# Vulnerabilities published in 2022


- [CVE-2022-32517](https://insights.sbomify.com/CVE-2022-32517/): Other in Conext™ ComBox (medium 6.5)
- [CVE-2022-32516](https://insights.sbomify.com/CVE-2022-32516/): Cross-site request forgery in Conext™ ComBox (high 7.5)
- [CVE-2022-32515](https://insights.sbomify.com/CVE-2022-32515/): Auth bypass in Conext™ ComBox (high 8.6)
- [CVE-2022-32514](https://insights.sbomify.com/CVE-2022-32514/): Auth bypass in C-Bus Network Automation Controller, LSS5500NAC (critical 9.8)
- [CVE-2022-32513](https://insights.sbomify.com/CVE-2022-32513/): Weak cryptography in C-Bus Network Automation Controller, LSS5500NAC (critical 9.8)
- [CVE-2022-32512](https://insights.sbomify.com/CVE-2022-32512/): Memory corruption in CanBRASS (medium 5.3)
- [CVE-2022-32511](https://insights.sbomify.com/CVE-2022-32511/): JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable (critical 9.8)
- [CVE-2022-32510](https://insights.sbomify.com/CVE-2022-32510/): An issue was discovered on certain Nuki Home Solutions devices. (high 7.1)
- [CVE-2022-3251](https://insights.sbomify.com/CVE-2022-3251/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarca (high 7.5)
- [CVE-2022-32509](https://insights.sbomify.com/CVE-2022-32509/): An issue was discovered on certain Nuki Home Solutions devices. (high 8.8)
- [CVE-2022-32508](https://insights.sbomify.com/CVE-2022-32508/): An issue was discovered on certain Nuki Home Solutions devices. (high 7.5)
- [CVE-2022-32507](https://insights.sbomify.com/CVE-2022-32507/): An issue was discovered on certain Nuki Home Solutions devices. (high 8.8)
- [CVE-2022-32506](https://insights.sbomify.com/CVE-2022-32506/): An issue was discovered on certain Nuki Home Solutions devices. (medium 6.4)
- [CVE-2022-32505](https://insights.sbomify.com/CVE-2022-32505/): An issue was discovered on certain Nuki Home Solutions devices. (high 7.1)
- [CVE-2022-32504](https://insights.sbomify.com/CVE-2022-32504/): An issue was discovered on certain Nuki Home Solutions devices. (critical 9.8)
- [CVE-2022-32503](https://insights.sbomify.com/CVE-2022-32503/): An issue was discovered on certain Nuki Home Solutions devices. (high 7.6)
- [CVE-2022-32502](https://insights.sbomify.com/CVE-2022-32502/): An issue was discovered on certain Nuki Home Solutions devices. (medium 6.3)
- [CVE-2022-3250](https://insights.sbomify.com/CVE-2022-3250/): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb (medium 4.9)
- [CVE-2022-32498](https://insights.sbomify.com/CVE-2022-32498/): Privilege escalation in PowerStore (medium 5.5)
- [CVE-2022-32493](https://insights.sbomify.com/CVE-2022-32493/): Memory corruption in CPG BIOS (medium 6.0)
- [CVE-2022-32492](https://insights.sbomify.com/CVE-2022-32492/): Other in CPG BIOS (high 7.5)
- [CVE-2022-32491](https://insights.sbomify.com/CVE-2022-32491/): Memory corruption in CPG BIOS (medium 4.1)
- [CVE-2022-32490](https://insights.sbomify.com/CVE-2022-32490/): Other in BIOS (high 7.5)
- [CVE-2022-3249](https://insights.sbomify.com/CVE-2022-3249/): WP CSV Exporter < 1.3.7 - Admin+ SQLi (high 7.2)
- [CVE-2022-32489](https://insights.sbomify.com/CVE-2022-32489/): Other in CPG BIOS (high 8.2)
- [CVE-2022-32488](https://insights.sbomify.com/CVE-2022-32488/): Other in CPG BIOS (high 8.2)
- [CVE-2022-32487](https://insights.sbomify.com/CVE-2022-32487/): Other in CPG BIOS (high 7.5)
- [CVE-2022-32486](https://insights.sbomify.com/CVE-2022-32486/): Other in CPG BIOS (high 7.5)
- [CVE-2022-32485](https://insights.sbomify.com/CVE-2022-32485/): Other in CPG BIOS (high 7.5)
- [CVE-2022-32484](https://insights.sbomify.com/CVE-2022-32484/): Other in CPG BIOS (medium 5.6)
- [CVE-2022-32483](https://insights.sbomify.com/CVE-2022-32483/): Other in CPG BIOS (medium 5.6)
- [CVE-2022-32482](https://insights.sbomify.com/CVE-2022-32482/): Other in CPG BIOS (medium 5.6)
- [CVE-2022-32481](https://insights.sbomify.com/CVE-2022-32481/): Privilege escalation in Cyber Recovery (high 7.8)
