# Vulnerabilities published in 2022


- [CVE-2022-28986](https://insights.sbomify.com/CVE-2022-28986/): Missing authorization in lmsdoctor:2 factor authentication (high 7.5)
- [CVE-2022-28985](https://insights.sbomify.com/CVE-2022-28985/): Cross-site scripting in orangehrm:orangehrm (medium 6.3)
- [CVE-2022-28982](https://insights.sbomify.com/CVE-2022-28982/): Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name (medium 6.1)
- [CVE-2022-28981](https://insights.sbomify.com/CVE-2022-28981/): Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module (high 7.5)
- [CVE-2022-28980](https://insights.sbomify.com/CVE-2022-28980/): Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix (medium 6.1)
- [CVE-2022-2898](https://insights.sbomify.com/CVE-2022-2898/): Measuresoft ScadaPro Server and Client Link Following (medium 6.1)
- [CVE-2022-28979](https://insights.sbomify.com/CVE-2022-28979/): Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module (medium 6.1)
- [CVE-2022-28978](https://insights.sbomify.com/CVE-2022-28978/): Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module (medium 5.4)
- [CVE-2022-28977](https://insights.sbomify.com/CVE-2022-28977/): Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented (medium 6.1)
- [CVE-2022-28975](https://insights.sbomify.com/CVE-2022-28975/): Cross-site scripting in infoblox:nios (medium 5.4)
- [CVE-2022-28973](https://insights.sbomify.com/CVE-2022-28973/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-28972](https://insights.sbomify.com/CVE-2022-28972/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-28971](https://insights.sbomify.com/CVE-2022-28971/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-28970](https://insights.sbomify.com/CVE-2022-28970/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-2897](https://insights.sbomify.com/CVE-2022-2897/): Measuresoft ScadaPro Server and Client Link Following (high 7.8)
- [CVE-2022-28969](https://insights.sbomify.com/CVE-2022-28969/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-28966](https://insights.sbomify.com/CVE-2022-28966/): Memory corruption in wasm3 project:wasm3 (medium 5.5)
- [CVE-2022-28965](https://insights.sbomify.com/CVE-2022-28965/): Other in avast:premium security (medium 6.5)
- [CVE-2022-28964](https://insights.sbomify.com/CVE-2022-28964/): Other in avast:premium security (high 7.1)
- [CVE-2022-28962](https://insights.sbomify.com/CVE-2022-28962/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-28961](https://insights.sbomify.com/CVE-2022-28961/): SQL injection in spip:spip (high 8.8)
- [CVE-2022-28960](https://insights.sbomify.com/CVE-2022-28960/): Code injection in spip:spip (high 8.8)
- [CVE-2022-2896](https://insights.sbomify.com/CVE-2022-2896/): Measuresoft ScadaPro Server Use After Free (high 7.8)
- [CVE-2022-28959](https://insights.sbomify.com/CVE-2022-28959/): Cross-site scripting in spip:spip (medium 6.1)
- [CVE-2022-28956](https://insights.sbomify.com/CVE-2022-28956/): Auth bypass in dlink:dir-816l firmware (critical 9.8)
- [CVE-2022-28955](https://insights.sbomify.com/CVE-2022-28955/): Missing authorization in dlink:dir-816l firmware (high 7.5)
- [CVE-2022-2895](https://insights.sbomify.com/CVE-2022-2895/): Measuresoft ScadaPro Server Stack-based Buffer Overflow (high 7.8)
- [CVE-2022-28948](https://insights.sbomify.com/CVE-2022-28948/): gopkg.in/yaml.v3 Denial of Service (high 7.5)
- [CVE-2022-28946](https://insights.sbomify.com/CVE-2022-28946/): Out of bounds memory access in github.com/open-policy-agent/opa (high 7.5)
- [CVE-2022-28945](https://insights.sbomify.com/CVE-2022-28945/): Path traversal in webbank:webcube (critical 9.8)
- [CVE-2022-28944](https://insights.sbomify.com/CVE-2022-28944/): Supply chain in emcosoftware:msi package builder (high 8.8)
- [CVE-2022-28940](https://insights.sbomify.com/CVE-2022-28940/): Missing authorization in h3c:magic r100 firmware (high 7.5)
- [CVE-2022-2894](https://insights.sbomify.com/CVE-2022-2894/): Measuresoft ScadaPro Server Untrusted Pointer Dereference (high 7.8)
