# Vulnerabilities published in 2022


- [CVE-2022-27215](https://insights.sbomify.com/CVE-2022-27215/): Missing permission checks in Jenkins Release Helper Plugin (medium 4.3)
- [CVE-2022-27214](https://insights.sbomify.com/CVE-2022-27214/): CSRF vulnerability in Jenkins Release Helper Plugin (medium 4.3)
- [CVE-2022-27213](https://insights.sbomify.com/CVE-2022-27213/): Stored Cross-site Scripting vulnerability in Jenkins Environment Dashboard Plugin (medium 5.4)
- [CVE-2022-27212](https://insights.sbomify.com/CVE-2022-27212/): Stored Cross-site Scripting vulnerability in Jenkins List Git Branches Parameter Plugin (medium 5.4)
- [CVE-2022-27211](https://insights.sbomify.com/CVE-2022-27211/): CSRF vulnerability and missing permission checks in Jenkins kubernetes-cd Plugin allow capturing credentials (medium 6.5)
- [CVE-2022-27210](https://insights.sbomify.com/CVE-2022-27210/): CSRF vulnerability in Jenkins kubernetes-cd Plugin allow capturing credentials (medium 6.5)
- [CVE-2022-2721](https://insights.sbomify.com/CVE-2022-2721/): Information disclosure in Octopus Server (high 7.5)
- [CVE-2022-27209](https://insights.sbomify.com/CVE-2022-27209/): Missing permission checks in Jenkins kubernetes-cd Plugin allow enumerating credentials IDs (medium 6.5)
- [CVE-2022-27208](https://insights.sbomify.com/CVE-2022-27208/): Arbitrary file read vulnerability in Jenkins kubernetes-cd Plugin (medium 6.5)
- [CVE-2022-27207](https://insights.sbomify.com/CVE-2022-27207/): Stored Cross-site Scripting vulnerability in Jenkins global-build-stats Plugin (medium 4.8)
- [CVE-2022-27206](https://insights.sbomify.com/CVE-2022-27206/): Client Secret stored in plain text by Jenkins GitLab Authentication Plugin (medium 6.5)
- [CVE-2022-27205](https://insights.sbomify.com/CVE-2022-27205/): CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF (medium 4.3)
- [CVE-2022-27204](https://insights.sbomify.com/CVE-2022-27204/): CSRF vulnerability and missing permission checks in Jenkins Extended Choice Parameter Plugin allow SSRF (high 8.8)
- [CVE-2022-27203](https://insights.sbomify.com/CVE-2022-27203/): Arbitrary JSON and property file read vulnerability in Jenkins Extended Choice Parameter Plugin (medium 6.5)
- [CVE-2022-27202](https://insights.sbomify.com/CVE-2022-27202/): Stored Cross-site Scripting vulnerability in Jenkins Extended Choice Parameter Plugin (medium 5.4)
- [CVE-2022-27201](https://insights.sbomify.com/CVE-2022-27201/): Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin (medium 6.5)
- [CVE-2022-27200](https://insights.sbomify.com/CVE-2022-27200/): Stored Cross-site Scripting in folder-auth plugin (medium 4.8)
- [CVE-2022-2720](https://insights.sbomify.com/CVE-2022-2720/): Information disclosure in Octopus Server (medium 5.3)
- [CVE-2022-27199](https://insights.sbomify.com/CVE-2022-27199/): Missing permission checks in AWS Credentials Plugin (medium 4.3)
- [CVE-2022-27198](https://insights.sbomify.com/CVE-2022-27198/): CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin (high 8.0)
- [CVE-2022-27197](https://insights.sbomify.com/CVE-2022-27197/): Stored Cross-site Scripting vulnerability in Jenkins Dashboard View Plugin (medium 5.4)
- [CVE-2022-27196](https://insights.sbomify.com/CVE-2022-27196/): Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin (medium 5.4)
