# Vulnerabilities published in 2022


- [CVE-2022-31520](https://insights.sbomify.com/CVE-2022-31520/): Path traversal in logstash-management-api project:logstash-management-api (critical 9.3)
- [CVE-2022-3152](https://insights.sbomify.com/CVE-2022-3152/): Unverified Password Change in phpfusion/phpfusion (critical 9.6)
- [CVE-2022-31519](https://insights.sbomify.com/CVE-2022-31519/): Path traversal in windmill project:windmill (critical 9.3)
- [CVE-2022-31518](https://insights.sbomify.com/CVE-2022-31518/): Path traversal in python-recipe-database project:python-recipe-database (critical 9.3)
- [CVE-2022-31517](https://insights.sbomify.com/CVE-2022-31517/): Path traversal in mercury sample manager project:mercury sample manager (critical 9.3)
- [CVE-2022-31516](https://insights.sbomify.com/CVE-2022-31516/): Path traversal in harveyzyh python project:harveyzyh python (critical 9.3)
- [CVE-2022-31515](https://insights.sbomify.com/CVE-2022-31515/): Path traversal in carceresbe project:carceresbe (critical 9.3)
- [CVE-2022-31514](https://insights.sbomify.com/CVE-2022-31514/): Path traversal in fan platform project:fan platform (critical 9.3)
- [CVE-2022-31513](https://insights.sbomify.com/CVE-2022-31513/): Path traversal in krypton project:krypton (critical 9.3)
- [CVE-2022-31512](https://insights.sbomify.com/CVE-2022-31512/): Path traversal in flask-mvc project:flask-mvc (critical 9.3)
- [CVE-2022-31511](https://insights.sbomify.com/CVE-2022-31511/): Path traversal in equanimity project:equanimity (critical 9.3)
- [CVE-2022-31510](https://insights.sbomify.com/CVE-2022-31510/): Path traversal in simple-rat project:simple-rat (critical 9.3)
- [CVE-2022-3151](https://insights.sbomify.com/CVE-2022-3151/): WP Custom Cursors < 3.0.1 - Arbitrary Cursor Deletion via CSRF (medium 4.3)
- [CVE-2022-31509](https://insights.sbomify.com/CVE-2022-31509/): Path traversal in iedadata:usap-dc web submission and dataset search (critical 9.3)
- [CVE-2022-31508](https://insights.sbomify.com/CVE-2022-31508/): Path traversal in idayrus:e-voting (critical 9.3)
- [CVE-2022-31507](https://insights.sbomify.com/CVE-2022-31507/): Ganga allows absolute path traversal (critical 9.3)
- [CVE-2022-31506](https://insights.sbomify.com/CVE-2022-31506/): SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely (critical 9.3)
- [CVE-2022-31505](https://insights.sbomify.com/CVE-2022-31505/): Path traversal in mercadoenlineaback project:mercadoenlineaback (critical 9.3)
- [CVE-2022-31504](https://insights.sbomify.com/CVE-2022-31504/): Path traversal in baiduwenkuspider flaskweb project:baiduwenkuspider flaskweb (critical 9.3)
- [CVE-2022-31503](https://insights.sbomify.com/CVE-2022-31503/): Path traversal in orchest:orchest (critical 9.3)
- [CVE-2022-31502](https://insights.sbomify.com/CVE-2022-31502/): Path traversal in wormnest project:wormnest (critical 9.3)
- [CVE-2022-31501](https://insights.sbomify.com/CVE-2022-31501/): Path traversal in onyxforum project:onyxforum (critical 9.3)
- [CVE-2022-31500](https://insights.sbomify.com/CVE-2022-31500/): Misconfiguration in knime:knime analytics platform (high 7.8)
- [CVE-2022-3150](https://insights.sbomify.com/CVE-2022-3150/): WP Custom Cursors < 3.2 - Admin+ SQLi (high 7.2)
