# Vulnerabilities published in 2022


- [CVE-2022-28654](https://insights.sbomify.com/CVE-2022-28654/): Denial of service in Apport (medium 5.5)
- [CVE-2022-28653](https://insights.sbomify.com/CVE-2022-28653/): Denial of service in Apport (high 7.5)
- [CVE-2022-28652](https://insights.sbomify.com/CVE-2022-28652/): Denial of service in Apport (medium 5.5)
- [CVE-2022-28651](https://insights.sbomify.com/CVE-2022-28651/): Information disclosure in IntelliJ IDEA (high 8.4)
- [CVE-2022-28650](https://insights.sbomify.com/CVE-2022-28650/): Cross-site scripting in YouTrack (high 7.3)
- [CVE-2022-2865](https://insights.sbomify.com/CVE-2022-2865/): Cross-site scripting in GitLab (high 7.3)
- [CVE-2022-28649](https://insights.sbomify.com/CVE-2022-28649/): Other in YouTrack (medium 4.6)
- [CVE-2022-28648](https://insights.sbomify.com/CVE-2022-28648/): Cross-site scripting in YouTrack (medium 5.7)
- [CVE-2022-28647](https://insights.sbomify.com/CVE-2022-28647/): Memory corruption in MicroStation CONNECT (high 7.8)
- [CVE-2022-28646](https://insights.sbomify.com/CVE-2022-28646/): Memory corruption in MicroStation CONNECT (high 7.8)
- [CVE-2022-28645](https://insights.sbomify.com/CVE-2022-28645/): Memory corruption in MicroStation CONNECT (low 3.3)
- [CVE-2022-28644](https://insights.sbomify.com/CVE-2022-28644/): Memory corruption in MicroStation CONNECT (high 7.8)
- [CVE-2022-28643](https://insights.sbomify.com/CVE-2022-28643/): Memory corruption in MicroStation CONNECT (high 7.8)
- [CVE-2022-28642](https://insights.sbomify.com/CVE-2022-28642/): Memory corruption in MicroStation CONNECT (high 7.8)
- [CVE-2022-28641](https://insights.sbomify.com/CVE-2022-28641/): Use after free in MicroStation CONNECT (high 7.8)
- [CVE-2022-28640](https://insights.sbomify.com/CVE-2022-28640/): Code injection in HPE Integrated Lights-Out 5 (iLO 5) (high 8.8)
- [CVE-2022-2864](https://insights.sbomify.com/CVE-2022-2864/): Cross-site request forgery in demon image annotation (high 8.8)
- [CVE-2022-28639](https://insights.sbomify.com/CVE-2022-28639/): Denial of service in HPE Integrated Lights-Out 5 (iLO 5) (high 8.8)
- [CVE-2022-28638](https://insights.sbomify.com/CVE-2022-28638/): Information disclosure in HPE Integrated Lights-Out 5 (iLO 5) (high 7.8)
- [CVE-2022-28637](https://insights.sbomify.com/CVE-2022-28637/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 7.8)
- [CVE-2022-28636](https://insights.sbomify.com/CVE-2022-28636/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 7.4)
- [CVE-2022-28635](https://insights.sbomify.com/CVE-2022-28635/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 7.4)
- [CVE-2022-28634](https://insights.sbomify.com/CVE-2022-28634/): Other in HPE Integrated Lights-Out 5 (iLO 5) (medium 6.7)
- [CVE-2022-28633](https://insights.sbomify.com/CVE-2022-28633/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 7.3)
- [CVE-2022-28632](https://insights.sbomify.com/CVE-2022-28632/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 8.8)
- [CVE-2022-28631](https://insights.sbomify.com/CVE-2022-28631/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 8.8)
- [CVE-2022-28630](https://insights.sbomify.com/CVE-2022-28630/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 7.3)
- [CVE-2022-2863](https://insights.sbomify.com/CVE-2022-2863/): WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read (medium 4.9)
- [CVE-2022-28629](https://insights.sbomify.com/CVE-2022-28629/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 7.8)
- [CVE-2022-28628](https://insights.sbomify.com/CVE-2022-28628/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 8.4)
- [CVE-2022-28627](https://insights.sbomify.com/CVE-2022-28627/): Other in HPE Integrated Lights-Out 5 (iLO 5) (high 8.4)
- [CVE-2022-28626](https://insights.sbomify.com/CVE-2022-28626/): Other in HPE Integrated Lights-Out 5 (iLO 5) (medium 6.7)
- [CVE-2022-28625](https://insights.sbomify.com/CVE-2022-28625/): Information disclosure in HPE OneView (medium 5.5)
- [CVE-2022-28624](https://insights.sbomify.com/CVE-2022-28624/): Cross-site scripting in HPE FlexNetwork 5130 EI Switch Series; HPE FlexFabric 5945 Switch Series (medium 4.8)