- [CVE-2022-28937](https://insights.sbomify.com/CVE-2022-28937/): Integer overflow in fisco-bcos:fisco-bcos (high 7.5)
- [CVE-2022-28936](https://insights.sbomify.com/CVE-2022-28936/): Integer overflow in fisco-bcos:fisco-bcos (high 7.5)
- [CVE-2022-28935](https://insights.sbomify.com/CVE-2022-28935/): Command injection in totolink:a3000ru firmware (high 7.2)
- [CVE-2022-28932](https://insights.sbomify.com/CVE-2022-28932/): Misconfiguration in dlink:dsl-g2452dg firmware (critical 9.8)
- [CVE-2022-28930](https://insights.sbomify.com/CVE-2022-28930/): SQL injection in erp-pro project:erp-pro (critical 9.8)
- [CVE-2022-2893](https://insights.sbomify.com/CVE-2022-2893/): Path traversal in Equipment Predictive Maintenance Solution (high 8.2)
- [CVE-2022-28929](https://insights.sbomify.com/CVE-2022-28929/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-28927](https://insights.sbomify.com/CVE-2022-28927/): File upload in subconverter project:subconverter (critical 9.8)
- [CVE-2022-28924](https://insights.sbomify.com/CVE-2022-28924/): Information disclosure in universis:universis-students (medium 6.5)
- [CVE-2022-28923](https://insights.sbomify.com/CVE-2022-28923/): Open Redirect in Caddy (medium 6.1)
- [CVE-2022-28921](https://insights.sbomify.com/CVE-2022-28921/): Cross-site request forgery in blogengine:blogengine.net (medium 6.5)
- [CVE-2022-28920](https://insights.sbomify.com/CVE-2022-28920/): Cross-site scripting in moecraft:tieba-cloud-sign (medium 4.8)
- [CVE-2022-2892](https://insights.sbomify.com/CVE-2022-2892/): Measuresoft ScadaPro Server Out-of-bounds Write (high 7.8)
- [CVE-2022-28919](https://insights.sbomify.com/CVE-2022-28919/): Cross-site scripting in dokuwiki:dokuwiki (medium 6.1)
- [CVE-2022-28918](https://insights.sbomify.com/CVE-2022-28918/): Path traversal in njtech:greencms (high 8.1)
- [CVE-2022-28917](https://insights.sbomify.com/CVE-2022-28917/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2022-28915](https://insights.sbomify.com/CVE-2022-28915/): Command injection in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-28913](https://insights.sbomify.com/CVE-2022-28913/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28912](https://insights.sbomify.com/CVE-2022-28912/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28911](https://insights.sbomify.com/CVE-2022-28911/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28910](https://insights.sbomify.com/CVE-2022-28910/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-2891](https://insights.sbomify.com/CVE-2022-2891/): WP 2FA < 2.3.0 - Time-Based Side-Channel Attack (medium 5.9)
- [CVE-2022-28909](https://insights.sbomify.com/CVE-2022-28909/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28908](https://insights.sbomify.com/CVE-2022-28908/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28907](https://insights.sbomify.com/CVE-2022-28907/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28906](https://insights.sbomify.com/CVE-2022-28906/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28905](https://insights.sbomify.com/CVE-2022-28905/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-28901](https://insights.sbomify.com/CVE-2022-28901/): Command injection in dlink:dir-882 firmware (critical 9.8)
- [CVE-2022-2890](https://insights.sbomify.com/CVE-2022-2890/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (critical 9.0)
- [CVE-2022-28896](https://insights.sbomify.com/CVE-2022-28896/): Command injection in dlink:dir-882 firmware (critical 9.8)
- [CVE-2022-28895](https://insights.sbomify.com/CVE-2022-28895/): Command injection in dlink:dir-882 firmware (critical 9.8)
- [CVE-2022-28893](https://insights.sbomify.com/CVE-2022-28893/): Use after free in debian:debian linux (high 7.8)
- [CVE-2022-28892](https://insights.sbomify.com/CVE-2022-28892/): Cross-site request forgery in mahara:mahara (high 8.8)