- [CVE-2022-31499](https://insights.sbomify.com/CVE-2022-31499/): Command injection in nortekcontrol:emerge e3 firmware (critical 9.8)
- [CVE-2022-31498](https://insights.sbomify.com/CVE-2022-31498/): Cross-site scripting in librehealth:librehealth ehr (medium 6.1)
- [CVE-2022-31497](https://insights.sbomify.com/CVE-2022-31497/): Cross-site scripting in librehealth:librehealth ehr (medium 6.1)
- [CVE-2022-31496](https://insights.sbomify.com/CVE-2022-31496/): Missing authorization in librehealth:librehealth ehr (high 8.8)
- [CVE-2022-31495](https://insights.sbomify.com/CVE-2022-31495/): Cross-site scripting in librehealth:librehealth ehr (medium 6.1)
- [CVE-2022-31494](https://insights.sbomify.com/CVE-2022-31494/): Cross-site scripting in librehealth:librehealth ehr (medium 6.1)
- [CVE-2022-31493](https://insights.sbomify.com/CVE-2022-31493/): Cross-site scripting in librehealth:librehealth ehr (medium 6.1)
- [CVE-2022-31492](https://insights.sbomify.com/CVE-2022-31492/): Cross-site scripting in librehealth:librehealth ehr (medium 6.1)
- [CVE-2022-31491](https://insights.sbomify.com/CVE-2022-31491/): Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote at (critical 10.0)
- [CVE-2022-3149](https://insights.sbomify.com/CVE-2022-3149/): WP Custom Cursors < 3.0.1 - Stored Cross-Site Scripting via CSRF (medium 6.1)
- [CVE-2022-31489](https://insights.sbomify.com/CVE-2022-31489/): SQL injection in inoutscripts:blockchain altexchanger (high 7.5)
- [CVE-2022-31488](https://insights.sbomify.com/CVE-2022-31488/): SQL injection in inoutscripts:blockchain altexchanger (high 7.5)
- [CVE-2022-31487](https://insights.sbomify.com/CVE-2022-31487/): SQL injection in inoutscripts:blockchain altexchanger (high 7.5)
- [CVE-2022-31486](https://insights.sbomify.com/CVE-2022-31486/): Command injection via Advanced Networking route add functionality (high 8.8)
- [CVE-2022-31485](https://insights.sbomify.com/CVE-2022-31485/): Unauthenticated homepage note modification (medium 5.3)
- [CVE-2022-31484](https://insights.sbomify.com/CVE-2022-31484/): User Account Deletion Unauthenticated (high 7.5)
- [CVE-2022-31483](https://insights.sbomify.com/CVE-2022-31483/): Arbitrary file write via authenticated OSDP file upload (critical 9.1)
- [CVE-2022-31482](https://insights.sbomify.com/CVE-2022-31482/): Denial-of-Service via internal structure overflow (high 7.5)
- [CVE-2022-31481](https://insights.sbomify.com/CVE-2022-31481/): Remote Code Execution via buffer overflow in firmware update process (critical 10.0)
- [CVE-2022-31480](https://insights.sbomify.com/CVE-2022-31480/): Unauthenticated Firmware Upload and Arbitrary Reboot (high 7.5)
- [CVE-2022-3148](https://insights.sbomify.com/CVE-2022-3148/): Cross-site Scripting (XSS) - Generic in jgraph/drawio (medium 5.3)
- [CVE-2022-31479](https://insights.sbomify.com/CVE-2022-31479/): Remote Code Execution via command injection of the hostname (critical 9.6)
- [CVE-2022-31478](https://insights.sbomify.com/CVE-2022-31478/): Information disclosure in sr.solutions:usertakeover (medium 4.3)
- [CVE-2022-31477](https://insights.sbomify.com/CVE-2022-31477/): Information disclosure in Intel(R) NUC BIOS firmware (medium 4.0)
- [CVE-2022-31476](https://insights.sbomify.com/CVE-2022-31476/): Missing authorization in Intel(R) SUR software (medium 5.5)