- [CVE-2022-32480](https://insights.sbomify.com/CVE-2022-32480/): Misconfiguration in PowerScale OneFS (medium 4.3)
- [CVE-2022-3248](https://insights.sbomify.com/CVE-2022-3248/): Openshift api admission checks does not enforce "custom-host" permissions (medium 4.4)
- [CVE-2022-32478](https://insights.sbomify.com/CVE-2022-32478/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32477](https://insights.sbomify.com/CVE-2022-32477/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32476](https://insights.sbomify.com/CVE-2022-32476/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32475](https://insights.sbomify.com/CVE-2022-32475/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32474](https://insights.sbomify.com/CVE-2022-32474/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32473](https://insights.sbomify.com/CVE-2022-32473/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32471](https://insights.sbomify.com/CVE-2022-32471/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-32470](https://insights.sbomify.com/CVE-2022-32470/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-3247](https://insights.sbomify.com/CVE-2022-3247/): Blog2Social < 6.9.10 - Subscriber+ SSRF (medium 6.5)
- [CVE-2022-32469](https://insights.sbomify.com/CVE-2022-32469/): Race condition in insyde:insydeh2o (high 7.0)
- [CVE-2022-3246](https://insights.sbomify.com/CVE-2022-3246/): Blog2Social < 6.9.10 - Subscriber+ SQLi (high 8.8)
- [CVE-2022-32458](https://insights.sbomify.com/CVE-2022-32458/): Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection (high 7.5)
- [CVE-2022-32457](https://insights.sbomify.com/CVE-2022-32457/): Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF) (medium 5.3)
- [CVE-2022-32456](https://insights.sbomify.com/CVE-2022-32456/): Data Systems Consulting Co., Ltd. BPM - SQL Injection (critical 9.8)
- [CVE-2022-32455](https://insights.sbomify.com/CVE-2022-32455/): TMM vulnerability CVE-2022-32455 (high 7.5)
- [CVE-2022-32454](https://insights.sbomify.com/CVE-2022-32454/): Memory corruption in iota All-In-One Security Kit (critical 10.0)
- [CVE-2022-32453](https://insights.sbomify.com/CVE-2022-32453/): Other in Cybozu Office (medium 6.5)
- [CVE-2022-32450](https://insights.sbomify.com/CVE-2022-32450/): Privilege escalation in anydesk:anydesk (high 7.1)
- [CVE-2022-3245](https://insights.sbomify.com/CVE-2022-3245/): Code Injection in display of tag title on saving tags in microweber/microweber (medium 4.3)
- [CVE-2022-32449](https://insights.sbomify.com/CVE-2022-32449/): Command injection in totolink:ex300 v2 firmware (critical 9.8)
- [CVE-2022-32444](https://insights.sbomify.com/CVE-2022-32444/): Open redirect in yuba:u5cms (medium 6.1)
- [CVE-2022-32442](https://insights.sbomify.com/CVE-2022-32442/): Cross-site scripting in yuba:u5cms (medium 6.1)
- [CVE-2022-32441](https://insights.sbomify.com/CVE-2022-32441/): Memory corruption in hex-rays:ida (medium 5.5)
- [CVE-2022-3244](https://insights.sbomify.com/CVE-2022-3244/): Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing Authorisation (medium 4.2)
- [CVE-2022-32434](https://insights.sbomify.com/CVE-2022-32434/): Memory corruption in opener project:opener (high 7.8)
- [CVE-2022-32433](https://insights.sbomify.com/CVE-2022-32433/): File upload in advanced school management system project:advanced school management system (high 7.2)
- [CVE-2022-32430](https://insights.sbomify.com/CVE-2022-32430/): Hardcoded JWT Token in Lin CMS Spring Boot (high 7.5)
- [CVE-2022-3243](https://insights.sbomify.com/CVE-2022-3243/): Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi (high 7.2)
- [CVE-2022-32429](https://insights.sbomify.com/CVE-2022-32429/): Auth bypass in megatech:msnswitch firmware (critical 9.8)
- [CVE-2022-32427](https://insights.sbomify.com/CVE-2022-32427/): Path traversal in printerlogic:windows client (high 8.8)
- [CVE-2022-32425](https://insights.sbomify.com/CVE-2022-32425/): Information disclosure in mealie:mealie (medium 5.3)
