# Vulnerabilities published in 2022


- [CVE-2022-2815](https://insights.sbomify.com/CVE-2022-2815/): Insecure Storage of Sensitive Information in publify/publify (medium 4.6)
- [CVE-2022-28149](https://insights.sbomify.com/CVE-2022-28149/): Stored Cross-site Scripting vulnerability in Jenkins Job and Node ownership Plugin (medium 5.4)
- [CVE-2022-28148](https://insights.sbomify.com/CVE-2022-28148/): Path traversal vulnerability on Windows in Jenkins Continuous Integration with Toad Edge Plugin (medium 6.5)
- [CVE-2022-28147](https://insights.sbomify.com/CVE-2022-28147/): Missing permission check in Jenkins Continuous Integration with Toad Edge Plugin (medium 4.3)
- [CVE-2022-28146](https://insights.sbomify.com/CVE-2022-28146/): Arbitrary file read vulnerability in Jenkins Continuous Integration with Toad Edge Plugin (medium 6.5)
- [CVE-2022-28145](https://insights.sbomify.com/CVE-2022-28145/): Cross-site Scripting (XSS) vulnerability in Jenkins Continuous Integration with Toad Edge Plugin (medium 5.4)
- [CVE-2022-28144](https://insights.sbomify.com/CVE-2022-28144/): Missing permission checks in Jenkins Proxmox Plugin (medium 6.5)
- [CVE-2022-28143](https://insights.sbomify.com/CVE-2022-28143/): CSRF vulnerability in Proxmox Plugin (medium 6.5)
- [CVE-2022-28142](https://insights.sbomify.com/CVE-2022-28142/): SSL/TLS certificate validation globally disabled by Jenkins Proxmox Plugin (high 7.5)
- [CVE-2022-28141](https://insights.sbomify.com/CVE-2022-28141/): Password stored in plain text by Jenkins Proxmox Plugin (medium 6.5)
- [CVE-2022-28140](https://insights.sbomify.com/CVE-2022-28140/): XXE vulnerability in Jenkins Flaky Test Handler Plugin (high 8.1)
- [CVE-2022-2814](https://insights.sbomify.com/CVE-2022-2814/): SourceCodester Simple and Nice Shopping Cart Script login.php cross site scripting (low 3.5)
- [CVE-2022-28139](https://insights.sbomify.com/CVE-2022-28139/): Missing permission check in Jenkins RocketChat Notifier Plugin (medium 4.3)
- [CVE-2022-28138](https://insights.sbomify.com/CVE-2022-28138/): CSRF vulnerability in Jenkins RocketChat Notifier Plugin (medium 4.3)
- [CVE-2022-28137](https://insights.sbomify.com/CVE-2022-28137/): Missing permission check in Jenkins JiraTestResultReporter Plugin (medium 4.3)
- [CVE-2022-28136](https://insights.sbomify.com/CVE-2022-28136/): CSRF vulnerability and missing permission check in Jenkins JiraTestResultReporter Plugin (high 8.8)
- [CVE-2022-28135](https://insights.sbomify.com/CVE-2022-28135/): Plaintext storage in Jenkins instant-messaging Plugin (medium 6.5)
- [CVE-2022-28134](https://insights.sbomify.com/CVE-2022-28134/): Missing permission checks in Jekins Bitbucket Server Integration Plugin (medium 5.4)
- [CVE-2022-28133](https://insights.sbomify.com/CVE-2022-28133/): Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin (medium 5.4)
- [CVE-2022-28132](https://insights.sbomify.com/CVE-2022-28132/): The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. (high 7.2)
- [CVE-2022-28131](https://insights.sbomify.com/CVE-2022-28131/): Stack exhaustion from deeply nested XML documents in encoding/xml (high 7.5)
- [CVE-2022-2813](https://insights.sbomify.com/CVE-2022-2813/): SourceCodester Guest Management System cleartext storage (medium 4.3)
- [CVE-2022-28129](https://insights.sbomify.com/CVE-2022-28129/): Insufficient Validation of HTTP/1.x Headers (high 7.5)
- [CVE-2022-28128](https://insights.sbomify.com/CVE-2022-28128/): Other in AttacheCase (high 7.8)
- [CVE-2022-28127](https://insights.sbomify.com/CVE-2022-28127/): Path traversal in R1510 (high 8.7)
- [CVE-2022-28126](https://insights.sbomify.com/CVE-2022-28126/): Privilege escalation in Intel(R) XMM(TM) 7560 Modem software (medium 6.0)
- [CVE-2022-28120](https://insights.sbomify.com/CVE-2022-28120/): File upload in rainier:open virtual simulation experiment teaching management platform (critical 9.8)
- [CVE-2022-2812](https://insights.sbomify.com/CVE-2022-2812/): SourceCodester Guest Management System index.php sql injection (high 7.3)
- [CVE-2022-28118](https://insights.sbomify.com/CVE-2022-28118/): RCE in SiteServer CMS (critical 9.8)
- [CVE-2022-28117](https://insights.sbomify.com/CVE-2022-28117/): Server-side request forgery in naviwebs:navigate cms (medium 4.9)
- [CVE-2022-28116](https://insights.sbomify.com/CVE-2022-28116/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-28115](https://insights.sbomify.com/CVE-2022-28115/): SQL injection in online sports complex booking project:online sports complex booking (critical 9.8)