- [CVE-2022-28890](https://insights.sbomify.com/CVE-2022-28890/): Processing external DTDs (critical 9.8)
- [CVE-2022-2889](https://insights.sbomify.com/CVE-2022-2889/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-28889](https://insights.sbomify.com/CVE-2022-28889/): Clickjacking in the web console (medium 4.3)
- [CVE-2022-28888](https://insights.sbomify.com/CVE-2022-28888/): Command injection in spryker:cloud commerce (critical 9.8)
- [CVE-2022-28887](https://insights.sbomify.com/CVE-2022-28887/): Multiple Denial of Service Vulnerability (medium 4.3)
- [CVE-2022-28886](https://insights.sbomify.com/CVE-2022-28886/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28885](https://insights.sbomify.com/CVE-2022-28885/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28884](https://insights.sbomify.com/CVE-2022-28884/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28883](https://insights.sbomify.com/CVE-2022-28883/): Denial-of-Service (DoS) Vulnerability (low 3.5)
- [CVE-2022-28882](https://insights.sbomify.com/CVE-2022-28882/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28881](https://insights.sbomify.com/CVE-2022-28881/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28880](https://insights.sbomify.com/CVE-2022-28880/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-2888](https://insights.sbomify.com/CVE-2022-2888/): Insufficient Session Expiration in octoprint/octoprint (medium 4.4)
- [CVE-2022-28879](https://insights.sbomify.com/CVE-2022-28879/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28878](https://insights.sbomify.com/CVE-2022-28878/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28877](https://insights.sbomify.com/CVE-2022-28877/): Local Privilege Escalation Vulnerability in F-Secure & WithSecure Windows Endpoint Products (medium 4.3)
- [CVE-2022-28876](https://insights.sbomify.com/CVE-2022-28876/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28875](https://insights.sbomify.com/CVE-2022-28875/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28874](https://insights.sbomify.com/CVE-2022-28874/): Multiple Denial-of-Service (DoS) Vulnerabilities (medium 4.3)
- [CVE-2022-28873](https://insights.sbomify.com/CVE-2022-28873/): Multiple Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (medium 4.3)
- [CVE-2022-28872](https://insights.sbomify.com/CVE-2022-28872/): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (medium 4.3)
- [CVE-2022-28871](https://insights.sbomify.com/CVE-2022-28871/): Denial-of-Service (DoS) Vulnerability (medium 4.3)
- [CVE-2022-28870](https://insights.sbomify.com/CVE-2022-28870/): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (medium 4.3)
- [CVE-2022-2887](https://insights.sbomify.com/CVE-2022-2887/): WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-28869](https://insights.sbomify.com/CVE-2022-28869/): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (medium 4.3)
- [CVE-2022-28868](https://insights.sbomify.com/CVE-2022-28868/): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (medium 4.3)
- [CVE-2022-28867](https://insights.sbomify.com/CVE-2022-28867/): Cross-site scripting in nokia:netact (medium 5.4)
- [CVE-2022-28866](https://insights.sbomify.com/CVE-2022-28866/): Missing authorization in nokia:airframe bmc web gui r18 firmware (high 8.8)
- [CVE-2022-28865](https://insights.sbomify.com/CVE-2022-28865/): Cross-site scripting in nokia:netact (medium 5.4)
- [CVE-2022-28864](https://insights.sbomify.com/CVE-2022-28864/): Code injection in nokia:netact (high 8.8)
- [CVE-2022-28863](https://insights.sbomify.com/CVE-2022-28863/): File upload in nokia:netact (high 8.8)
- [CVE-2022-28862](https://insights.sbomify.com/CVE-2022-28862/): SQL injection in archibus:web central (critical 9.8)
- [CVE-2022-28861](https://insights.sbomify.com/CVE-2022-28861/): Information disclosure in citilog:citilog (medium 5.9)
- [CVE-2022-28860](https://insights.sbomify.com/CVE-2022-28860/): Auth bypass in citilog:citilog (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/337/