# Vulnerabilities published in 2022


- [CVE-2022-2736](https://insights.sbomify.com/CVE-2022-2736/): SourceCodester Company Website CMS Background Upload Logo Icon updatelogo.php unrestricted upload (medium 6.3)
- [CVE-2022-27359](https://insights.sbomify.com/CVE-2022-27359/): Null dereference in foxit:pdf editor (medium 5.5)
- [CVE-2022-27357](https://insights.sbomify.com/CVE-2022-27357/): File upload in ecommerce-website project:ecommerce-website (critical 9.8)
- [CVE-2022-27352](https://insights.sbomify.com/CVE-2022-27352/): File upload in simple house rental system project:simple house rental system (high 8.8)
- [CVE-2022-27351](https://insights.sbomify.com/CVE-2022-27351/): File upload in phpgurukul:zoo management system (critical 9.8)
- [CVE-2022-2735](https://insights.sbomify.com/CVE-2022-2735/): Misconfiguration in ClusterLabs/pcs (high 7.8)
- [CVE-2022-27349](https://insights.sbomify.com/CVE-2022-27349/): File upload in socialcodia:social codia sms (high 7.2)
- [CVE-2022-27348](https://insights.sbomify.com/CVE-2022-27348/): Cross-site scripting in socialcodia:social codia sms (medium 4.8)
- [CVE-2022-27346](https://insights.sbomify.com/CVE-2022-27346/): File upload in ecommerce-website project:ecommerce-website (high 8.8)
- [CVE-2022-27342](https://insights.sbomify.com/CVE-2022-27342/): SQL injection in link-admin project:link-admin (critical 9.8)
- [CVE-2022-27341](https://insights.sbomify.com/CVE-2022-27341/): SQL injection in jfinalcms project:jfinalcms (critical 9.8)
- [CVE-2022-27340](https://insights.sbomify.com/CVE-2022-27340/): Cross Site Request Forgery in Mingsoft MCMS (high 8.8)
- [CVE-2022-2734](https://insights.sbomify.com/CVE-2022-2734/): Improper Restriction of Rendered UI Layers or Frames in openemr/openemr (critical 10.0)
- [CVE-2022-27337](https://insights.sbomify.com/CVE-2022-27337/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2022-27336](https://insights.sbomify.com/CVE-2022-27336/): Code injection in seacms:seacms (critical 9.8)
- [CVE-2022-27333](https://insights.sbomify.com/CVE-2022-27333/): Other in idccms:idccms (high 7.5)
- [CVE-2022-27332](https://insights.sbomify.com/CVE-2022-27332/): Missing authorization in zammad:zammad (critical 9.1)
- [CVE-2022-27331](https://insights.sbomify.com/CVE-2022-27331/): Missing authorization in zammad:zammad (medium 4.3)
- [CVE-2022-27330](https://insights.sbomify.com/CVE-2022-27330/): Cross-site scripting in e-commerce website project:e-commerce website (medium 5.4)
- [CVE-2022-2733](https://insights.sbomify.com/CVE-2022-2733/): Cross-site Scripting (XSS) - Reflected in openemr/openemr (critical 9.6)
- [CVE-2022-2732](https://insights.sbomify.com/CVE-2022-2732/): Missing Authorization in openemr/openemr (high 8.3)
- [CVE-2022-27313](https://insights.sbomify.com/CVE-2022-27313/): Arbitrary file deletion in gitea (high 7.5)
- [CVE-2022-27311](https://insights.sbomify.com/CVE-2022-27311/): Server side request forgery in gibbon (critical 9.8)
- [CVE-2022-2731](https://insights.sbomify.com/CVE-2022-2731/): Cross-site Scripting (XSS) - Reflected in openemr/openemr (medium 5.4)
- [CVE-2022-27308](https://insights.sbomify.com/CVE-2022-27308/): Cross-site scripting in phprojekt phpsimplygest project:phprojekt phpsimplygest (medium 5.4)
- [CVE-2022-27305](https://insights.sbomify.com/CVE-2022-27305/): Auth bypass in gibbonedu:gibbon (high 8.8)
- [CVE-2022-27304](https://insights.sbomify.com/CVE-2022-27304/): SQL injection in oretnom23:student grading system (critical 9.8)
- [CVE-2022-2730](https://insights.sbomify.com/CVE-2022-2730/): Authorization Bypass Through User-Controlled Key in openemr/openemr (medium 6.5)
- [CVE-2022-27299](https://insights.sbomify.com/CVE-2022-27299/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-27295](https://insights.sbomify.com/CVE-2022-27295/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27294](https://insights.sbomify.com/CVE-2022-27294/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27293](https://insights.sbomify.com/CVE-2022-27293/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27292](https://insights.sbomify.com/CVE-2022-27292/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27291](https://insights.sbomify.com/CVE-2022-27291/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27290](https://insights.sbomify.com/CVE-2022-27290/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-2729](https://insights.sbomify.com/CVE-2022-2729/): Cross-site Scripting (XSS) - DOM in openemr/openemr (medium 5.4)
