# Vulnerabilities published in 2022


- [CVE-2022-28022](https://insights.sbomify.com/CVE-2022-28022/): SQL injection in purchase order management system project:purchase order management system (critical 9.8)
- [CVE-2022-28021](https://insights.sbomify.com/CVE-2022-28021/): File upload in purchase order management system project:purchase order management system (critical 9.8)
- [CVE-2022-28020](https://insights.sbomify.com/CVE-2022-28020/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-2802](https://insights.sbomify.com/CVE-2022-2802/): SourceCodester Gas Agency Management System login.php sql injection (high 7.3)
- [CVE-2022-28019](https://insights.sbomify.com/CVE-2022-28019/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28018](https://insights.sbomify.com/CVE-2022-28018/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28017](https://insights.sbomify.com/CVE-2022-28017/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28016](https://insights.sbomify.com/CVE-2022-28016/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28015](https://insights.sbomify.com/CVE-2022-28015/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28014](https://insights.sbomify.com/CVE-2022-28014/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28013](https://insights.sbomify.com/CVE-2022-28013/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28012](https://insights.sbomify.com/CVE-2022-28012/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28011](https://insights.sbomify.com/CVE-2022-28011/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28010](https://insights.sbomify.com/CVE-2022-28010/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-2801](https://insights.sbomify.com/CVE-2022-2801/): SourceCodester Automated Beer Parlour Billing System Login sql injection (medium 6.3)
- [CVE-2022-28009](https://insights.sbomify.com/CVE-2022-28009/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28008](https://insights.sbomify.com/CVE-2022-28008/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28007](https://insights.sbomify.com/CVE-2022-28007/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28006](https://insights.sbomify.com/CVE-2022-28006/): SQL injection in attendance and payroll system project:attendance and payroll system (high 8.8)
- [CVE-2022-28005](https://insights.sbomify.com/CVE-2022-28005/): Path traversal in 3cx:3cx (critical 9.8)
- [CVE-2022-28002](https://insights.sbomify.com/CVE-2022-28002/): Information disclosure in movie seat reservation project:movie seat reservation (high 7.5)
- [CVE-2022-28001](https://insights.sbomify.com/CVE-2022-28001/): SQL injection in movie seat reservation project:movie seat reservation (critical 9.8)
- [CVE-2022-28000](https://insights.sbomify.com/CVE-2022-28000/): SQL injection in car rental system project:car rental system (high 8.8)
- [CVE-2022-2800](https://insights.sbomify.com/CVE-2022-2800/): SourceCodester Gym Management System clickjacking (medium 4.3)
- [CVE-2022-27992](https://insights.sbomify.com/CVE-2022-27992/): SQL injection in phpgurukul:zoo management system (high 8.8)
- [CVE-2022-27991](https://insights.sbomify.com/CVE-2022-27991/): SQL injection in online banking system project:online banking system (medium 6.5)
- [CVE-2022-2799](https://insights.sbomify.com/CVE-2022-2799/): Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-27985](https://insights.sbomify.com/CVE-2022-27985/): SQL injection in cuppacms:cuppacms (critical 9.8)
- [CVE-2022-27984](https://insights.sbomify.com/CVE-2022-27984/): SQL injection in cuppacms:cuppacms (critical 9.8)
- [CVE-2022-27983](https://insights.sbomify.com/CVE-2022-27983/): Path traversal in ruijienetworks:rg-nbr2100g-e firmware (high 7.5)
- [CVE-2022-27982](https://insights.sbomify.com/CVE-2022-27982/): File upload in ruijienetworks:rg-nbr2100g-e firmware (critical 9.8)
- [CVE-2022-2798](https://insights.sbomify.com/CVE-2022-2798/): Affiliates Manager < 2.9.14 - Affiliate CSV Injection (high 8.0)
- [CVE-2022-27979](https://insights.sbomify.com/CVE-2022-27979/): Cross-site scripting in tooljet:tooljet (medium 5.4)
- [CVE-2022-27978](https://insights.sbomify.com/CVE-2022-27978/): Auth bypass in tooljet:tooljet (high 7.5)
