# Vulnerabilities published in 2022


- [CVE-2022-27892](https://insights.sbomify.com/CVE-2022-27892/): Palantir Gotham included an endpoint that would log arbitrary sized payloads. (medium 5.3)
- [CVE-2022-27891](https://insights.sbomify.com/CVE-2022-27891/): Missing authorization in Gotham (medium 5.3)
- [CVE-2022-27890](https://insights.sbomify.com/CVE-2022-27890/): Security feature bypass in AtlasDB (medium 6.3)
- [CVE-2022-2789](https://insights.sbomify.com/CVE-2022-2789/): Security feature bypass in Proficy Machine Edition (medium 4.7)
- [CVE-2022-27889](https://insights.sbomify.com/CVE-2022-27889/): Denial of service in Foundry Multipass (medium 5.3)
- [CVE-2022-27888](https://insights.sbomify.com/CVE-2022-27888/): The Foundry Issues service was found to be logging in a manner that captured session tokens. (medium 5.5)
- [CVE-2022-27887](https://insights.sbomify.com/CVE-2022-27887/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2022-27886](https://insights.sbomify.com/CVE-2022-27886/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2022-27885](https://insights.sbomify.com/CVE-2022-27885/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2022-27884](https://insights.sbomify.com/CVE-2022-27884/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2022-27883](https://insights.sbomify.com/CVE-2022-27883/): Privilege escalation in Trend Micro Antivirus for Mac (high 7.3)
- [CVE-2022-27882](https://insights.sbomify.com/CVE-2022-27882/): Integer overflow in openbsd:openbsd (high 7.5)
- [CVE-2022-27881](https://insights.sbomify.com/CVE-2022-27881/): Memory corruption in openbsd:openbsd (high 7.5)
- [CVE-2022-27880](https://insights.sbomify.com/CVE-2022-27880/): Cross-site scripting in Traffix SDC (medium 4.8)
- [CVE-2022-2788](https://insights.sbomify.com/CVE-2022-2788/): Path traversal in Proficy Machine Edition (low 3.9)
- [CVE-2022-27879](https://insights.sbomify.com/CVE-2022-27879/): Memory corruption in Intel(R) Processors (medium 5.3)
- [CVE-2022-27878](https://insights.sbomify.com/CVE-2022-27878/): Cross-site scripting in BIG-IP (medium 6.8)
- [CVE-2022-27875](https://insights.sbomify.com/CVE-2022-27875/): Information disclosure in F5 Access for Android (medium 5.5)
- [CVE-2022-27874](https://insights.sbomify.com/CVE-2022-27874/): Auth bypass in Intel(R) XMM(TM) 7560 Modem software (medium 6.8)
- [CVE-2022-27873](https://insights.sbomify.com/CVE-2022-27873/): XML external entity in Fusion360 (high 7.8)
- [CVE-2022-27872](https://insights.sbomify.com/CVE-2022-27872/): Memory corruption in Navisworks (high 7.8)
- [CVE-2022-27871](https://insights.sbomify.com/CVE-2022-27871/): Memory corruption in Autodesk AutoCAD product suite, Revit, Design Review and Navisworks (high 7.8)
- [CVE-2022-27870](https://insights.sbomify.com/CVE-2022-27870/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-2787](https://insights.sbomify.com/CVE-2022-2787/): stricter rules on chroot names (medium 4.3)
- [CVE-2022-27869](https://insights.sbomify.com/CVE-2022-27869/): Memory corruption in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-27868](https://insights.sbomify.com/CVE-2022-27868/): Use after free in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-27867](https://insights.sbomify.com/CVE-2022-27867/): Use after free in Autodesk Inventor, Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D (high 7.8)
- [CVE-2022-27866](https://insights.sbomify.com/CVE-2022-27866/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-27865](https://insights.sbomify.com/CVE-2022-27865/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-27864](https://insights.sbomify.com/CVE-2022-27864/): Memory corruption in Autodesk Design Review (high 8.8)
- [CVE-2022-27863](https://insights.sbomify.com/CVE-2022-27863/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2022-27862](https://insights.sbomify.com/CVE-2022-27862/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 - Arbitrary File Upload leading to RCE (critical 9.8)
- [CVE-2022-27861](https://insights.sbomify.com/CVE-2022-27861/): WordPress Ninja Popups Plugin <= 4.7.5 is vulnerable to Open Redirection (medium 4.7)