- [CVE-2022-31475](https://insights.sbomify.com/CVE-2022-31475/): WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability (medium 5.5)
- [CVE-2022-31474](https://insights.sbomify.com/CVE-2022-31474/): WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal (high 7.5)
- [CVE-2022-31473](https://insights.sbomify.com/CVE-2022-31473/): BIG-IP APM Appliance mode vulnerability CVE-2022-31473 (medium 6.8)
- [CVE-2022-31472](https://insights.sbomify.com/CVE-2022-31472/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2022-31471](https://insights.sbomify.com/CVE-2022-31471/): untangle vulnerable to Improper Restriction of XML External Entity Reference (high 7.5)
- [CVE-2022-31470](https://insights.sbomify.com/CVE-2022-31470/): Cross-site scripting in axigen:axigen mobile webmail (medium 6.1)
- [CVE-2022-3147](https://insights.sbomify.com/CVE-2022-3147/): Server-side Denial of Service while processing a specifically crafted JPEG file (low 3.1)
- [CVE-2022-31469](https://insights.sbomify.com/CVE-2022-31469/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2022-31468](https://insights.sbomify.com/CVE-2022-31468/): Cross-site scripting in open-xchange:ox app suite (medium 6.1)
- [CVE-2022-31467](https://insights.sbomify.com/CVE-2022-31467/): DLL Hijacking Vulnerability in Quick Heal Total Security (high 7.9)
- [CVE-2022-31466](https://insights.sbomify.com/CVE-2022-31466/): TOCTOU Vulnerability in Quick Heal Total Security (high 7.9)
- [CVE-2022-31465](https://insights.sbomify.com/CVE-2022-31465/): Privilege escalation in Xpedition Designer VX.2.10 (high 7.8)
- [CVE-2022-31464](https://insights.sbomify.com/CVE-2022-31464/): Privilege escalation in adaware:protect (high 7.8)
- [CVE-2022-31463](https://insights.sbomify.com/CVE-2022-31463/): Auth bypass in owllabs:meeting owl pro firmware (high 8.2)
- [CVE-2022-31462](https://insights.sbomify.com/CVE-2022-31462/): Hardcoded credentials in owllabs:meeting owl pro firmware (critical 9.3)
- [CVE-2022-31461](https://insights.sbomify.com/CVE-2022-31461/): Auth bypass in owllabs:meeting owl pro firmware (high 7.4)
- [CVE-2022-31460](https://insights.sbomify.com/CVE-2022-31460/): Hardcoded credentials in owllabs:meeting owl pro firmware (high 7.4)
- [CVE-2022-3146](https://insights.sbomify.com/CVE-2022-3146/): tripleo-ansible may disclose important configuration details from an OpenStack deployment (medium 5.5)
- [CVE-2022-31459](https://insights.sbomify.com/CVE-2022-31459/): Weak cryptography in owllabs:meeting owl pro firmware (high 7.4)
- [CVE-2022-31458](https://insights.sbomify.com/CVE-2022-31458/): Other in rtx trap project:rtx trap (medium 6.1)
- [CVE-2022-31457](https://insights.sbomify.com/CVE-2022-31457/): Path traversal in rtx trap project:rtx trap (high 7.5)
- [CVE-2022-31456](https://insights.sbomify.com/CVE-2022-31456/): Cross-site scripting in truedesk:truedesk (medium 6.1)
- [CVE-2022-31455](https://insights.sbomify.com/CVE-2022-31455/): Cross-site scripting in truedesk:truedesk (medium 6.1)
- [CVE-2022-31454](https://insights.sbomify.com/CVE-2022-31454/): Cross-site scripting in yiiframework:yii (medium 6.1)
- [CVE-2022-3145](https://insights.sbomify.com/CVE-2022-3145/): @okta/oidc-middlewareOpen Redirect vulnerability (medium 4.7)
- [CVE-2022-31447](https://insights.sbomify.com/CVE-2022-31447/): XML external entity in magicpin:magicpin (high 7.5)
