# Vulnerabilities published in 2022


- [CVE-2022-27083](https://insights.sbomify.com/CVE-2022-27083/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-27082](https://insights.sbomify.com/CVE-2022-27082/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-27081](https://insights.sbomify.com/CVE-2022-27081/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-27080](https://insights.sbomify.com/CVE-2022-27080/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-2708](https://insights.sbomify.com/CVE-2022-2708/): SourceCodester Gym Management System login.php sql injection (medium 5.5)
- [CVE-2022-27079](https://insights.sbomify.com/CVE-2022-27079/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-27078](https://insights.sbomify.com/CVE-2022-27078/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-27077](https://insights.sbomify.com/CVE-2022-27077/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-27076](https://insights.sbomify.com/CVE-2022-27076/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-2707](https://insights.sbomify.com/CVE-2022-2707/): SourceCodester Online Class and Exam Scheduling System faculty_sched.php sql injection (medium 6.3)
- [CVE-2022-27064](https://insights.sbomify.com/CVE-2022-27064/): File upload in musical world project:musical world (high 8.8)
- [CVE-2022-27063](https://insights.sbomify.com/CVE-2022-27063/): Cross-site scripting in aerocms project:aerocms (medium 6.1)
- [CVE-2022-27062](https://insights.sbomify.com/CVE-2022-27062/): Cross-site scripting in aerocms project:aerocms (medium 4.8)
- [CVE-2022-27061](https://insights.sbomify.com/CVE-2022-27061/): File upload in aerocms project:aerocms (high 7.2)
- [CVE-2022-2706](https://insights.sbomify.com/CVE-2022-2706/): SourceCodester Online Class and Exam Scheduling System class_sched.php sql injection (medium 6.3)
- [CVE-2022-27055](https://insights.sbomify.com/CVE-2022-27055/): Information disclosure in ecjia:daojia (high 7.5)
- [CVE-2022-27052](https://insights.sbomify.com/CVE-2022-27052/): Privilege escalation in freesshd:freeftpd (high 7.8)
- [CVE-2022-27050](https://insights.sbomify.com/CVE-2022-27050/): Privilege escalation in bitcomet:bitcomet (high 7.8)
- [CVE-2022-2705](https://insights.sbomify.com/CVE-2022-2705/): SourceCodester Simple Student Information System manage_department.php sql injection (medium 6.3)
- [CVE-2022-27049](https://insights.sbomify.com/CVE-2022-27049/): Other in raidrive:raidrive (low 2.0)
- [CVE-2022-27048](https://insights.sbomify.com/CVE-2022-27048/): Other in moxa:mgate mb3170-m-sc-t firmware (high 7.4)
- [CVE-2022-27047](https://insights.sbomify.com/CVE-2022-27047/): File upload in moguit:mogu blog cms (critical 9.8)
- [CVE-2022-27046](https://insights.sbomify.com/CVE-2022-27046/): Use after free in saitoha:libsixel (high 8.8)
- [CVE-2022-27044](https://insights.sbomify.com/CVE-2022-27044/): Memory corruption in saitoha:libsixel (high 8.8)
- [CVE-2022-27043](https://insights.sbomify.com/CVE-2022-27043/): Path traversal in yearning:yearning (high 7.5)
- [CVE-2022-27041](https://insights.sbomify.com/CVE-2022-27041/): SQL injection in os4ed:opensis (high 7.5)
- [CVE-2022-2704](https://insights.sbomify.com/CVE-2022-2704/): SourceCodester Simple E-Learning System downloadFiles.php information disclosure (medium 4.3)
- [CVE-2022-2703](https://insights.sbomify.com/CVE-2022-2703/): SourceCodester Gym Management System Exercises Module sql injection (medium 6.3)
- [CVE-2022-27022](https://insights.sbomify.com/CVE-2022-27022/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-2702](https://insights.sbomify.com/CVE-2022-2702/): SourceCodester Company Website CMS Cookie site-settings.php access control (high 7.3)
- [CVE-2022-27016](https://insights.sbomify.com/CVE-2022-27016/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-2701](https://insights.sbomify.com/CVE-2022-2701/): SourceCodester Simple E-Learning System claire_blake cross site scripting (low 3.5)
- [CVE-2022-27008](https://insights.sbomify.com/CVE-2022-27008/): Memory corruption in f5:njs (high 7.5)
- [CVE-2022-27007](https://insights.sbomify.com/CVE-2022-27007/): Use after free in f5:njs (critical 9.8)