- [CVE-2022-27860](https://insights.sbomify.com/CVE-2022-27860/): Cross-site request forgery in Footer Text (WordPress plugin) (medium 6.1)
- [CVE-2022-27859](https://insights.sbomify.com/CVE-2022-27859/): WordPress Travel Management plugin <= 2.0 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (medium 4.1)
- [CVE-2022-27858](https://insights.sbomify.com/CVE-2022-27858/): WordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerability (high 7.4)
- [CVE-2022-27856](https://insights.sbomify.com/CVE-2022-27856/): WordPress Export All URLs Plugin <= 4.1 is vulnerable to Cross Site Scripting (XSS) (low 3.4)
- [CVE-2022-27855](https://insights.sbomify.com/CVE-2022-27855/): WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-27854](https://insights.sbomify.com/CVE-2022-27854/): Cross-site scripting in Psychological tests & quizzes (WordPress plugin) (medium 5.4)
- [CVE-2022-27853](https://insights.sbomify.com/CVE-2022-27853/): WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-27852](https://insights.sbomify.com/CVE-2022-27852/): WordPress KB Support plugin <= 1.5.5 - Multiple Unauth. Stored Cross-Site Scripting (XSS) vulnerabilities (medium 6.1)
- [CVE-2022-27851](https://insights.sbomify.com/CVE-2022-27851/): WordPress Use Any Font plugin <= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-27850](https://insights.sbomify.com/CVE-2022-27850/): WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-2785](https://insights.sbomify.com/CVE-2022-2785/): Arbitrary Memory read in BPF Linux Kernel (medium 6.7)
- [CVE-2022-27849](https://insights.sbomify.com/CVE-2022-27849/): WordPress Simple Ajax Chat plugin <= 20220115 - Sensitive Information Disclosure vulnerability (medium 5.3)
- [CVE-2022-27848](https://insights.sbomify.com/CVE-2022-27848/): WordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (low 3.4)
- [CVE-2022-27847](https://insights.sbomify.com/CVE-2022-27847/): WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template Import (medium 4.3)
- [CVE-2022-27846](https://insights.sbomify.com/CVE-2022-27846/): Cross-site request forgery in Yoo Slider – Image Slider & Video Slider (WordPress plugin) (medium 4.3)
- [CVE-2022-27845](https://insights.sbomify.com/CVE-2022-27845/): WordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-27844](https://insights.sbomify.com/CVE-2022-27844/): WordPress WPvivid plugin <= 0.9.70 - Arbitrary File Read vulnerability (low 2.7)
- [CVE-2022-27843](https://insights.sbomify.com/CVE-2022-27843/): Other in Kies (medium 6.2)
- [CVE-2022-27842](https://insights.sbomify.com/CVE-2022-27842/): Other in Smart Switch PC (medium 6.2)
- [CVE-2022-27841](https://insights.sbomify.com/CVE-2022-27841/): Auth bypass in Samsung Pass (medium 4.3)
- [CVE-2022-27840](https://insights.sbomify.com/CVE-2022-27840/): Missing authorization in Samsung Recovery (medium 4.4)
- [CVE-2022-27839](https://insights.sbomify.com/CVE-2022-27839/): Auth bypass in Samsung Internet (low 3.3)
- [CVE-2022-27838](https://insights.sbomify.com/CVE-2022-27838/): Missing authorization in FactoryCamera (high 7.7)
- [CVE-2022-27837](https://insights.sbomify.com/CVE-2022-27837/): Privilege escalation in Accessibility (medium 4.4)
- [CVE-2022-27836](https://insights.sbomify.com/CVE-2022-27836/): Path traversal in Samsung Mobile Devices (high 8.4)
- [CVE-2022-27835](https://insights.sbomify.com/CVE-2022-27835/): Memory corruption in Samsung Mobile Devices (high 7.6)
- [CVE-2022-27834](https://insights.sbomify.com/CVE-2022-27834/): Use after free in Samsung Mobile Devices (low 2.9)
- [CVE-2022-27833](https://insights.sbomify.com/CVE-2022-27833/): Integer overflow in Samsung Mobile Devices (medium 4.4)
- [CVE-2022-27832](https://insights.sbomify.com/CVE-2022-27832/): Memory corruption in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-27831](https://insights.sbomify.com/CVE-2022-27831/): Memory corruption in Samsung Mobile Devices (low 2.9)
- [CVE-2022-27830](https://insights.sbomify.com/CVE-2022-27830/): Other in Samsung Mobile Devices (high 8.5)
- [CVE-2022-2783](https://insights.sbomify.com/CVE-2022-2783/): Cross-site request forgery in Octopus Server (medium 5.3)