- [CVE-2022-27289](https://insights.sbomify.com/CVE-2022-27289/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27288](https://insights.sbomify.com/CVE-2022-27288/): Memory corruption in dlink:dir-619 firmware (high 7.5)
- [CVE-2022-27287](https://insights.sbomify.com/CVE-2022-27287/): Memory corruption in dlink:dir-619 ax firmware (high 7.5)
- [CVE-2022-27286](https://insights.sbomify.com/CVE-2022-27286/): Memory corruption in dlink:dir-619 ax firmware (high 7.5)
- [CVE-2022-27280](https://insights.sbomify.com/CVE-2022-27280/): Cross-site scripting in inhandnetworks:inrouter 900 firmware (medium 5.4)
- [CVE-2022-2728](https://insights.sbomify.com/CVE-2022-2728/): SourceCodester Gym Management System index.php sql injection (medium 6.3)
- [CVE-2022-27279](https://insights.sbomify.com/CVE-2022-27279/): Path traversal in inhandnetworks:inrouter 900 firmware (high 7.5)
- [CVE-2022-27277](https://insights.sbomify.com/CVE-2022-27277/): Path traversal in inhandnetworks:inrouter 900 firmware (critical 9.1)
- [CVE-2022-27276](https://insights.sbomify.com/CVE-2022-27276/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27275](https://insights.sbomify.com/CVE-2022-27275/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27274](https://insights.sbomify.com/CVE-2022-27274/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27273](https://insights.sbomify.com/CVE-2022-27273/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27272](https://insights.sbomify.com/CVE-2022-27272/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27271](https://insights.sbomify.com/CVE-2022-27271/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27270](https://insights.sbomify.com/CVE-2022-27270/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-2727](https://insights.sbomify.com/CVE-2022-2727/): SourceCodester Gym Management System login.php sql injection (medium 6.3)
- [CVE-2022-27269](https://insights.sbomify.com/CVE-2022-27269/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27268](https://insights.sbomify.com/CVE-2022-27268/): Command injection in inhandnetworks:inrouter 900 firmware (critical 9.8)
- [CVE-2022-27263](https://insights.sbomify.com/CVE-2022-27263/): Unrestricted Upload of File with Dangerous Type in Strapi (critical 9.8)
- [CVE-2022-27262](https://insights.sbomify.com/CVE-2022-27262/): File upload in sailsjs:skipper (critical 9.8)
- [CVE-2022-27261](https://insights.sbomify.com/CVE-2022-27261/): Express-FileUpload Arbitrary File Overwrite (high 7.5)
- [CVE-2022-27260](https://insights.sbomify.com/CVE-2022-27260/): Unrestricted Upload of File with Dangerous Type in ButterCMS (critical 9.8)
- [CVE-2022-2726](https://insights.sbomify.com/CVE-2022-2726/): SEMCMS Ant_Check.php sql injection (medium 6.3)
- [CVE-2022-27258](https://insights.sbomify.com/CVE-2022-27258/): Cross-site scripting in hubzilla:hubzilla (medium 6.1)
- [CVE-2022-27257](https://insights.sbomify.com/CVE-2022-27257/): Path traversal in hubzilla:hubzilla (high 7.5)
- [CVE-2022-27256](https://insights.sbomify.com/CVE-2022-27256/): Path traversal in hubzilla:hubzilla (medium 6.1)
- [CVE-2022-27255](https://insights.sbomify.com/CVE-2022-27255/): Memory corruption in realtek:ecos msdk firmware (critical 9.8)
- [CVE-2022-27254](https://insights.sbomify.com/CVE-2022-27254/): Auth bypass in honda:civic 2018 firmware (medium 5.3)
- [CVE-2022-27250](https://insights.sbomify.com/CVE-2022-27250/): Other in unisoc:unisoc chipset (critical 9.8)
- [CVE-2022-2725](https://insights.sbomify.com/CVE-2022-2725/): SourceCodester Company Website CMS add-blog.php cross site scripting (low 3.5)
- [CVE-2022-27249](https://insights.sbomify.com/CVE-2022-27249/): File upload in idearespa:reftree (high 8.8)
- [CVE-2022-27248](https://insights.sbomify.com/CVE-2022-27248/): Path traversal in idearespa:reftree (medium 6.5)