- [CVE-2022-27195](https://insights.sbomify.com/CVE-2022-27195/): Sensitive parameter values captured in build metadata files by Jenkins Parameterized Trigger Plugin (medium 5.5)
- [CVE-2022-27194](https://insights.sbomify.com/CVE-2022-27194/): Denial of service in SIMATIC PCS neo (Administration Console) (high 7.5)
- [CVE-2022-27193](https://insights.sbomify.com/CVE-2022-27193/): XML External Entities Vulnerability in CVRF-CSAF-Converter (medium 6.1)
- [CVE-2022-27192](https://insights.sbomify.com/CVE-2022-27192/): Information disclosure in asseco:dvs avilys (high 7.5)
- [CVE-2022-27191](https://insights.sbomify.com/CVE-2022-27191/): golang.org/x/crypto/ssh Denial of service via crafted Signer (high 7.5)
- [CVE-2022-2719](https://insights.sbomify.com/CVE-2022-2719/): Denial of service in ImageMagick (medium 5.5)
- [CVE-2022-27189](https://insights.sbomify.com/CVE-2022-27189/): Denial of service in BIG-IP (high 7.5)
- [CVE-2022-27188](https://insights.sbomify.com/CVE-2022-27188/): Command injection in CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP (high 7.8)
- [CVE-2022-27187](https://insights.sbomify.com/CVE-2022-27187/): Privilege escalation in Intel(R) Quartus Prime Standard edition software (medium 6.7)
- [CVE-2022-27185](https://insights.sbomify.com/CVE-2022-27185/): Denial of service in LinkHub Mesh Wifi (critical 9.3)
- [CVE-2022-27184](https://insights.sbomify.com/CVE-2022-27184/): Horner Automation Cscape Csfont (high 7.8)
- [CVE-2022-27183](https://insights.sbomify.com/CVE-2022-27183/): Reflected XSS in a query parameter of the Monitoring Console (high 8.8)
- [CVE-2022-27182](https://insights.sbomify.com/CVE-2022-27182/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-27181](https://insights.sbomify.com/CVE-2022-27181/): Denial of service in BIG-IP APM (medium 5.3)
- [CVE-2022-27180](https://insights.sbomify.com/CVE-2022-27180/): Privilege escalation in Intel(R) MacCPUID software (medium 4.2)
- [CVE-2022-2718](https://insights.sbomify.com/CVE-2022-2718/): SQL injection in JoomSport – for Sports: Team & League, Football, Hockey & more (high 7.2)
- [CVE-2022-27179](https://insights.sbomify.com/CVE-2022-27179/): ICSA-22-104-03 Red Lion DA50N (medium 4.6)
- [CVE-2022-27178](https://insights.sbomify.com/CVE-2022-27178/): Denial of service in LinkHub Mesh Wifi (critical 9.6)
- [CVE-2022-27177](https://insights.sbomify.com/CVE-2022-27177/): Use of Externally-Controlled Format String in consoleme (critical 9.8)
- [CVE-2022-27176](https://insights.sbomify.com/CVE-2022-27176/): Code injection in RevoWorks SCVX, RevoWorks Browser, and RevoWorks (high 7.8)
- [CVE-2022-27175](https://insights.sbomify.com/CVE-2022-27175/): Delta Electronics DIAEnergie SQL Injection in GetCalcTagList (critical 9.8)
- [CVE-2022-27174](https://insights.sbomify.com/CVE-2022-27174/): Cross-site request forgery in Easy Blog for EC-CUBE4 (medium 4.3)
- [CVE-2022-27172](https://insights.sbomify.com/CVE-2022-27172/): Hardcoded credentials in InRouter302 (medium 4.3)
- [CVE-2022-27170](https://insights.sbomify.com/CVE-2022-27170/): Privilege escalation in Intel(R) Media SDK software (medium 5.7)
- [CVE-2022-2717](https://insights.sbomify.com/CVE-2022-2717/): SQL injection in JoomSport – for Sports: Team & League, Football, Hockey & more (high 7.2)