- [CVE-2022-28623](https://insights.sbomify.com/CVE-2022-28623/): SQL injection in HPE IceWall SSO (critical 9.8)
- [CVE-2022-28622](https://insights.sbomify.com/CVE-2022-28622/): Weak cryptography in HPE StoreOnce Software (high 7.5)
- [CVE-2022-28621](https://insights.sbomify.com/CVE-2022-28621/): Information disclosure in HPE NonStop DSM/SCM T6031 (high 7.5)
- [CVE-2022-28620](https://insights.sbomify.com/CVE-2022-28620/): Auth bypass in Cray Legacy Shasta System Solutions; HPE Slingshot; HPE Cray EX supercomputers (critical 9.8)
- [CVE-2022-2862](https://insights.sbomify.com/CVE-2022-2862/): Use After Free in vim/vim (high 7.6)
- [CVE-2022-28619](https://insights.sbomify.com/CVE-2022-28619/): Privilege escalation in HPE Version Control Repository Manager (high 7.8)
- [CVE-2022-28618](https://insights.sbomify.com/CVE-2022-28618/): Command injection in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays (critical 9.8)
- [CVE-2022-28617](https://insights.sbomify.com/CVE-2022-28617/): Security feature bypass in HPE OneView (critical 9.8)
- [CVE-2022-28616](https://insights.sbomify.com/CVE-2022-28616/): Server-side request forgery in HPE OneView (critical 9.8)
- [CVE-2022-28615](https://insights.sbomify.com/CVE-2022-28615/): Read beyond bounds in ap_strcmp_match() (critical 9.1)
- [CVE-2022-28614](https://insights.sbomify.com/CVE-2022-28614/): read beyond bounds via ap_rwrite() (medium 5.3)
- [CVE-2022-28613](https://insights.sbomify.com/CVE-2022-28613/): Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series (high 7.5)
- [CVE-2022-28612](https://insights.sbomify.com/CVE-2022-28612/): Cross-site scripting in Custom Popup Builder (WordPress plugin) (medium 5.4)
- [CVE-2022-28611](https://insights.sbomify.com/CVE-2022-28611/): Privilege escalation in Intel(R) XMM(TM) 7560 Modem software (medium 6.8)
- [CVE-2022-2861](https://insights.sbomify.com/CVE-2022-2861/): Cross-site scripting in Chrome (medium 6.5)
- [CVE-2022-28607](https://insights.sbomify.com/CVE-2022-28607/): Information disclosure in isic.lk project:isic.lk (high 7.5)
- [CVE-2022-28606](https://insights.sbomify.com/CVE-2022-28606/): File upload in bosscms:bosscms (critical 9.8)
- [CVE-2022-28605](https://insights.sbomify.com/CVE-2022-28605/): Hardcoded credentials in linkplay:sound bar (critical 9.8)
- [CVE-2022-28601](https://insights.sbomify.com/CVE-2022-28601/): Auth bypass in lmsdoctor:2 factor authentication (medium 6.5)
- [CVE-2022-2860](https://insights.sbomify.com/CVE-2022-2860/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-28599](https://insights.sbomify.com/CVE-2022-28599/): Cross-site scripting in thedaylightstudio:fuel cms (medium 5.4)
- [CVE-2022-28598](https://insights.sbomify.com/CVE-2022-28598/): Cross-site scripting in frappe:erpnext (medium 6.1)
- [CVE-2022-28590](https://insights.sbomify.com/CVE-2022-28590/): Code injection in pixelimity:pixelimity (high 7.2)
- [CVE-2022-2859](https://insights.sbomify.com/CVE-2022-2859/): Use after free in Chrome (high 8.8)
- [CVE-2022-28589](https://insights.sbomify.com/CVE-2022-28589/): Cross-site scripting in pixelimity:pixelimity (medium 4.8)
- [CVE-2022-28588](https://insights.sbomify.com/CVE-2022-28588/): Cross-site scripting in springbootmovie project:springbootmovie (medium 5.4)
- [CVE-2022-28586](https://insights.sbomify.com/CVE-2022-28586/): Cross-site scripting in hoosk:hoosk (medium 6.1)
- [CVE-2022-28585](https://insights.sbomify.com/CVE-2022-28585/): SQL injection in phome:empirecms (critical 9.8)
- [CVE-2022-28584](https://insights.sbomify.com/CVE-2022-28584/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28583](https://insights.sbomify.com/CVE-2022-28583/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28582](https://insights.sbomify.com/CVE-2022-28582/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28581](https://insights.sbomify.com/CVE-2022-28581/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28580](https://insights.sbomify.com/CVE-2022-28580/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-2858](https://insights.sbomify.com/CVE-2022-2858/): Use after free in Chrome (high 8.8)