- [CVE-2022-27005](https://insights.sbomify.com/CVE-2022-27005/): Command injection in totolink:a7000r firmware (high 8.8)
- [CVE-2022-27004](https://insights.sbomify.com/CVE-2022-27004/): Command injection in totolink:a7000r firmware (high 8.8)
- [CVE-2022-27003](https://insights.sbomify.com/CVE-2022-27003/): Command injection in totolink:a7000r firmware (high 8.8)
- [CVE-2022-27002](https://insights.sbomify.com/CVE-2022-27002/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-27001](https://insights.sbomify.com/CVE-2022-27001/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-27000](https://insights.sbomify.com/CVE-2022-27000/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-2700](https://insights.sbomify.com/CVE-2022-2700/): SourceCodester Gym Management System GET Parameter sql injection (medium 4.7)
- [CVE-2022-26999](https://insights.sbomify.com/CVE-2022-26999/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-26998](https://insights.sbomify.com/CVE-2022-26998/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-26997](https://insights.sbomify.com/CVE-2022-26997/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-26996](https://insights.sbomify.com/CVE-2022-26996/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-26995](https://insights.sbomify.com/CVE-2022-26995/): Command injection in commscope:arris tr3300 firmware (critical 9.8)
- [CVE-2022-26994](https://insights.sbomify.com/CVE-2022-26994/): Command injection in arris:sbr-ac1200p firmware (critical 9.8)
- [CVE-2022-26993](https://insights.sbomify.com/CVE-2022-26993/): Command injection in arris:sbr-ac1200p firmware (critical 9.8)
- [CVE-2022-26992](https://insights.sbomify.com/CVE-2022-26992/): Command injection in arris:sbr-ac1200p firmware (critical 9.8)
- [CVE-2022-26991](https://insights.sbomify.com/CVE-2022-26991/): Command injection in arris:sbr-ac1200p firmware (critical 9.8)
- [CVE-2022-26990](https://insights.sbomify.com/CVE-2022-26990/): Command injection in arris:sbr-ac1200p firmware (critical 9.8)
- [CVE-2022-2699](https://insights.sbomify.com/CVE-2022-2699/): SourceCodester Simple E-Learning System claire_blake sql injection (medium 6.3)
- [CVE-2022-26988](https://insights.sbomify.com/CVE-2022-26988/): Memory corruption in fastcom:fac1900r firmware (high 7.8)
- [CVE-2022-26987](https://insights.sbomify.com/CVE-2022-26987/): Memory corruption in fastcom:fac1900r firmware (high 7.8)
- [CVE-2022-26986](https://insights.sbomify.com/CVE-2022-26986/): SQL injection in ImpressCMS (high 7.2)
- [CVE-2022-26982](https://insights.sbomify.com/CVE-2022-26982/): Code injection in simplemachines:simple machines forum (high 7.2)
- [CVE-2022-26981](https://insights.sbomify.com/CVE-2022-26981/): Memory corruption in apple:ipados (high 7.8)
- [CVE-2022-26980](https://insights.sbomify.com/CVE-2022-26980/): Cross-site Scripting in teampass (medium 6.1)
- [CVE-2022-2698](https://insights.sbomify.com/CVE-2022-2698/): SourceCodester Simple E-Learning System search.php sql injection (medium 6.3)
- [CVE-2022-26979](https://insights.sbomify.com/CVE-2022-26979/): Null dereference in foxit:pdf editor (high 7.5)
- [CVE-2022-26978](https://insights.sbomify.com/CVE-2022-26978/): Cross-site scripting in barco:control room management suite (medium 6.1)
- [CVE-2022-26977](https://insights.sbomify.com/CVE-2022-26977/): Cross-site scripting in barco:control room management suite (medium 6.1)
- [CVE-2022-26976](https://insights.sbomify.com/CVE-2022-26976/): Cross-site scripting in barco:control room management suite (medium 5.4)
- [CVE-2022-26975](https://insights.sbomify.com/CVE-2022-26975/): Missing authorization in barco:control room management suite (high 7.5)
- [CVE-2022-26974](https://insights.sbomify.com/CVE-2022-26974/): Cross-site scripting in barco:control room management suite (medium 6.1)
- [CVE-2022-26973](https://insights.sbomify.com/CVE-2022-26973/): Information disclosure in barco:control room management suite (medium 5.3)
- [CVE-2022-26972](https://insights.sbomify.com/CVE-2022-26972/): Cross-site scripting in barco:control room management suite (medium 6.1)
- [CVE-2022-26971](https://insights.sbomify.com/CVE-2022-26971/): Missing authorization in barco:control room management suite (medium 5.3)