- [CVE-2022-27169](https://insights.sbomify.com/CVE-2022-27169/): Information disclosure in OAS Platform (high 7.5)
- [CVE-2022-27168](https://insights.sbomify.com/CVE-2022-27168/): Cross-site scripting in LiteCart (medium 6.1)
- [CVE-2022-27167](https://insights.sbomify.com/CVE-2022-27167/): Arbitrary File Deletion in ESET products for Windows (high 7.1)
- [CVE-2022-27166](https://insights.sbomify.com/CVE-2022-27166/): XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 (medium 6.1)
- [CVE-2022-27165](https://insights.sbomify.com/CVE-2022-27165/): SQL injection in cszcms:csz cms (critical 9.8)
- [CVE-2022-27164](https://insights.sbomify.com/CVE-2022-27164/): SQL injection in cszcms:csz cms (critical 9.8)
- [CVE-2022-27163](https://insights.sbomify.com/CVE-2022-27163/): SQL injection in cszcms:csz cms (critical 9.8)
- [CVE-2022-27162](https://insights.sbomify.com/CVE-2022-27162/): SQL injection in cszcms:csz cms (critical 9.8)
- [CVE-2022-27161](https://insights.sbomify.com/CVE-2022-27161/): SQL injection in cszcms:csz cms (critical 9.8)
- [CVE-2022-2716](https://insights.sbomify.com/CVE-2022-2716/): Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor (medium 6.4)
- [CVE-2022-27158](https://insights.sbomify.com/CVE-2022-27158/): Deserialization in php:pearweb (critical 9.8)
- [CVE-2022-27157](https://insights.sbomify.com/CVE-2022-27157/): Auth bypass in php:pearweb (critical 9.8)
- [CVE-2022-27156](https://insights.sbomify.com/CVE-2022-27156/): Cross-site scripting in thedaylightstudio:fuel cms (medium 5.4)
- [CVE-2022-27152](https://insights.sbomify.com/CVE-2022-27152/): Other in roku:roku os (medium 5.7)
- [CVE-2022-2715](https://insights.sbomify.com/CVE-2022-2715/): SourceCodester Employee Management System eloginwel.php sql injection (medium 6.3)
- [CVE-2022-27148](https://insights.sbomify.com/CVE-2022-27148/): Integer overflow in gpac:gpac (medium 5.5)
- [CVE-2022-27147](https://insights.sbomify.com/CVE-2022-27147/): Use after free in gpac:gpac (medium 5.5)
- [CVE-2022-27146](https://insights.sbomify.com/CVE-2022-27146/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-27145](https://insights.sbomify.com/CVE-2022-27145/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-27140](https://insights.sbomify.com/CVE-2022-27140/): File upload in express-fileupload project:express-fileupload (critical 9.8)
- [CVE-2022-2714](https://insights.sbomify.com/CVE-2022-2714/): Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis (high 8.1)
- [CVE-2022-27139](https://insights.sbomify.com/CVE-2022-27139/): Arbitrary file upload in Ghost (critical 9.8)
- [CVE-2022-27135](https://insights.sbomify.com/CVE-2022-27135/): Memory corruption in xpdfreader:xpdf (medium 5.5)
- [CVE-2022-27134](https://insights.sbomify.com/CVE-2022-27134/): Business logic in b1:eosio batdappboomx (high 7.5)
- [CVE-2022-27133](https://insights.sbomify.com/CVE-2022-27133/): Path traversal in zbzcms:zbzcms (critical 9.1)
- [CVE-2022-27131](https://insights.sbomify.com/CVE-2022-27131/): File upload in zbzcms:zbzcms (critical 9.8)
- [CVE-2022-2713](https://insights.sbomify.com/CVE-2022-2713/): Insufficient Session Expiration in cockpit-hq/cockpit (high 8.6)
