# Vulnerabilities published in 2022


- [CVE-2022-31372](https://insights.sbomify.com/CVE-2022-31372/): Path traversal in wiris:mathtype (high 7.5)
- [CVE-2022-3137](https://insights.sbomify.com/CVE-2022-3137/): TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload (medium 5.4)
- [CVE-2022-31367](https://insights.sbomify.com/CVE-2022-31367/): Strapi mishandles hidden attributes within admin API responses (high 8.8)
- [CVE-2022-31366](https://insights.sbomify.com/CVE-2022-31366/): File upload in eve-ng:eve-ng (high 7.2)
- [CVE-2022-31364](https://insights.sbomify.com/CVE-2022-31364/): Memory corruption in infineon:cypress bluetooth mesh software development kit (high 8.2)
- [CVE-2022-31363](https://insights.sbomify.com/CVE-2022-31363/): Memory corruption in infineon:cypress bluetooth mesh software development kit (high 8.2)
- [CVE-2022-31362](https://insights.sbomify.com/CVE-2022-31362/): File upload in docebo:docebo (high 8.8)
- [CVE-2022-31361](https://insights.sbomify.com/CVE-2022-31361/): SQL injection in docebo:docebo (critical 9.8)
- [CVE-2022-3136](https://insights.sbomify.com/CVE-2022-3136/): Social Rocket < 1.3.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-31358](https://insights.sbomify.com/CVE-2022-31358/): Cross-site scripting in proxmox:virtual environment (critical 9.0)
- [CVE-2022-31357](https://insights.sbomify.com/CVE-2022-31357/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31356](https://insights.sbomify.com/CVE-2022-31356/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31355](https://insights.sbomify.com/CVE-2022-31355/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31354](https://insights.sbomify.com/CVE-2022-31354/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31353](https://insights.sbomify.com/CVE-2022-31353/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31352](https://insights.sbomify.com/CVE-2022-31352/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31351](https://insights.sbomify.com/CVE-2022-31351/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31350](https://insights.sbomify.com/CVE-2022-31350/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-3135](https://insights.sbomify.com/CVE-2022-3135/): SEO Smart Links <= 3.0.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-31348](https://insights.sbomify.com/CVE-2022-31348/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31347](https://insights.sbomify.com/CVE-2022-31347/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31346](https://insights.sbomify.com/CVE-2022-31346/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31345](https://insights.sbomify.com/CVE-2022-31345/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31344](https://insights.sbomify.com/CVE-2022-31344/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31343](https://insights.sbomify.com/CVE-2022-31343/): SQL injection in oretnom23:online car wash booking system (critical 9.8)
- [CVE-2022-31342](https://insights.sbomify.com/CVE-2022-31342/): Path traversal in oretnom23:online car wash booking system (medium 6.5)
- [CVE-2022-31340](https://insights.sbomify.com/CVE-2022-31340/): SQL injection in argie:simple inventory system (critical 9.8)
- [CVE-2022-3134](https://insights.sbomify.com/CVE-2022-3134/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-31339](https://insights.sbomify.com/CVE-2022-31339/): SQL injection in argie:simple inventory system (high 7.2)
- [CVE-2022-31338](https://insights.sbomify.com/CVE-2022-31338/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31337](https://insights.sbomify.com/CVE-2022-31337/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31336](https://insights.sbomify.com/CVE-2022-31336/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31335](https://insights.sbomify.com/CVE-2022-31335/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-3133](https://insights.sbomify.com/CVE-2022-3133/): OS Command Injection in jgraph/drawio (high 7.0)