- [CVE-2022-28114](https://insights.sbomify.com/CVE-2022-28114/): Path traversal in dscms project:dscms (critical 9.1)
- [CVE-2022-28113](https://insights.sbomify.com/CVE-2022-28113/): Auth bypass in fantec:mwid25-ds firmware (high 7.2)
- [CVE-2022-28111](https://insights.sbomify.com/CVE-2022-28111/): MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter (critical 9.8)
- [CVE-2022-28110](https://insights.sbomify.com/CVE-2022-28110/): SQL injection in hotel management system project:hotel management system (critical 9.8)
- [CVE-2022-2811](https://insights.sbomify.com/CVE-2022-2811/): SourceCodester Guest Management System myform.php cross site scripting (low 3.5)
- [CVE-2022-28109](https://insights.sbomify.com/CVE-2022-28109/): Cross-site request forgery in selenium:selenium grid (high 8.8)
- [CVE-2022-28108](https://insights.sbomify.com/CVE-2022-28108/): Selenium Server (Grid) CSRF (high 8.8)
- [CVE-2022-28106](https://insights.sbomify.com/CVE-2022-28106/): Auth bypass in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-28105](https://insights.sbomify.com/CVE-2022-28105/): SQL injection in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-28104](https://insights.sbomify.com/CVE-2022-28104/): File upload in foxit:pdf editor (critical 9.8)
- [CVE-2022-28102](https://insights.sbomify.com/CVE-2022-28102/): Cross-site scripting in php mysql admin panel generator project:php mysql admin panel generator (medium 5.4)
- [CVE-2022-28101](https://insights.sbomify.com/CVE-2022-28101/): Cross-site scripting in lyonbros:turtl (critical 9.0)
- [CVE-2022-28099](https://insights.sbomify.com/CVE-2022-28099/): SQL injection in poultry farm management system project:poultry farm management system (high 8.8)
- [CVE-2022-28096](https://insights.sbomify.com/CVE-2022-28096/): Code injection in skycaiji:skycaiji (high 7.2)
- [CVE-2022-28094](https://insights.sbomify.com/CVE-2022-28094/): Cross-site scripting in online sports complex booking system project:online sports complex booking system (medium 6.1)
- [CVE-2022-28093](https://insights.sbomify.com/CVE-2022-28093/): Path traversal in online sports complex booking system project:online sports complex booking system (critical 9.8)
- [CVE-2022-28090](https://insights.sbomify.com/CVE-2022-28090/): Server-side request forgery in ujcms:jspxcms (medium 6.5)
- [CVE-2022-2809](https://insights.sbomify.com/CVE-2022-2809/): Unauthenticated out of bounds heap write in bmcweb (high 8.2)
- [CVE-2022-28085](https://insights.sbomify.com/CVE-2022-28085/): Memory corruption in htmldoc project:htmldoc (high 7.8)
- [CVE-2022-28082](https://insights.sbomify.com/CVE-2022-28082/): Memory corruption in tenda:ax12 firmware (critical 9.8)
- [CVE-2022-28081](https://insights.sbomify.com/CVE-2022-28081/): Cross-site scripting in ar-php:arphp (medium 6.1)
- [CVE-2022-28080](https://insights.sbomify.com/CVE-2022-28080/): SQL injection in event management system project:event management system (high 8.8)
- [CVE-2022-2808](https://insights.sbomify.com/CVE-2022-2808/): IDOR in Prens Student Information System (high 8.8)
- [CVE-2022-28079](https://insights.sbomify.com/CVE-2022-28079/): SQL injection in college management system project:college management system (high 8.8)
- [CVE-2022-28078](https://insights.sbomify.com/CVE-2022-28078/): Cross-site scripting in home owners collection management system project:home owners collection management system (medium 6.1)
- [CVE-2022-28077](https://insights.sbomify.com/CVE-2022-28077/): Cross-site scripting in home owners collection management system project:home owners collection management system (medium 6.1)
- [CVE-2022-28076](https://insights.sbomify.com/CVE-2022-28076/): Command injection in seacms:seacms (high 7.2)
- [CVE-2022-28074](https://insights.sbomify.com/CVE-2022-28074/): Cross-site scripting in fit2cloud:halo (medium 4.8)
- [CVE-2022-28073](https://insights.sbomify.com/CVE-2022-28073/): Use after free in radare:radare2 (high 7.5)
- [CVE-2022-28072](https://insights.sbomify.com/CVE-2022-28072/): Memory corruption in radare:radare2 (high 7.5)
- [CVE-2022-28071](https://insights.sbomify.com/CVE-2022-28071/): Use after free in radare:radare2 (high 7.5)
- [CVE-2022-28070](https://insights.sbomify.com/CVE-2022-28070/): Null dereference in radare:radare2 (high 7.5)
- [CVE-2022-2807](https://insights.sbomify.com/CVE-2022-2807/): SQL Injection in Prens Student Information System (critical 9.8)