- [CVE-2022-27129](https://insights.sbomify.com/CVE-2022-27129/): File upload in zbzcms:zbzcms (critical 9.8)
- [CVE-2022-27128](https://insights.sbomify.com/CVE-2022-27128/): Missing authorization in zbzcms:zbzcms (critical 9.8)
- [CVE-2022-27127](https://insights.sbomify.com/CVE-2022-27127/): SQL injection in zbzcms:zbzcms (medium 6.5)
- [CVE-2022-27126](https://insights.sbomify.com/CVE-2022-27126/): SQL injection in zbzcms:zbzcms (critical 9.8)
- [CVE-2022-27125](https://insights.sbomify.com/CVE-2022-27125/): Cross-site scripting in zbzcms:zbzcms (medium 6.1)
- [CVE-2022-27124](https://insights.sbomify.com/CVE-2022-27124/): SQL injection in angeljudesuarez:insurance management system (critical 9.8)
- [CVE-2022-27123](https://insights.sbomify.com/CVE-2022-27123/): SQL injection in employee performance evaluation project:employee performance evaluation (critical 9.8)
- [CVE-2022-2712](https://insights.sbomify.com/CVE-2022-2712/): Path Traversal In Eclipse GlassFish (medium 6.5)
- [CVE-2022-27115](https://insights.sbomify.com/CVE-2022-27115/): RCE in Studio-42 elFinder on Windows before 2.1.61 (critical 9.8)
- [CVE-2022-27114](https://insights.sbomify.com/CVE-2022-27114/): Integer overflow in debian:debian linux (medium 5.5)
- [CVE-2022-27111](https://insights.sbomify.com/CVE-2022-27111/): Cross-site scripting in jflyfox:jfinal cms (medium 5.4)
- [CVE-2022-27110](https://insights.sbomify.com/CVE-2022-27110/): Open redirect in orangehrm:orangehrm (medium 5.4)
- [CVE-2022-2711](https://insights.sbomify.com/CVE-2022-2711/): WP All Import < 3.6.9 - Admin+ Directory traversal via file upload (high 7.2)
- [CVE-2022-27109](https://insights.sbomify.com/CVE-2022-27109/): Open redirect in orangehrm:orangehrm (medium 5.4)
- [CVE-2022-27108](https://insights.sbomify.com/CVE-2022-27108/): Missing authorization in orangehrm:orangehrm (medium 4.3)
- [CVE-2022-27107](https://insights.sbomify.com/CVE-2022-27107/): Cross-site scripting in orangehrm:orangehrm (medium 5.4)
- [CVE-2022-27105](https://insights.sbomify.com/CVE-2022-27105/): Cross-site scripting in digitus:inmailx (medium 5.4)
- [CVE-2022-27104](https://insights.sbomify.com/CVE-2022-27104/): SQL injection in formalms:formalms (critical 9.8)
- [CVE-2022-27103](https://insights.sbomify.com/CVE-2022-27103/): element-plus vulnerable to cross-site scripting (XSS) via el-table-column (medium 6.1)
- [CVE-2022-2710](https://insights.sbomify.com/CVE-2022-2710/): Scroll To Top < 1.4.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-27095](https://insights.sbomify.com/CVE-2022-27095/): Privilege escalation in battleye:battleye (high 7.8)
- [CVE-2022-27094](https://insights.sbomify.com/CVE-2022-27094/): Privilege escalation in sony:playmemories home (medium 6.7)
- [CVE-2022-27090](https://insights.sbomify.com/CVE-2022-27090/): Open redirect in chshcms:cscms (medium 5.4)
- [CVE-2022-2709](https://insights.sbomify.com/CVE-2022-2709/): Float to Top Button <= 2.3.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-27089](https://insights.sbomify.com/CVE-2022-27089/): Privilege escalation in fujitsu:plugfree network (high 7.8)
- [CVE-2022-27088](https://insights.sbomify.com/CVE-2022-27088/): Privilege escalation in ivanti:dsm remote (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/351/