- [CVE-2022-28579](https://insights.sbomify.com/CVE-2022-28579/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28578](https://insights.sbomify.com/CVE-2022-28578/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28577](https://insights.sbomify.com/CVE-2022-28577/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28575](https://insights.sbomify.com/CVE-2022-28575/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2022-28573](https://insights.sbomify.com/CVE-2022-28573/): Command injection in dlink:dir-823 pro firmware (critical 9.8)
- [CVE-2022-28572](https://insights.sbomify.com/CVE-2022-28572/): Command injection in tenda:ax1803 firmware (high 8.8)
- [CVE-2022-28571](https://insights.sbomify.com/CVE-2022-28571/): Command injection in dlink:dir-882 firmware (critical 9.8)
- [CVE-2022-2857](https://insights.sbomify.com/CVE-2022-2857/): Use after free in Chrome (high 8.8)
- [CVE-2022-28568](https://insights.sbomify.com/CVE-2022-28568/): File upload in simple doctor\'s appointment system project:simple doctor\'s appointment system (critical 9.8)
- [CVE-2022-28561](https://insights.sbomify.com/CVE-2022-28561/): Memory corruption in tenda:ax12 firmware (critical 9.8)
- [CVE-2022-28560](https://insights.sbomify.com/CVE-2022-28560/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-2856](https://insights.sbomify.com/CVE-2022-2856/): Google Chromium Intents Insufficient Input Validation (medium 6.5, exploited in the wild)
- [CVE-2022-28557](https://insights.sbomify.com/CVE-2022-28557/): Command injection in tenda:ac15 firmware (critical 9.8)
- [CVE-2022-28556](https://insights.sbomify.com/CVE-2022-28556/): Memory corruption in tenda:ac15 firmware (high 7.5)
- [CVE-2022-28552](https://insights.sbomify.com/CVE-2022-28552/): SQL injection in chshcms:cscms (high 8.8)
- [CVE-2022-28550](https://insights.sbomify.com/CVE-2022-28550/): Memory corruption in jhead project:jhead (critical 9.8)
- [CVE-2022-2855](https://insights.sbomify.com/CVE-2022-2855/): Use after free in Chrome (high 8.8)
- [CVE-2022-28545](https://insights.sbomify.com/CVE-2022-28545/): Cross-site scripting in fudforum:fudforum (medium 5.4)
- [CVE-2022-28544](https://insights.sbomify.com/CVE-2022-28544/): Path traversal in Galaxy Store (medium 6.2)
- [CVE-2022-28543](https://insights.sbomify.com/CVE-2022-28543/): Path traversal in Samsung Flow (medium 4.0)
- [CVE-2022-28542](https://insights.sbomify.com/CVE-2022-28542/): Missing authorization in Galaxy Store (medium 6.8)
- [CVE-2022-28541](https://insights.sbomify.com/CVE-2022-28541/): Other in Samsung Update (medium 5.9)
- [CVE-2022-2854](https://insights.sbomify.com/CVE-2022-2854/): Use after free in Chrome (high 8.8)
- [CVE-2022-28533](https://insights.sbomify.com/CVE-2022-28533/): SQL injection in medical hub directory site project:medical hub directory site (critical 9.8)
- [CVE-2022-28531](https://insights.sbomify.com/CVE-2022-28531/): SQL injection in covid-19 directory on vaccination system project:covid-19 directory on vaccination system (critical 9.8)
- [CVE-2022-28530](https://insights.sbomify.com/CVE-2022-28530/): SQL injection in covid-19 directory on vaccination system project:covid-19 directory on vaccination system (critical 9.8)
- [CVE-2022-2853](https://insights.sbomify.com/CVE-2022-2853/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-28528](https://insights.sbomify.com/CVE-2022-28528/): File upload in bloofox:bloofoxcms (high 8.8)
- [CVE-2022-28527](https://insights.sbomify.com/CVE-2022-28527/): Path traversal in dhcms project:dhcms (high 8.1)
- [CVE-2022-28525](https://insights.sbomify.com/CVE-2022-28525/): File upload in ed01-cms project:ed01-cms (high 8.8)
- [CVE-2022-28524](https://insights.sbomify.com/CVE-2022-28524/): SQL injection in ed01-cms project:ed01-cms (critical 9.8)
- [CVE-2022-28523](https://insights.sbomify.com/CVE-2022-28523/): Path traversal in hongcms project:hongcms (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/340/