- [CVE-2022-31329](https://insights.sbomify.com/CVE-2022-31329/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31328](https://insights.sbomify.com/CVE-2022-31328/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31327](https://insights.sbomify.com/CVE-2022-31327/): SQL injection in online ordering system project:online ordering system (critical 9.8)
- [CVE-2022-31325](https://insights.sbomify.com/CVE-2022-31325/): SQL injection in churchcrm:churchcrm (high 7.2)
- [CVE-2022-31324](https://insights.sbomify.com/CVE-2022-31324/): Path traversal in pentasecurity:wapples (medium 6.5)
- [CVE-2022-31322](https://insights.sbomify.com/CVE-2022-31322/): Privilege escalation in pentasecurity:wapples (high 7.8)
- [CVE-2022-31321](https://insights.sbomify.com/CVE-2022-31321/): Path traversal in boltcms:bolt (critical 9.1)
- [CVE-2022-3132](https://insights.sbomify.com/CVE-2022-3132/): Goolytics - Simple Google Analytics < 1.1.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-31313](https://insights.sbomify.com/CVE-2022-31313/): Backdoor in api-res-py (critical 9.8)
- [CVE-2022-31311](https://insights.sbomify.com/CVE-2022-31311/): Command injection in wavlink:aerial x 1200m firmware (critical 9.8)
- [CVE-2022-3131](https://insights.sbomify.com/CVE-2022-3131/): Search Logger <= 0.9 - Admin+ SQLi (high 7.2)
- [CVE-2022-31309](https://insights.sbomify.com/CVE-2022-31309/): Information disclosure in wavlink:aerial x 1200m firmware (high 7.5)
- [CVE-2022-31308](https://insights.sbomify.com/CVE-2022-31308/): Information disclosure in wavlink:aerial x 1200m firmware (high 7.5)
- [CVE-2022-31307](https://insights.sbomify.com/CVE-2022-31307/): Use after free in f5:njs (medium 5.5)
- [CVE-2022-31306](https://insights.sbomify.com/CVE-2022-31306/): Use after free in f5:njs (medium 5.5)
- [CVE-2022-31303](https://insights.sbomify.com/CVE-2022-31303/): Cross-site scripting in maccms:maccms (medium 5.4)
- [CVE-2022-31302](https://insights.sbomify.com/CVE-2022-31302/): Cross-site scripting in maccms:maccms (medium 5.4)
- [CVE-2022-31301](https://insights.sbomify.com/CVE-2022-31301/): Cross-site scripting in angtech:haraj (medium 5.4)
- [CVE-2022-31300](https://insights.sbomify.com/CVE-2022-31300/): Cross-site scripting in angtech:haraj (medium 5.4)
- [CVE-2022-3130](https://insights.sbomify.com/CVE-2022-3130/): codeprojects Online Driving School login.php sql injection (high 7.3)
- [CVE-2022-31299](https://insights.sbomify.com/CVE-2022-31299/): Cross-site scripting in angtech:haraj (medium 6.1)
- [CVE-2022-31298](https://insights.sbomify.com/CVE-2022-31298/): Cross-site scripting in angtech:haraj (medium 5.4)
- [CVE-2022-31296](https://insights.sbomify.com/CVE-2022-31296/): SQL injection in online discussion forum project:online discussion forum (critical 9.8)
- [CVE-2022-31295](https://insights.sbomify.com/CVE-2022-31295/): Missing authorization in razormist:online discussion forum site (high 7.5)
- [CVE-2022-31294](https://insights.sbomify.com/CVE-2022-31294/): Cross-site request forgery in razormist:online discussion forum site (medium 6.5)
- [CVE-2022-31291](https://insights.sbomify.com/CVE-2022-31291/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2022-31290](https://insights.sbomify.com/CVE-2022-31290/): Known v1.3.1 Cross-site Scripting (medium 5.4)
- [CVE-2022-3129](https://insights.sbomify.com/CVE-2022-3129/): codeprojects Online Driving School registration.php unrestricted upload (medium 6.3)
- [CVE-2022-31287](https://insights.sbomify.com/CVE-2022-31287/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-31285](https://insights.sbomify.com/CVE-2022-31285/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-31282](https://insights.sbomify.com/CVE-2022-31282/): Memory corruption in axiosys:bento4 (medium 5.5)
- [CVE-2022-3128](https://insights.sbomify.com/CVE-2022-3128/): Donation Thermometer < 2.1.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-31277](https://insights.sbomify.com/CVE-2022-31277/): Auth bypass in mi:xiaomi lamp 1 firmware (high 8.8)
- [CVE-2022-31273](https://insights.sbomify.com/CVE-2022-31273/): Auth bypass in 17ido:topidp3000 topsec operating system (critical 9.8)