- [CVE-2022-2797](https://insights.sbomify.com/CVE-2022-2797/): SourceCodester Student Information System view_student.php sql injection (medium 6.3)
- [CVE-2022-27969](https://insights.sbomify.com/CVE-2022-27969/): Missing authorization in cynet:cynet 360 (medium 5.3)
- [CVE-2022-27968](https://insights.sbomify.com/CVE-2022-27968/): Missing authorization in cynet:cynet 360 (medium 5.3)
- [CVE-2022-27967](https://insights.sbomify.com/CVE-2022-27967/): Missing authorization in cynet:cynet 360 (medium 5.3)
- [CVE-2022-27966](https://insights.sbomify.com/CVE-2022-27966/): Other in netsarang:xshell (medium 6.5)
- [CVE-2022-27965](https://insights.sbomify.com/CVE-2022-27965/): Other in netsarang:xlpd (medium 6.5)
- [CVE-2022-27964](https://insights.sbomify.com/CVE-2022-27964/): Other in netsarang:xmanager (medium 6.5)
- [CVE-2022-27963](https://insights.sbomify.com/CVE-2022-27963/): Other in netsarang:xftp (medium 6.5)
- [CVE-2022-27962](https://insights.sbomify.com/CVE-2022-27962/): SQL injection in bluecms project:bluecms (critical 9.8)
- [CVE-2022-27961](https://insights.sbomify.com/CVE-2022-27961/): Cross-site scripting in ofcms project:ofcms (medium 5.4)
- [CVE-2022-27960](https://insights.sbomify.com/CVE-2022-27960/): Missing authorization in ofcms project:ofcms (medium 5.4)
- [CVE-2022-2796](https://insights.sbomify.com/CVE-2022-2796/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.7)
- [CVE-2022-27958](https://insights.sbomify.com/CVE-2022-27958/): Missing authorization in febs-security project:febs-security (medium 5.4)
- [CVE-2022-27952](https://insights.sbomify.com/CVE-2022-27952/): Unrestricted Upload of File with Dangerous Type in Payload (critical 9.8)
- [CVE-2022-27950](https://insights.sbomify.com/CVE-2022-27950/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2022-2795](https://insights.sbomify.com/CVE-2022-2795/): Processing large delegations may severely degrade resolver performance (medium 5.3)
- [CVE-2022-27949](https://insights.sbomify.com/CVE-2022-27949/): Apache Airflow prior to 2.3.1 may include sensitive values in rendered template (high 7.5)
- [CVE-2022-27948](https://insights.sbomify.com/CVE-2022-27948/): Missing authorization in tesla:model 3 firmware (high 7.2)
- [CVE-2022-27947](https://insights.sbomify.com/CVE-2022-27947/): Command injection in netgear:r8500 firmware (high 8.8)
- [CVE-2022-27946](https://insights.sbomify.com/CVE-2022-27946/): Command injection in netgear:r8500 firmware (high 8.8)
- [CVE-2022-27945](https://insights.sbomify.com/CVE-2022-27945/): Command injection in netgear:r8500 firmware (high 8.8)
- [CVE-2022-27944](https://insights.sbomify.com/CVE-2022-27944/): Null dereference in foxit:pdf editor (high 7.5)
- [CVE-2022-27943](https://insights.sbomify.com/CVE-2022-27943/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2022-27942](https://insights.sbomify.com/CVE-2022-27942/): Memory corruption in broadcom:tcpreplay (high 7.8)
- [CVE-2022-27941](https://insights.sbomify.com/CVE-2022-27941/): Memory corruption in broadcom:tcpreplay (high 7.8)
- [CVE-2022-27940](https://insights.sbomify.com/CVE-2022-27940/): Memory corruption in broadcom:tcpreplay (high 7.8)
- [CVE-2022-2794](https://insights.sbomify.com/CVE-2022-2794/): Denial of service in Certain HP PageWide Pro printers (high 7.5)
- [CVE-2022-27939](https://insights.sbomify.com/CVE-2022-27939/): Denial of service in broadcom:tcpreplay (medium 5.5)
- [CVE-2022-27938](https://insights.sbomify.com/CVE-2022-27938/): Denial of service in libsixel:libsixel (medium 5.5)
- [CVE-2022-27937](https://insights.sbomify.com/CVE-2022-27937/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27936](https://insights.sbomify.com/CVE-2022-27936/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27935](https://insights.sbomify.com/CVE-2022-27935/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27934](https://insights.sbomify.com/CVE-2022-27934/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27933](https://insights.sbomify.com/CVE-2022-27933/): Denial of service in pexip:pexip infinity (high 8.2)
