# Vulnerabilities published in 2022


- [CVE-2022-30078](https://insights.sbomify.com/CVE-2022-30078/): Command injection in netgear:r6200 firmware (high 8.8)
- [CVE-2022-30076](https://insights.sbomify.com/CVE-2022-30076/): Information disclosure in entab:erp (medium 5.3)
- [CVE-2022-30075](https://insights.sbomify.com/CVE-2022-30075/): Code injection in tp-link:archer ax50 firmware (high 8.8)
- [CVE-2022-30073](https://insights.sbomify.com/CVE-2022-30073/): Cross-site scripting in wbce:wbce cms (medium 5.4)
- [CVE-2022-30072](https://insights.sbomify.com/CVE-2022-30072/): Cross-site scripting in wbce:wbce cms (medium 5.4)
- [CVE-2022-3007](https://insights.sbomify.com/CVE-2022-3007/): Unauthorized Access Vulnerability in Syska SW100 Smartwatch (high 8.1)
- [CVE-2022-30067](https://insights.sbomify.com/CVE-2022-30067/): Memory corruption in gimp:gimp (medium 5.5)
- [CVE-2022-30065](https://insights.sbomify.com/CVE-2022-30065/): Use after free in busybox:busybox (high 7.8)
- [CVE-2022-30063](https://insights.sbomify.com/CVE-2022-30063/): Code injection in ftcms:ftcms (critical 9.8)
- [CVE-2022-30062](https://insights.sbomify.com/CVE-2022-30062/): Path traversal in ftcms:ftcms (medium 6.5)
- [CVE-2022-30061](https://insights.sbomify.com/CVE-2022-30061/): Path traversal in ftcms:ftcms (medium 6.5)
- [CVE-2022-30060](https://insights.sbomify.com/CVE-2022-30060/): Path traversal in ftcms:ftcms (high 8.8)
- [CVE-2022-30059](https://insights.sbomify.com/CVE-2022-30059/): Path traversal in shopwind:shopwind (medium 6.5)
- [CVE-2022-30058](https://insights.sbomify.com/CVE-2022-30058/): Path traversal in shopwind:shopwind (medium 5.3)
- [CVE-2022-30057](https://insights.sbomify.com/CVE-2022-30057/): Cross-site scripting in shopwind:shopwind (medium 5.4)
- [CVE-2022-30055](https://insights.sbomify.com/CVE-2022-30055/): Memory corruption in mersenne:prime95 (critical 9.8)
- [CVE-2022-30054](https://insights.sbomify.com/CVE-2022-30054/): SQL injection in covid 19 travel pass management project:covid 19 travel pass management (critical 9.8)
- [CVE-2022-30053](https://insights.sbomify.com/CVE-2022-30053/): SQL injection in oretnom23:toll tax management system (critical 9.8)
- [CVE-2022-30052](https://insights.sbomify.com/CVE-2022-30052/): SQL injection in home clean service system project:home clean service system (critical 9.8)
- [CVE-2022-30050](https://insights.sbomify.com/CVE-2022-30050/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2022-3005](https://insights.sbomify.com/CVE-2022-3005/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (medium 5.4)
- [CVE-2022-30049](https://insights.sbomify.com/CVE-2022-30049/): Server-side request forgery in ruifang-tech:rebuild (high 7.5)
- [CVE-2022-30048](https://insights.sbomify.com/CVE-2022-30048/): SQL injection in mingsoft:mcms (critical 9.8)
- [CVE-2022-30047](https://insights.sbomify.com/CVE-2022-30047/): SQL injection in mingsoft:mcms (critical 9.8)
- [CVE-2022-30045](https://insights.sbomify.com/CVE-2022-30045/): Memory corruption in ezxml project:ezxml (medium 6.5)
- [CVE-2022-30040](https://insights.sbomify.com/CVE-2022-30040/): Memory corruption in tenda:ax1803 firmware (high 7.5)
- [CVE-2022-3004](https://insights.sbomify.com/CVE-2022-3004/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (medium 6.3)
- [CVE-2022-30037](https://insights.sbomify.com/CVE-2022-30037/): Code injection in xunruicms:xunruicms (high 7.2)
- [CVE-2022-30036](https://insights.sbomify.com/CVE-2022-30036/): Hardcoded credentials in malighting:grandma2 light firmware (high 8.8)
- [CVE-2022-30034](https://insights.sbomify.com/CVE-2022-30034/): Flower OAuth authentication bypass (high 8.6)
- [CVE-2022-30033](https://insights.sbomify.com/CVE-2022-30033/): Memory corruption in tenda:tx9 pro firmware (high 7.5)
- [CVE-2022-30028](https://insights.sbomify.com/CVE-2022-30028/): Race condition in dradisframework:dradis (medium 5.9)
- [CVE-2022-30025](https://insights.sbomify.com/CVE-2022-30025/): SQL injection in credenceanalytics:ideal - wealth and funds (medium 6.5)
- [CVE-2022-30024](https://insights.sbomify.com/CVE-2022-30024/): Memory corruption in tp-link:tl-wr841 firmware (high 8.8)