- [CVE-2022-27247](https://insights.sbomify.com/CVE-2022-27247/): Missing authorization in cdsoft:winhotel.mx (medium 5.3)
- [CVE-2022-27246](https://insights.sbomify.com/CVE-2022-27246/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2022-27245](https://insights.sbomify.com/CVE-2022-27245/): Server-side request forgery in misp-project:misp (high 8.8)
- [CVE-2022-27244](https://insights.sbomify.com/CVE-2022-27244/): Cross-site scripting in misp-project:misp (medium 4.8)
- [CVE-2022-27243](https://insights.sbomify.com/CVE-2022-27243/): Path traversal in misp-project:misp (high 7.8)
- [CVE-2022-27242](https://insights.sbomify.com/CVE-2022-27242/): Memory corruption in OpenV2G (medium 5.5)
- [CVE-2022-27241](https://insights.sbomify.com/CVE-2022-27241/): Information disclosure in Mendix Applications using Mendix 7 (high 7.5)
- [CVE-2022-27240](https://insights.sbomify.com/CVE-2022-27240/): Memory corruption in glewlwyd sso server project:glewlwyd sso server (critical 9.8)
- [CVE-2022-2724](https://insights.sbomify.com/CVE-2022-2724/): SourceCodester Employee Management System aprocess.php sql injection (medium 6.3)
- [CVE-2022-27239](https://insights.sbomify.com/CVE-2022-27239/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-27238](https://insights.sbomify.com/CVE-2022-27238/): Cross-site scripting in bigbluebutton:bigbluebutton (medium 5.4)
- [CVE-2022-27237](https://insights.sbomify.com/CVE-2022-27237/): Cross-site scripting in ni:flexlogger (medium 6.1)
- [CVE-2022-27235](https://insights.sbomify.com/CVE-2022-27235/): WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities (medium 6.3)
- [CVE-2022-27234](https://insights.sbomify.com/CVE-2022-27234/): Server-side request forgery in CVAT software maintained by Intel(R) (medium 4.3)
- [CVE-2022-27233](https://insights.sbomify.com/CVE-2022-27233/): XML external entity in Intel(R) Quartus Prime Pro and Standard edition software (medium 6.5)
- [CVE-2022-27231](https://insights.sbomify.com/CVE-2022-27231/): Cross-site scripting in WP Statistics (medium 6.1)
- [CVE-2022-27230](https://insights.sbomify.com/CVE-2022-27230/): Cross-site scripting in BIG-IP APM (high 7.5)
- [CVE-2022-2723](https://insights.sbomify.com/CVE-2022-2723/): SourceCodester Employee Management System eprocess.php sql injection (medium 6.3)
- [CVE-2022-27229](https://insights.sbomify.com/CVE-2022-27229/): Path traversal in Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software (medium 6.7)
- [CVE-2022-27228](https://insights.sbomify.com/CVE-2022-27228/): Code injection in bitrix24:bitrix24 (critical 9.8)
- [CVE-2022-27227](https://insights.sbomify.com/CVE-2022-27227/): Other in fedoraproject:fedora (high 7.5)
- [CVE-2022-27226](https://insights.sbomify.com/CVE-2022-27226/): Cross-site request forgery in irz:rl01 firmware (high 8.8)
- [CVE-2022-27225](https://insights.sbomify.com/CVE-2022-27225/): Information disclosure in gradle:enterprise (medium 6.5)
- [CVE-2022-27224](https://insights.sbomify.com/CVE-2022-27224/): Command injection in galsys:nts-6002-gps firmware (high 7.2)
- [CVE-2022-27223](https://insights.sbomify.com/CVE-2022-27223/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2022-27221](https://insights.sbomify.com/CVE-2022-27221/): Information disclosure in SINEMA Remote Connect Server (medium 5.9)
- [CVE-2022-27220](https://insights.sbomify.com/CVE-2022-27220/): Misconfiguration in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2022-2722](https://insights.sbomify.com/CVE-2022-2722/): SourceCodester Simple Student Information System manage_course.php sql injection (medium 6.3)
- [CVE-2022-27219](https://insights.sbomify.com/CVE-2022-27219/): Misconfiguration in SINEMA Remote Connect Server (medium 4.3)
- [CVE-2022-27218](https://insights.sbomify.com/CVE-2022-27218/): Personal tokens stored in plain text by Jenkins incapptic connect uploader Plugin (medium 4.3)
- [CVE-2022-27217](https://insights.sbomify.com/CVE-2022-27217/): Passwords stored in plain text by Jenkins Vmware vRealize CodeStream Plugin (medium 6.5)
- [CVE-2022-27216](https://insights.sbomify.com/CVE-2022-27216/): Passwords stored in plain text by Jenkins dbCharts Plugin (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/350/