# Vulnerabilities published in 2022


- [CVE-2022-2947](https://insights.sbomify.com/CVE-2022-2947/): Memory corruption in HyperView Player (high 7.8)
- [CVE-2022-29468](https://insights.sbomify.com/CVE-2022-29468/): Cross-site request forgery in AVideo (high 8.8)
- [CVE-2022-29467](https://insights.sbomify.com/CVE-2022-29467/): Information disclosure in Cybozu Garoon (medium 4.3)
- [CVE-2022-29466](https://insights.sbomify.com/CVE-2022-29466/): Denial of service in Intel(R) SPS (high 7.3)
- [CVE-2022-29465](https://insights.sbomify.com/CVE-2022-29465/): Memory corruption in ImageGear (high 8.1)
- [CVE-2022-29464](https://insights.sbomify.com/CVE-2022-29464/): WSO2 Multiple Products Unrestrictive Upload of File (critical 9.8, exploited in the wild)
- [CVE-2022-2946](https://insights.sbomify.com/CVE-2022-2946/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-29458](https://insights.sbomify.com/CVE-2022-29458/): Memory corruption in apple:macos (high 7.1)
- [CVE-2022-29457](https://insights.sbomify.com/CVE-2022-29457/): Information disclosure in zohocorp:manageengine adaudit plus (high 8.8)
- [CVE-2022-29455](https://insights.sbomify.com/CVE-2022-29455/): WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.7)
- [CVE-2022-29454](https://insights.sbomify.com/CVE-2022-29454/): WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (low 3.1)
- [CVE-2022-29453](https://insights.sbomify.com/CVE-2022-29453/): WordPress API KEY for Google Maps plugin <= 1.2.1 - CSRF vulnerability leading to Google Maps API key update (medium 5.4)
- [CVE-2022-29452](https://insights.sbomify.com/CVE-2022-29452/): WordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2022-29451](https://insights.sbomify.com/CVE-2022-29451/): Cross-site request forgery in Rara One Click Demo Import (WordPress plugin) (high 8.8)
- [CVE-2022-29450](https://insights.sbomify.com/CVE-2022-29450/): WordPress Admin Management Xtended plugin <= 2.4.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-2945](https://insights.sbomify.com/CVE-2022-2945/): WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal (medium 4.9)
- [CVE-2022-29449](https://insights.sbomify.com/CVE-2022-29449/): WordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerability (medium 4.1)
- [CVE-2022-29448](https://insights.sbomify.com/CVE-2022-29448/): WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability (medium 6.8)
- [CVE-2022-29447](https://insights.sbomify.com/CVE-2022-29447/): WordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability (medium 6.8)
- [CVE-2022-29446](https://insights.sbomify.com/CVE-2022-29446/): WordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability (medium 6.8)
- [CVE-2022-29445](https://insights.sbomify.com/CVE-2022-29445/): WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability (medium 6.8)
- [CVE-2022-29444](https://insights.sbomify.com/CVE-2022-29444/): WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2022-29443](https://insights.sbomify.com/CVE-2022-29443/): WordPress Hotel Booking plugin <= 3.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (medium 4.1)
- [CVE-2022-29442](https://insights.sbomify.com/CVE-2022-29442/): Private Messages For WordPress <= 2.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2022-29441](https://insights.sbomify.com/CVE-2022-29441/): Cross-site request forgery in Private Messages For WordPress (WordPress plugin) (medium 4.3)
- [CVE-2022-29440](https://insights.sbomify.com/CVE-2022-29440/): WordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (medium 5.4)
- [CVE-2022-29439](https://insights.sbomify.com/CVE-2022-29439/): Cross-site request forgery in Image Slider by NextCode – Photo & Video SLider (WordPress plugin) (medium 5.4)
- [CVE-2022-29438](https://insights.sbomify.com/CVE-2022-29438/): WordPress Image Slider by NextCode plugin <= 1.1.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-29437](https://insights.sbomify.com/CVE-2022-29437/): WordPress Image Slider by NextCode plugin <= 1.1.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-29436](https://insights.sbomify.com/CVE-2022-29436/): Cross-site request forgery in Code Snippets Extended (WordPress plugin) (medium 4.7)
- [CVE-2022-29435](https://insights.sbomify.com/CVE-2022-29435/): WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-29434](https://insights.sbomify.com/CVE-2022-29434/): WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability (medium 6.3)