- [CVE-2022-30023](https://insights.sbomify.com/CVE-2022-30023/): Command injection in tenda:hg9 firmware (high 8.8)
- [CVE-2022-3002](https://insights.sbomify.com/CVE-2022-3002/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (medium 5.4)
- [CVE-2022-30018](https://insights.sbomify.com/CVE-2022-30018/): Information disclosure in mobotix:mxcontrolcenter (high 8.8)
- [CVE-2022-30017](https://insights.sbomify.com/CVE-2022-30017/): Cross-site scripting in rescue dispatch management system project:rescue dispatch management system (medium 5.4)
- [CVE-2022-30016](https://insights.sbomify.com/CVE-2022-30016/): Missing authorization in rescue dispatch management system project:rescue dispatch management system (high 8.8)
- [CVE-2022-30015](https://insights.sbomify.com/CVE-2022-30015/): Cross-site scripting in simple food website project:simple food website (medium 5.4)
- [CVE-2022-30014](https://insights.sbomify.com/CVE-2022-30014/): Cross-site request forgery in simple food website project:simple food website (high 8.8)
- [CVE-2022-30013](https://insights.sbomify.com/CVE-2022-30013/): Cross-site scripting in totaljs:total.js (medium 5.4)
- [CVE-2022-30012](https://insights.sbomify.com/CVE-2022-30012/): SQL injection in hospital management system project:hospital management system (high 7.5)
- [CVE-2022-30011](https://insights.sbomify.com/CVE-2022-30011/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-3001](https://insights.sbomify.com/CVE-2022-3001/): Vulnerability in Milesight Video Management Systems (VMS) (high 7.5)
- [CVE-2022-30007](https://insights.sbomify.com/CVE-2022-30007/): File upload in gxcms project:gxcms (high 7.2)
- [CVE-2022-30004](https://insights.sbomify.com/CVE-2022-30004/): SQL injection in online market place site project:online market place site (critical 9.8)
- [CVE-2022-30003](https://insights.sbomify.com/CVE-2022-30003/): Cross-site scripting in online market place site project:online market place site (medium 5.4)
- [CVE-2022-30002](https://insights.sbomify.com/CVE-2022-30002/): SQL injection in angeljudesuarez:insurance management system (high 7.2)
- [CVE-2022-30001](https://insights.sbomify.com/CVE-2022-30001/): SQL injection in angeljudesuarez:insurance management system (critical 9.8)
- [CVE-2022-30000](https://insights.sbomify.com/CVE-2022-30000/): SQL injection in angeljudesuarez:insurance management system (critical 9.8)
- [CVE-2022-3000](https://insights.sbomify.com/CVE-2022-3000/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (medium 6.3)
- [CVE-2022-29999](https://insights.sbomify.com/CVE-2022-29999/): SQL injection in angeljudesuarez:insurance management system (critical 9.8)
- [CVE-2022-29998](https://insights.sbomify.com/CVE-2022-29998/): SQL injection in angeljudesuarez:insurance management system (critical 9.8)
- [CVE-2022-29995](https://insights.sbomify.com/CVE-2022-29995/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29994](https://insights.sbomify.com/CVE-2022-29994/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29993](https://insights.sbomify.com/CVE-2022-29993/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29992](https://insights.sbomify.com/CVE-2022-29992/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29990](https://insights.sbomify.com/CVE-2022-29990/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29989](https://insights.sbomify.com/CVE-2022-29989/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29988](https://insights.sbomify.com/CVE-2022-29988/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29987](https://insights.sbomify.com/CVE-2022-29987/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29986](https://insights.sbomify.com/CVE-2022-29986/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29985](https://insights.sbomify.com/CVE-2022-29985/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-29984](https://insights.sbomify.com/CVE-2022-29984/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29983](https://insights.sbomify.com/CVE-2022-29983/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29982](https://insights.sbomify.com/CVE-2022-29982/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29981](https://insights.sbomify.com/CVE-2022-29981/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29980](https://insights.sbomify.com/CVE-2022-29980/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-2998](https://insights.sbomify.com/CVE-2022-2998/): Use after free in Chrome (high 8.8)