- [CVE-2022-28069](https://insights.sbomify.com/CVE-2022-28069/): Memory corruption in radare:radare2 (high 7.5)
- [CVE-2022-28068](https://insights.sbomify.com/CVE-2022-28068/): Memory corruption in radare:radare2 (high 7.5)
- [CVE-2022-28067](https://insights.sbomify.com/CVE-2022-28067/): Denial of service in sandboxie:sandboxie (high 8.6)
- [CVE-2022-28063](https://insights.sbomify.com/CVE-2022-28063/): Information disclosure in simple bakery shop management system project:simple bakery shop management system (medium 4.9)
- [CVE-2022-28062](https://insights.sbomify.com/CVE-2022-28062/): File upload in online car rental system project:online car rental system (high 8.8)
- [CVE-2022-28060](https://insights.sbomify.com/CVE-2022-28060/): SQL injection in victor cms project:victor cms (high 7.5)
- [CVE-2022-2806](https://insights.sbomify.com/CVE-2022-2806/): sosreport Exposure of Sensitive Information vulnerability (medium 5.5)
- [CVE-2022-28059](https://insights.sbomify.com/CVE-2022-28059/): Path traversal in verydows:verydows (high 8.1)
- [CVE-2022-28058](https://insights.sbomify.com/CVE-2022-28058/): Path traversal in verydows:verydows (high 8.1)
- [CVE-2022-28056](https://insights.sbomify.com/CVE-2022-28056/): Incorrect Permission Assignment for Critical Resource in ShopXO (critical 9.8)
- [CVE-2022-28055](https://insights.sbomify.com/CVE-2022-28055/): Command injection in fusionpbx:fusionpbx (critical 9.8)
- [CVE-2022-28054](https://insights.sbomify.com/CVE-2022-28054/): Code injection in vandyke:vshell (critical 9.8)
- [CVE-2022-28053](https://insights.sbomify.com/CVE-2022-28053/): File upload in typemill:typemill (high 8.8)
- [CVE-2022-28052](https://insights.sbomify.com/CVE-2022-28052/): Path traversal in roothub:roothub (high 8.0)
- [CVE-2022-28051](https://insights.sbomify.com/CVE-2022-28051/): Cross-site scripting in seeddms:seeddms (medium 5.4)
- [CVE-2022-2805](https://insights.sbomify.com/CVE-2022-2805/): Information disclosure in ovirt-engine (medium 6.5)
- [CVE-2022-28049](https://insights.sbomify.com/CVE-2022-28049/): Null dereference in f5:njs (medium 5.5)
- [CVE-2022-28048](https://insights.sbomify.com/CVE-2022-28048/): Integer overflow in fedoraproject:fedora (high 8.8)
- [CVE-2022-28044](https://insights.sbomify.com/CVE-2022-28044/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2022-28042](https://insights.sbomify.com/CVE-2022-28042/): Use after free in debian:debian linux (high 8.8)
- [CVE-2022-28041](https://insights.sbomify.com/CVE-2022-28041/): Integer overflow in debian:debian linux (medium 6.5)
- [CVE-2022-2804](https://insights.sbomify.com/CVE-2022-2804/): SourceCodester Zoo Management System apply_vacancy.php unrestricted upload (medium 6.3)
- [CVE-2022-28036](https://insights.sbomify.com/CVE-2022-28036/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-28035](https://insights.sbomify.com/CVE-2022-28035/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-28034](https://insights.sbomify.com/CVE-2022-28034/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-28033](https://insights.sbomify.com/CVE-2022-28033/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-28032](https://insights.sbomify.com/CVE-2022-28032/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-28030](https://insights.sbomify.com/CVE-2022-28030/): SQL injection in simple real estate portal system project:simple real estate portal system (critical 9.8)
- [CVE-2022-2803](https://insights.sbomify.com/CVE-2022-2803/): SourceCodester Zoo Management System animals.php sql injection (medium 6.3)
- [CVE-2022-28029](https://insights.sbomify.com/CVE-2022-28029/): SQL injection in simple real estate portal system project:simple real estate portal system (critical 9.8)
- [CVE-2022-28028](https://insights.sbomify.com/CVE-2022-28028/): SQL injection in simple real estate portal system project:simple real estate portal system (critical 9.8)
- [CVE-2022-28026](https://insights.sbomify.com/CVE-2022-28026/): SQL injection in oretnom23:student grading system (critical 9.8)
- [CVE-2022-28025](https://insights.sbomify.com/CVE-2022-28025/): SQL injection in oretnom23:student grading system (critical 9.8)
- [CVE-2022-28024](https://insights.sbomify.com/CVE-2022-28024/): SQL injection in oretnom23:student grading system (critical 9.8)
- [CVE-2022-28023](https://insights.sbomify.com/CVE-2022-28023/): SQL injection in purchase order management system project:purchase order management system (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/344/