- [CVE-2022-2697](https://insights.sbomify.com/CVE-2022-2697/): SourceCodester Simple E-Learning System comment_frame.php sql injection (medium 6.3)
- [CVE-2022-26969](https://insights.sbomify.com/CVE-2022-26969/): Insecure default value for CORS configuration (critical 9.8)
- [CVE-2022-26967](https://insights.sbomify.com/CVE-2022-26967/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-26966](https://insights.sbomify.com/CVE-2022-26966/): Information disclosure in debian:debian linux (medium 5.5)
- [CVE-2022-26965](https://insights.sbomify.com/CVE-2022-26965/): File upload in pluck-cms:pluck (high 7.2)
- [CVE-2022-26964](https://insights.sbomify.com/CVE-2022-26964/): Weak cryptography in devolutions:remote desktop manager (high 7.4)
- [CVE-2022-26962](https://insights.sbomify.com/CVE-2022-26962/): Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announce (medium 5.4)
- [CVE-2022-26961](https://insights.sbomify.com/CVE-2022-26961/): Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMS (medium 5.4)
- [CVE-2022-26960](https://insights.sbomify.com/CVE-2022-26960/): Path Traversal in Studio-42 elFinder through 2.1.60 (critical 9.1)
- [CVE-2022-2696](https://insights.sbomify.com/CVE-2022-2696/): Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions (medium 6.3)
- [CVE-2022-26959](https://insights.sbomify.com/CVE-2022-26959/): SQL injection in globalnorthstar:northstar club management (critical 10.0)
- [CVE-2022-26954](https://insights.sbomify.com/CVE-2022-26954/): Open redirect in nopcommerce:nopcommerce (medium 6.1)
- [CVE-2022-26953](https://insights.sbomify.com/CVE-2022-26953/): Memory corruption in digi:passport firmware (high 7.5)
- [CVE-2022-26952](https://insights.sbomify.com/CVE-2022-26952/): Memory corruption in digi:passport firmware (high 7.5)
- [CVE-2022-26951](https://insights.sbomify.com/CVE-2022-26951/): Cross-site scripting in rsa:archer (medium 6.5)
- [CVE-2022-26950](https://insights.sbomify.com/CVE-2022-26950/): Open redirect in rsa:archer (medium 5.4)
- [CVE-2022-2695](https://insights.sbomify.com/CVE-2022-2695/): Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption' (medium 6.4)
- [CVE-2022-26949](https://insights.sbomify.com/CVE-2022-26949/): Missing authorization in rsa:archer (medium 5.3)
- [CVE-2022-26948](https://insights.sbomify.com/CVE-2022-26948/): Information disclosure in rsa:archer (medium 5.8)
- [CVE-2022-26947](https://insights.sbomify.com/CVE-2022-26947/): Cross-site scripting in rsa:archer (medium 6.3)
- [CVE-2022-26945](https://insights.sbomify.com/CVE-2022-26945/): Server-side request forgery in hashicorp:go-getter (critical 9.8)
- [CVE-2022-26944](https://insights.sbomify.com/CVE-2022-26944/): Information disclosure in percona:xtrabackup (medium 6.5)
- [CVE-2022-26943](https://insights.sbomify.com/CVE-2022-26943/): Weak PRNG entropy source used for authentication challenge generation in Motorola MTM5000 (high 8.8)
- [CVE-2022-26942](https://insights.sbomify.com/CVE-2022-26942/): Multiple missing pointer validation checks in trusted execution module in Motorola MTM5000 (high 8.2)
- [CVE-2022-26941](https://insights.sbomify.com/CVE-2022-26941/): Format string vulnerability in AT+CTGL command in Motorola MTM5000 (critical 9.6)
- [CVE-2022-26940](https://insights.sbomify.com/CVE-2022-26940/): Remote Desktop Protocol Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-2694](https://insights.sbomify.com/CVE-2022-2694/): SourceCodester Company Website CMS unrestricted upload (medium 6.3)
- [CVE-2022-26939](https://insights.sbomify.com/CVE-2022-26939/): Storage Spaces Direct Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-26938](https://insights.sbomify.com/CVE-2022-26938/): Storage Spaces Direct Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-26937](https://insights.sbomify.com/CVE-2022-26937/): Windows Network File System Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-26936](https://insights.sbomify.com/CVE-2022-26936/): Windows Server Service Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-26935](https://insights.sbomify.com/CVE-2022-26935/): Windows WLAN AutoConfig Service Information Disclosure Vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/352/