- [CVE-2022-29979](https://insights.sbomify.com/CVE-2022-29979/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-29978](https://insights.sbomify.com/CVE-2022-29978/): Denial of service in saitoha:libsixel (medium 6.5)
- [CVE-2022-29977](https://insights.sbomify.com/CVE-2022-29977/): Denial of service in saitoha:libsixel (medium 6.5)
- [CVE-2022-29976](https://insights.sbomify.com/CVE-2022-29976/): Cross-site scripting in altn:mdaemon (medium 5.4)
- [CVE-2022-29975](https://insights.sbomify.com/CVE-2022-29975/): Cross-site scripting in altn:mdaemon (medium 5.4)
- [CVE-2022-29974](https://insights.sbomify.com/CVE-2022-29974/): AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. (medium 4.3)
- [CVE-2022-29973](https://insights.sbomify.com/CVE-2022-29973/): Information disclosure in exfat project:exfat (medium 4.7)
- [CVE-2022-29972](https://insights.sbomify.com/CVE-2022-29972/): Command injection in insightsoftware:magnitude simba amazon redshift odbc driver (high 7.8)
- [CVE-2022-29971](https://insights.sbomify.com/CVE-2022-29971/): Command injection in insightsoftware:magnitude simba amazon athena odbc driver (high 7.8)
- [CVE-2022-29970](https://insights.sbomify.com/CVE-2022-29970/): sinatra does not validate expanded path matches (high 7.5)
- [CVE-2022-2997](https://insights.sbomify.com/CVE-2022-2997/): Session Fixation in snipe/snipe-it (medium 4.6)
- [CVE-2022-29969](https://insights.sbomify.com/CVE-2022-29969/): Cross-site scripting in mediawiki:rss for mediawiki (medium 6.1)
- [CVE-2022-29968](https://insights.sbomify.com/CVE-2022-29968/): Other in fedoraproject:fedora (high 7.8)
- [CVE-2022-29967](https://insights.sbomify.com/CVE-2022-29967/): Path traversal in glewlwyd project:glewlwyd (high 7.5)
- [CVE-2022-29965](https://insights.sbomify.com/CVE-2022-29965/): Weak cryptography in emerson:deltav distributed control system (medium 5.5)
- [CVE-2022-29964](https://insights.sbomify.com/CVE-2022-29964/): Hardcoded credentials in emerson:deltav distributed control system sq controller firmware (medium 5.5)
- [CVE-2022-29963](https://insights.sbomify.com/CVE-2022-29963/): Hardcoded credentials in emerson:deltav distributed control system sq controller firmware (medium 5.5)
- [CVE-2022-29962](https://insights.sbomify.com/CVE-2022-29962/): Hardcoded credentials in emerson:deltav distributed control system sq controller firmware (medium 5.5)
- [CVE-2022-29960](https://insights.sbomify.com/CVE-2022-29960/): Hardcoded credentials in emerson:openbsi (medium 5.5)
- [CVE-2022-2996](https://insights.sbomify.com/CVE-2022-2996/): python-scciclient vulnerable to Man-in-the-middle (MITM) attacks (high 7.4)
- [CVE-2022-29959](https://insights.sbomify.com/CVE-2022-29959/): Weak cryptography in emerson:openbsi (medium 5.5)
- [CVE-2022-29958](https://insights.sbomify.com/CVE-2022-29958/): Security feature bypass in jtekt:nano 10gx tuc-1157 firmware (critical 9.8)
- [CVE-2022-29957](https://insights.sbomify.com/CVE-2022-29957/): Auth bypass in emerson:deltav distributed control system (high 7.8)
- [CVE-2022-29953](https://insights.sbomify.com/CVE-2022-29953/): Hardcoded credentials in bakerhughes:bently nevada 3701\/40 firmware (critical 9.8)
- [CVE-2022-29952](https://insights.sbomify.com/CVE-2022-29952/): Auth bypass in bakerhughes:bently nevada 3701\/40 firmware (critical 9.1)
- [CVE-2022-29951](https://insights.sbomify.com/CVE-2022-29951/): Auth bypass in jtekt:nano 10gx tuc-1157 firmware (critical 9.1)
- [CVE-2022-29950](https://insights.sbomify.com/CVE-2022-29950/): Business logic in experian:hunter (medium 4.3)
- [CVE-2022-2995](https://insights.sbomify.com/CVE-2022-2995/): CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure (high 7.1)
- [CVE-2022-29948](https://insights.sbomify.com/CVE-2022-29948/): Auth bypass in lepin ep-kp001 project:lepinep-kp001 firmware (medium 4.6)
- [CVE-2022-29947](https://insights.sbomify.com/CVE-2022-29947/): Woodpecker allows cross-site scripting (XSS) via build logs (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/328/