- [CVE-2022-3127](https://insights.sbomify.com/CVE-2022-3127/): Cross-site Scripting (XSS) - Stored in jgraph/drawio (medium 5.5)
- [CVE-2022-31269](https://insights.sbomify.com/CVE-2022-31269/): Hardcoded credentials in nortekcontrol:emerge e3 firmware (high 8.2)
- [CVE-2022-31268](https://insights.sbomify.com/CVE-2022-31268/): Path traversal in Gitblit (high 7.5)
- [CVE-2022-31267](https://insights.sbomify.com/CVE-2022-31267/): Unescaped control characters in Gitblit (critical 9.8)
- [CVE-2022-31266](https://insights.sbomify.com/CVE-2022-31266/): Auth bypass in ilias:ilias (medium 4.3)
- [CVE-2022-31265](https://insights.sbomify.com/CVE-2022-31265/): Code injection in wargaming:world of warships (high 8.8)
- [CVE-2022-31264](https://insights.sbomify.com/CVE-2022-31264/): Integer overflow in solana_rbpf (high 7.5)
- [CVE-2022-31263](https://insights.sbomify.com/CVE-2022-31263/): Security feature bypass in joinmastodon:mastodon (medium 5.3)
- [CVE-2022-31262](https://insights.sbomify.com/CVE-2022-31262/): Privilege escalation in gog:galaxy (high 7.8)
- [CVE-2022-31261](https://insights.sbomify.com/CVE-2022-31261/): XML external entity in morpheusdata:morpheus (high 7.5)
- [CVE-2022-31260](https://insights.sbomify.com/CVE-2022-31260/): Missing authorization in montala:resourcespace (medium 6.5)
- [CVE-2022-3126](https://insights.sbomify.com/CVE-2022-3126/): Frontend File Manager < 21.4 - File Upload via CSRF (medium 4.3)
- [CVE-2022-31259](https://insights.sbomify.com/CVE-2022-31259/): Access control bypass in beego (critical 9.8)
- [CVE-2022-31258](https://insights.sbomify.com/CVE-2022-31258/): Privilege escalation in checkmk:checkmk (high 8.2)
- [CVE-2022-31257](https://insights.sbomify.com/CVE-2022-31257/): Security feature bypass in Mendix Applications using Mendix 7 (high 7.5)
- [CVE-2022-31256](https://insights.sbomify.com/CVE-2022-31256/): sendmail: mail to root privilege escalation via sm-client.pre script (high 7.7)
- [CVE-2022-31255](https://insights.sbomify.com/CVE-2022-31255/): SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction (medium 4.3)
- [CVE-2022-31254](https://insights.sbomify.com/CVE-2022-31254/): rmt-server-pubcloud allows to escalate from user _rmt to root (high 7.8)
- [CVE-2022-31253](https://insights.sbomify.com/CVE-2022-31253/): openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself (high 7.1)
- [CVE-2022-31252](https://insights.sbomify.com/CVE-2022-31252/): permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() (medium 4.4)
- [CVE-2022-31251](https://insights.sbomify.com/CVE-2022-31251/): slurm: %post for slurm-testsuite operates as root in user owned directory (medium 6.5)
- [CVE-2022-31250](https://insights.sbomify.com/CVE-2022-31250/): keylime %post scriplet allows for privilege escalation from keylime user to root (high 7.1)
- [CVE-2022-3125](https://insights.sbomify.com/CVE-2022-3125/): Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload (high 8.8)
- [CVE-2022-31249](https://insights.sbomify.com/CVE-2022-31249/): [RANCHER] OS command injection in Rancher and Fleet (high 7.5)
- [CVE-2022-31248](https://insights.sbomify.com/CVE-2022-31248/): SUMA user enumeration via weak error message (medium 5.3)
- [CVE-2022-31247](https://insights.sbomify.com/CVE-2022-31247/): Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) (critical 9.1)
- [CVE-2022-31246](https://insights.sbomify.com/CVE-2022-31246/): Other in electrum:electrum (medium 5.5)
- [CVE-2022-31245](https://insights.sbomify.com/CVE-2022-31245/): Command injection in mailcow:mailcow\ (high 8.8)
- [CVE-2022-31244](https://insights.sbomify.com/CVE-2022-31244/): Privilege escalation in nokia:one-network directory server (high 7.8)
- [CVE-2022-31243](https://insights.sbomify.com/CVE-2022-31243/): Race condition in insyde:kernel (medium 6.4)
- [CVE-2022-3124](https://insights.sbomify.com/CVE-2022-3124/): Frontend File Manager < 21.3 - Unauthenticated File Renaming (medium 5.3)
- [CVE-2022-31239](https://insights.sbomify.com/CVE-2022-31239/): Information disclosure in PowerScale OneFS (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/317/