): Weak Password Requirements in ikus060/rdiffweb (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/301/