- [CVE-2022-27932](https://insights.sbomify.com/CVE-2022-27932/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27931](https://insights.sbomify.com/CVE-2022-27931/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27930](https://insights.sbomify.com/CVE-2022-27930/): Denial of service in pexip:pexip infinity (medium 5.9)
- [CVE-2022-2793](https://insights.sbomify.com/CVE-2022-2793/): Security feature bypass in Proficy Machine Edition (medium 5.9)
- [CVE-2022-27929](https://insights.sbomify.com/CVE-2022-27929/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27928](https://insights.sbomify.com/CVE-2022-27928/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2022-27927](https://insights.sbomify.com/CVE-2022-27927/): SQL injection in microfinance management system project:microfinance management system (critical 9.8)
- [CVE-2022-27926](https://insights.sbomify.com/CVE-2022-27926/): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2022-27925](https://insights.sbomify.com/CVE-2022-27925/): Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload (high 7.2, exploited in the wild)
- [CVE-2022-27924](https://insights.sbomify.com/CVE-2022-27924/): Synacor Zimbra Collaboration Suite (ZCS) Command Injection (critical 9.8, exploited in the wild)
- [CVE-2022-27920](https://insights.sbomify.com/CVE-2022-27920/): Cross-site scripting in fedoraproject:fedora (medium 6.1)
- [CVE-2022-2792](https://insights.sbomify.com/CVE-2022-2792/): Misconfiguration in Proficy Machine Edition (medium 6.6)
- [CVE-2022-27919](https://insights.sbomify.com/CVE-2022-27919/): Misconfiguration in gradle:enterprise (critical 9.8)
- [CVE-2022-27914](https://insights.sbomify.com/CVE-2022-27914/): [20221101] - Core - RXSS through reflection of user input in com_media (medium 6.1)
- [CVE-2022-27913](https://insights.sbomify.com/CVE-2022-27913/): [20221002] - Core - RXSS through reflection of user input in headings (medium 6.1)
- [CVE-2022-27912](https://insights.sbomify.com/CVE-2022-27912/): [20221001] - Core - Debug Mode leaks full request payloads including passwords (medium 5.3)
- [CVE-2022-27911](https://insights.sbomify.com/CVE-2022-27911/): [20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check' (medium 5.3)
- [CVE-2022-27910](https://insights.sbomify.com/CVE-2022-27910/): Extension - Joomlatools - DOCman - Reflected Cross-Site Scripting (XSS) in an image upload function (medium 6.1)
- [CVE-2022-2791](https://insights.sbomify.com/CVE-2022-2791/): File upload in Proficy Machine Edition (medium 5.9)
- [CVE-2022-27909](https://insights.sbomify.com/CVE-2022-27909/): Extension - Incorrect Access Control within jdownloads extension (medium 4.3)
- [CVE-2022-27908](https://insights.sbomify.com/CVE-2022-27908/): SQL injection in zohocorp:manageengine opmanager (high 8.8)
- [CVE-2022-27907](https://insights.sbomify.com/CVE-2022-27907/): Server-side request forgery in sonatype:nexus repository manager (medium 4.3)
- [CVE-2022-27906](https://insights.sbomify.com/CVE-2022-27906/): Path traversal in mendelson:oftp2 (medium 5.9)
- [CVE-2022-27905](https://insights.sbomify.com/CVE-2022-27905/): Privilege escalation in controlup:controlup (high 7.2)
- [CVE-2022-27904](https://insights.sbomify.com/CVE-2022-27904/): Race condition in automox:automox (high 7.0)
- [CVE-2022-27903](https://insights.sbomify.com/CVE-2022-27903/): Command injection in eve-ng:eve-ng (high 8.8)
- [CVE-2022-2790](https://insights.sbomify.com/CVE-2022-2790/): Security feature bypass in Proficy Machine Edition (medium 5.9)
- [CVE-2022-27897](https://insights.sbomify.com/CVE-2022-27897/): Palantir Gotham included an endpoint that would log arbitrary sized zip files. (medium 5.3)
- [CVE-2022-27896](https://insights.sbomify.com/CVE-2022-27896/): The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure. (medium 4.2)
- [CVE-2022-27895](https://insights.sbomify.com/CVE-2022-27895/): A component in Foundry logging was found to be capturing sensitive information in logs. (medium 4.2)
- [CVE-2022-27894](https://insights.sbomify.com/CVE-2022-27894/): The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability. (medium 4.8)
- [CVE-2022-27893](https://insights.sbomify.com/CVE-2022-27893/): Information disclosure in Foundry Magritte plugin osisoft-pi-web-connector (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/345/