- [CVE-2022-31446](https://insights.sbomify.com/CVE-2022-31446/): Command injection in tendacn:ac18 firmware (critical 9.8)
- [CVE-2022-3144](https://insights.sbomify.com/CVE-2022-3144/): Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2022-3143](https://insights.sbomify.com/CVE-2022-3143/): Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator (high 7.4)
- [CVE-2022-3142](https://insights.sbomify.com/CVE-2022-3142/): NEX-Forms < 7.9.7 - Authenticated SQLi (high 8.8)
- [CVE-2022-31415](https://insights.sbomify.com/CVE-2022-31415/): SQL injection in online fire reporting system project:online fire reporting system (medium 6.5)
- [CVE-2022-31414](https://insights.sbomify.com/CVE-2022-31414/): Memory corruption in dlink:dir-1960 firmware (high 7.5)
- [CVE-2022-3141](https://insights.sbomify.com/CVE-2022-3141/): Translatepress Multilinugal < 2.3.3 - Admin+ SQLi (high 8.8)
- [CVE-2022-31405](https://insights.sbomify.com/CVE-2022-31405/): Information disclosure in mv idigital clinic enterprise project:mv idigital clinic enterprise (medium 6.5)
- [CVE-2022-31403](https://insights.sbomify.com/CVE-2022-31403/): Cross-site scripting in combodo:itop (medium 6.1)
- [CVE-2022-31402](https://insights.sbomify.com/CVE-2022-31402/): Cross-site scripting in combodo:itop (medium 6.1)
- [CVE-2022-31400](https://insights.sbomify.com/CVE-2022-31400/): Cross-site scripting in helpdeskz:helpdeskz (medium 4.8)
- [CVE-2022-3140](https://insights.sbomify.com/CVE-2022-3140/): Macro URL arbitrary script execution (medium 6.3)
- [CVE-2022-31398](https://insights.sbomify.com/CVE-2022-31398/): Cross-site scripting in helpdeskz:helpdeskz (medium 4.8)
- [CVE-2022-31395](https://insights.sbomify.com/CVE-2022-31395/): Path traversal in algosolutions:8373 ip zone paging adapter firmware (high 8.8)
- [CVE-2022-31394](https://insights.sbomify.com/CVE-2022-31394/): Denial of service in hyper:hyper (high 7.5)
- [CVE-2022-31393](https://insights.sbomify.com/CVE-2022-31393/): Server-side request forgery in jizhicms:jizhicms (critical 9.1)
- [CVE-2022-31390](https://insights.sbomify.com/CVE-2022-31390/): Server-side request forgery in jizhicms:jizhicms (critical 9.1)
- [CVE-2022-3139](https://insights.sbomify.com/CVE-2022-3139/): We’re Open! < 1.42 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-31386](https://insights.sbomify.com/CVE-2022-31386/): Server-side request forgery in nbnbk project:nbnbk (critical 9.1)
- [CVE-2022-31384](https://insights.sbomify.com/CVE-2022-31384/): SQL injection in phpgurukul:directory management system (critical 9.8)
- [CVE-2022-31383](https://insights.sbomify.com/CVE-2022-31383/): SQL injection in phpgurukul:directory management system (critical 9.8)
- [CVE-2022-31382](https://insights.sbomify.com/CVE-2022-31382/): SQL injection in phpgurukul:directory management system (critical 9.8)
- [CVE-2022-3138](https://insights.sbomify.com/CVE-2022-3138/): Cross-site Scripting (XSS) - Generic in jgraph/drawio (medium 4.3)
- [CVE-2022-31374](https://insights.sbomify.com/CVE-2022-31374/): File upload in contec:sv-cpt-mc310 firmware (critical 9.8)
- [CVE-2022-31373](https://insights.sbomify.com/CVE-2022-31373/): Cross-site scripting in contec:sv-cpt-mc310 firmware (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/316/