- [CVE-2022-29433](https://insights.sbomify.com/CVE-2022-29433/): Cross-site scripting in Donations (WordPress plugin) (medium 4.1)
- [CVE-2022-29432](https://insights.sbomify.com/CVE-2022-29432/): WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (low 3.4)
- [CVE-2022-29431](https://insights.sbomify.com/CVE-2022-29431/): Remove CPT base <= 5.8 - CSRF leads to CPT base deletion (medium 5.4)
- [CVE-2022-29430](https://insights.sbomify.com/CVE-2022-29430/): Cross-site request forgery in PNG to JPG (WordPress plugin) (medium 4.7)
- [CVE-2022-2943](https://insights.sbomify.com/CVE-2022-2943/): WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read (medium 4.9)
- [CVE-2022-29429](https://insights.sbomify.com/CVE-2022-29429/): Cross-site request forgery in Code Snippets Extended (WordPress plugin) (high 8.8)
- [CVE-2022-29428](https://insights.sbomify.com/CVE-2022-29428/): WordPress WP Slider Plugin <= 1.4.5 - Cross-Site Scripting (XSS) vulnerability (medium 4.1)
- [CVE-2022-29427](https://insights.sbomify.com/CVE-2022-29427/): WordPress Disable Right Click For WP plugin <= 1.1.6 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2022-29426](https://insights.sbomify.com/CVE-2022-29426/): Cross-site scripting in Slideshow, Image Slider by 2J (WordPress plugin) (medium 5.4)
- [CVE-2022-29425](https://insights.sbomify.com/CVE-2022-29425/): WordPress Checkout Files Upload for WooCommerce plugin <= 2.1.2 - Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2022-29424](https://insights.sbomify.com/CVE-2022-29424/): Cross-site scripting in Image Hover Effects Ultimate (WordPress plugin) (medium 4.8)
- [CVE-2022-29423](https://insights.sbomify.com/CVE-2022-29423/): WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerability (low 3.8)
- [CVE-2022-29422](https://insights.sbomify.com/CVE-2022-29422/): Cross-site scripting in Countdown & Clock (WordPress plugin) (medium 4.8)
- [CVE-2022-29421](https://insights.sbomify.com/CVE-2022-29421/): WordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.7)
- [CVE-2022-29420](https://insights.sbomify.com/CVE-2022-29420/): WordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2022-29419](https://insights.sbomify.com/CVE-2022-29419/): WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability (medium 6.0)
- [CVE-2022-29418](https://insights.sbomify.com/CVE-2022-29418/): WordPress Night Mode plugin <= 1.0.0 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-29417](https://insights.sbomify.com/CVE-2022-29417/): WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability (medium 4.3)
- [CVE-2022-29416](https://insights.sbomify.com/CVE-2022-29416/): WordPress Afterpay Gateway for WooCommerce Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS) (medium 4.7)
- [CVE-2022-29415](https://insights.sbomify.com/CVE-2022-29415/): WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2022-29414](https://insights.sbomify.com/CVE-2022-29414/): WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-29413](https://insights.sbomify.com/CVE-2022-29413/): Cross-site request forgery in Hermit 音乐播放器 (WordPress plugin) (medium 4.7)
- [CVE-2022-29412](https://insights.sbomify.com/CVE-2022-29412/): WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (medium 5.4)
- [CVE-2022-29411](https://insights.sbomify.com/CVE-2022-29411/): WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Unauthenticated SQL Injection SQLi) vulnerability (high 8.3)
- [CVE-2022-29410](https://insights.sbomify.com/CVE-2022-29410/): WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Authenticated SQL Injection (SQLi) vulnerability (high 7.4)
- [CVE-2022-2941](https://insights.sbomify.com/CVE-2022-2941/): WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-29408](https://insights.sbomify.com/CVE-2022-29408/): Cross-site scripting in Advanced Contact form 7 DB (WordPress plugin) (medium 4.7)
- [CVE-2022-29406](https://insights.sbomify.com/CVE-2022-29406/): WordPress Team Manager plugin <= 1.6.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (medium 4.1)
- [CVE-2022-29405](https://insights.sbomify.com/CVE-2022-29405/): Apache Archiva Arbitrary user password reset vulnerability (medium 6.5)
- [CVE-2022-29404](https://insights.sbomify.com/CVE-2022-29404/): Denial of service in mod_lua r:parsebody (high 7.5)
- [CVE-2022-29402](https://insights.sbomify.com/CVE-2022-29402/): Auth bypass in tp-link:tl-wr840n firmware (medium 6.8)