- [CVE-2022-27829](https://insights.sbomify.com/CVE-2022-27829/): Other in Samsung Mobile Devices (high 8.5)
- [CVE-2022-27828](https://insights.sbomify.com/CVE-2022-27828/): Other in Samsung Mobile Devices (high 8.5)
- [CVE-2022-27827](https://insights.sbomify.com/CVE-2022-27827/): Other in Samsung Mobile Devices (high 8.5)
- [CVE-2022-27826](https://insights.sbomify.com/CVE-2022-27826/): Security feature bypass in Samsung Mobile Devices (high 8.5)
- [CVE-2022-27825](https://insights.sbomify.com/CVE-2022-27825/): Memory corruption in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-27824](https://insights.sbomify.com/CVE-2022-27824/): Memory corruption in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-27823](https://insights.sbomify.com/CVE-2022-27823/): Memory corruption in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-27822](https://insights.sbomify.com/CVE-2022-27822/): Information disclosure in Samsung Mobile Devices (medium 6.6)
- [CVE-2022-27821](https://insights.sbomify.com/CVE-2022-27821/): Memory corruption in Samsung Mobile Devices (medium 4.0)
- [CVE-2022-27820](https://insights.sbomify.com/CVE-2022-27820/): Improper Certificate Validation in OWASP ZAP (medium 4.0)
- [CVE-2022-2782](https://insights.sbomify.com/CVE-2022-2782/): Auth bypass in Octopus Server (critical 9.1)
- [CVE-2022-27819](https://insights.sbomify.com/CVE-2022-27819/): Unsafe parsing in SWHKD (medium 5.3)
- [CVE-2022-27818](https://insights.sbomify.com/CVE-2022-27818/): Insecure temporary file usage in SWHKD (critical 9.1)
- [CVE-2022-27817](https://insights.sbomify.com/CVE-2022-27817/): Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon (medium 4.4)
- [CVE-2022-27816](https://insights.sbomify.com/CVE-2022-27816/): Data Loss/Denial of Service in SWHKD (high 7.1)
- [CVE-2022-27815](https://insights.sbomify.com/CVE-2022-27815/): Insecure Temporary File in SWHKD (high 7.8)
- [CVE-2022-27814](https://insights.sbomify.com/CVE-2022-27814/): Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon (low 3.3)
- [CVE-2022-27813](https://insights.sbomify.com/CVE-2022-27813/): Unconfigured memory protection modules in Motorola MTM5000 (high 8.1)
- [CVE-2022-27812](https://insights.sbomify.com/CVE-2022-27812/): Denial of service in stormshield:stormshield network security (high 7.5)
- [CVE-2022-27811](https://insights.sbomify.com/CVE-2022-27811/): Command injection in gnome:ocrfeeder (critical 9.8)
- [CVE-2022-27810](https://insights.sbomify.com/CVE-2022-27810/): Denial of service in Hermes (high 7.5)
- [CVE-2022-2781](https://insights.sbomify.com/CVE-2022-2781/): Weak cryptography in Octopus Server (medium 5.3)
- [CVE-2022-27808](https://insights.sbomify.com/CVE-2022-27808/): Privilege escalation in Intel(R) Ethernet Controller Administrative Tools drivers for Windows (medium 6.3)
- [CVE-2022-27807](https://insights.sbomify.com/CVE-2022-27807/): Other in Cybozu Garoon (medium 4.3)
- [CVE-2022-27806](https://insights.sbomify.com/CVE-2022-27806/): Command injection in BIG-IP (Advanced WAF, APM, ASM) (high 8.7)
- [CVE-2022-27805](https://insights.sbomify.com/CVE-2022-27805/): Auth bypass in iota All-In-One Security Kit (critical 9.8)
- [CVE-2022-27804](https://insights.sbomify.com/CVE-2022-27804/): Command injection in iota All-In-One Security Kit (high 8.0)
- [CVE-2022-27803](https://insights.sbomify.com/CVE-2022-27803/): Other in Cybozu Garoon (medium 4.3)
- [CVE-2022-27802](https://insights.sbomify.com/CVE-2022-27802/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-27801](https://insights.sbomify.com/CVE-2022-27801/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-27800](https://insights.sbomify.com/CVE-2022-27800/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-2780](https://insights.sbomify.com/CVE-2022-2780/): Other in Octopus Server (high 8.1)
- [CVE-2022-27799](https://insights.sbomify.com/CVE-2022-27799/): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-27798](https://insights.sbomify.com/CVE-2022-27798/): Adobe Acrobat Reader DC zoomType Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-27797](https://insights.sbomify.com/CVE-2022-27797/): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/346/