- [CVE-2022-32420](https://insights.sbomify.com/CVE-2022-32420/): File upload in college management system project:college management system (high 8.8)
- [CVE-2022-3242](https://insights.sbomify.com/CVE-2022-3242/): HTML code Injection in template search keyword in microweber/microweber (medium 4.3)
- [CVE-2022-32417](https://insights.sbomify.com/CVE-2022-32417/): Code injection in pbootcms:pbootcms (critical 9.8)
- [CVE-2022-32416](https://insights.sbomify.com/CVE-2022-32416/): SQL injection in product show room site project:product show room site (high 7.2)
- [CVE-2022-32415](https://insights.sbomify.com/CVE-2022-32415/): SQL injection in product show room site project:product show room site (high 8.8)
- [CVE-2022-32414](https://insights.sbomify.com/CVE-2022-32414/): Use after free in f5:njs (medium 5.5)
- [CVE-2022-32413](https://insights.sbomify.com/CVE-2022-32413/): File upload in dice project:dice (critical 9.8)
- [CVE-2022-32412](https://insights.sbomify.com/CVE-2022-32412/): Code injection in hongcms project:hongcms (high 7.2)
- [CVE-2022-32411](https://insights.sbomify.com/CVE-2022-32411/): Code injection in hongcms project:hongcms (high 7.2)
- [CVE-2022-3241](https://insights.sbomify.com/CVE-2022-3241/): Build App Online < 1.0.19 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-32409](https://insights.sbomify.com/CVE-2022-32409/): Path traversal in softwarepublico:i3geo (critical 9.8)
- [CVE-2022-32407](https://insights.sbomify.com/CVE-2022-32407/): Cross-site scripting in softr:softr (medium 6.1)
- [CVE-2022-32406](https://insights.sbomify.com/CVE-2022-32406/): Memory corruption in gtkradiant project:gtkradiant (medium 5.5)
- [CVE-2022-32405](https://insights.sbomify.com/CVE-2022-32405/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32404](https://insights.sbomify.com/CVE-2022-32404/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32403](https://insights.sbomify.com/CVE-2022-32403/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32402](https://insights.sbomify.com/CVE-2022-32402/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32401](https://insights.sbomify.com/CVE-2022-32401/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32400](https://insights.sbomify.com/CVE-2022-32400/): SQL injection in prison management system project:prison management system (high 7.2)
- [CVE-2022-3240](https://insights.sbomify.com/CVE-2022-3240/): Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-32399](https://insights.sbomify.com/CVE-2022-32399/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32398](https://insights.sbomify.com/CVE-2022-32398/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32397](https://insights.sbomify.com/CVE-2022-32397/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32396](https://insights.sbomify.com/CVE-2022-32396/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32395](https://insights.sbomify.com/CVE-2022-32395/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32394](https://insights.sbomify.com/CVE-2022-32394/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32393](https://insights.sbomify.com/CVE-2022-32393/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32392](https://insights.sbomify.com/CVE-2022-32392/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-32391](https://insights.sbomify.com/CVE-2022-32391/): SQL injection in prison management system project:prison management system (high 8.8)
- [CVE-2022-3239](https://insights.sbomify.com/CVE-2022-3239/): Use after free in Kernel (high 7.8)
- [CVE-2022-32389](https://insights.sbomify.com/CVE-2022-32389/): Hardcoded credentials in isode:swift (high 7.5)
- [CVE-2022-32387](https://insights.sbomify.com/CVE-2022-32387/): Denial of service in kentico:xperience (high 7.5)
- [CVE-2022-32386](https://insights.sbomify.com/CVE-2022-32386/): Memory corruption in tendacn:ac23 ac2100 firmware (critical 9.8)
- [CVE-2022-32385](https://insights.sbomify.com/CVE-2022-32385/): Memory corruption in tendacn:ac23 ac2100 firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/308/