- [CVE-2022-29399](https://insights.sbomify.com/CVE-2022-29399/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29398](https://insights.sbomify.com/CVE-2022-29398/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29397](https://insights.sbomify.com/CVE-2022-29397/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29396](https://insights.sbomify.com/CVE-2022-29396/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29395](https://insights.sbomify.com/CVE-2022-29395/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29394](https://insights.sbomify.com/CVE-2022-29394/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29393](https://insights.sbomify.com/CVE-2022-29393/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29392](https://insights.sbomify.com/CVE-2022-29392/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-29391](https://insights.sbomify.com/CVE-2022-29391/): Memory corruption in totolink:n600r firmware (critical 9.8)
- [CVE-2022-2939](https://insights.sbomify.com/CVE-2022-2939/): WP Cerber Security <= 9.0 - User Enumeration Bypass (medium 5.3)
- [CVE-2022-29383](https://insights.sbomify.com/CVE-2022-29383/): SQL injection in netgear:ssl312 firmware (critical 9.8)
- [CVE-2022-29380](https://insights.sbomify.com/CVE-2022-29380/): Cross-site scripting in creativeitem:academy lms (medium 4.8)
- [CVE-2022-2938](https://insights.sbomify.com/CVE-2022-2938/): Use after free in kernel (high 7.8)
- [CVE-2022-29379](https://insights.sbomify.com/CVE-2022-29379/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2022-29377](https://insights.sbomify.com/CVE-2022-29377/): Memory corruption in totolink:a3600r firmware (high 7.5)
- [CVE-2022-29376](https://insights.sbomify.com/CVE-2022-29376/): Misconfiguration in apachefriends:xampp (high 8.8)
- [CVE-2022-2937](https://insights.sbomify.com/CVE-2022-2937/): Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description (medium 6.4)
- [CVE-2022-29369](https://insights.sbomify.com/CVE-2022-29369/): Memory corruption in f5:njs (high 7.5)
- [CVE-2022-29368](https://insights.sbomify.com/CVE-2022-29368/): Memory corruption in moddable:moddable (high 7.1)
- [CVE-2022-29363](https://insights.sbomify.com/CVE-2022-29363/): Deserialization in phpok:phpok (critical 9.8)
- [CVE-2022-29362](https://insights.sbomify.com/CVE-2022-29362/): Cross-site Scripting in ZKEACMS (medium 5.4)
- [CVE-2022-29361](https://insights.sbomify.com/CVE-2022-29361/): Other in palletsprojects:werkzeug (critical 9.8)
- [CVE-2022-29360](https://insights.sbomify.com/CVE-2022-29360/): Cross-site scripting in rainloop:webmail (medium 5.4)
- [CVE-2022-2936](https://insights.sbomify.com/CVE-2022-2936/): Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link (medium 6.4)
- [CVE-2022-29359](https://insights.sbomify.com/CVE-2022-29359/): Cross-site scripting in school club application system project:school club application system (medium 6.1)
- [CVE-2022-29358](https://insights.sbomify.com/CVE-2022-29358/): Integer overflow in epub2txt2 project:epub2txt2 (medium 5.5)
- [CVE-2022-29354](https://insights.sbomify.com/CVE-2022-29354/): File upload in keystonejs:keystone (critical 9.8)
- [CVE-2022-29353](https://insights.sbomify.com/CVE-2022-29353/): File upload in graphql-upload project:graphql-upload (critical 9.8)
- [CVE-2022-29351](https://insights.sbomify.com/CVE-2022-29351/): File upload in tiddlywiki:tiddlywiki5 (critical 9.8)
- [CVE-2022-2935](https://insights.sbomify.com/CVE-2022-2935/): Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL (medium 6.4)
- [CVE-2022-29349](https://insights.sbomify.com/CVE-2022-29349/): Cross-site scripting in keking:kkfileview (medium 6.1)
- [CVE-2022-29347](https://insights.sbomify.com/CVE-2022-29347/): File upload in web\@rchiv project:web\@rchiv (critical 9.8)
- [CVE-2022-29340](https://insights.sbomify.com/CVE-2022-29340/): Null dereference in gpac:gpac (high 7.5)
- [CVE-2022-2934](https://insights.sbomify.com/CVE-2022-2934/): Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URL (medium 6.4)
- [CVE-2022-29339](https://insights.sbomify.com/CVE-2022-29339/): Denial of service in gpac:gpac (high 7.5)
- [CVE-2022-29337](https://insights.sbomify.com/CVE-2022-29337/): Command injection in cdatatec:fd702xw-x-r430 firmware (critical 9.8)
- [CVE-2022-29334](https://insights.sbomify.com/CVE-2022-29334/): Auth bypass in h project:h (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/333/