# Vulnerabilities published in 2022


- [CVE-2022-26607](https://insights.sbomify.com/CVE-2022-26607/): File upload in baigo:baigo cms (high 7.2)
- [CVE-2022-26605](https://insights.sbomify.com/CVE-2022-26605/): File upload in dascomsoft:eziosuite (high 8.8)
- [CVE-2022-2660](https://insights.sbomify.com/CVE-2022-2660/): Hardcoded credentials in Industrial Automation DIALink (critical 9.8)
- [CVE-2022-26597](https://insights.sbomify.com/CVE-2022-26597/): Liferay Portal and Liferay DXP allows arbitrary injection via the site name (medium 6.1)
- [CVE-2022-26596](https://insights.sbomify.com/CVE-2022-26596/): Liferay Portal and Liferay DXP allows arbitrary injection via web content template names (medium 6.1)
- [CVE-2022-26595](https://insights.sbomify.com/CVE-2022-26595/): Liferay Portal and Liferay DXP fails to check permissions to view sites/groups (medium 4.3)
- [CVE-2022-26594](https://insights.sbomify.com/CVE-2022-26594/): Liferay Portal and Liferay DXP allows arbitrary injection via form field (medium 6.1)
- [CVE-2022-26593](https://insights.sbomify.com/CVE-2022-26593/): Liferay Portal and Liferay DXP allows arbitrary injection via the name of an asset category (medium 5.4)
- [CVE-2022-26592](https://insights.sbomify.com/CVE-2022-26592/): Memory corruption in sass-lang:libsass (high 8.8)
- [CVE-2022-26591](https://insights.sbomify.com/CVE-2022-26591/): Missing authorization in fantec:mwid25-ds firmware (high 7.5)
- [CVE-2022-26589](https://insights.sbomify.com/CVE-2022-26589/): Cross-site request forgery in pluck-cms:pluck (medium 6.5)
- [CVE-2022-26588](https://insights.sbomify.com/CVE-2022-26588/): Cross-site request forgery in icehrm:icehrm (medium 6.5)
- [CVE-2022-26585](https://insights.sbomify.com/CVE-2022-26585/): SQL injection in net.mingsoft:ms-mcms (critical 9.8)
- [CVE-2022-26582](https://insights.sbomify.com/CVE-2022-26582/): Command injection in paxtechnology:paydroid (high 7.8)
- [CVE-2022-26581](https://insights.sbomify.com/CVE-2022-26581/): Missing authorization in paxtechnology:paydroid (medium 5.2)
- [CVE-2022-26580](https://insights.sbomify.com/CVE-2022-26580/): Command injection in paxtechnology:paydroid (medium 6.8)
- [CVE-2022-2658](https://insights.sbomify.com/CVE-2022-2658/): WP Spell Check < 9.13 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-26579](https://insights.sbomify.com/CVE-2022-26579/): Security feature bypass in paxtechnology:paydroid (medium 6.0)
- [CVE-2022-26573](https://insights.sbomify.com/CVE-2022-26573/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2022-26572](https://insights.sbomify.com/CVE-2022-26572/): Missing authorization in xerox:colorqube 8580 firmware (high 7.5)
- [CVE-2022-2657](https://insights.sbomify.com/CVE-2022-2657/): Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls (medium 4.3)
- [CVE-2022-26565](https://insights.sbomify.com/CVE-2022-26565/): Cross-site scripting in totaljs:content management system (medium 4.8)
- [CVE-2022-26564](https://insights.sbomify.com/CVE-2022-26564/): Cross-site scripting in digitaldruid:hoteldruid (medium 6.1)
- [CVE-2022-26563](https://insights.sbomify.com/CVE-2022-26563/): Privilege escalation in tildeslash:monit (high 8.8)
- [CVE-2022-26562](https://insights.sbomify.com/CVE-2022-26562/): Auth bypass in kopano:groupware core (critical 9.8)
- [CVE-2022-2656](https://insights.sbomify.com/CVE-2022-2656/): SourceCodester Multi Language Hotel Management Software sql injection (medium 6.3)
- [CVE-2022-26555](https://insights.sbomify.com/CVE-2022-26555/): Cross-site scripting in eova:eova (medium 5.4)
- [CVE-2022-2655](https://insights.sbomify.com/CVE-2022-2655/): Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-26546](https://insights.sbomify.com/CVE-2022-26546/): Missing authorization in hospital management system project:hospital management system (critical 9.1)
- [CVE-2022-2654](https://insights.sbomify.com/CVE-2022-2654/): Classima < 2.1.11 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-26536](https://insights.sbomify.com/CVE-2022-26536/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-26534](https://insights.sbomify.com/CVE-2022-26534/): Denial of service in fisco-bcos:fisco-bcos (high 7.5)
- [CVE-2022-26533](https://insights.sbomify.com/CVE-2022-26533/): Cross-site Scripting in Alist (medium 6.1)
- [CVE-2022-26532](https://insights.sbomify.com/CVE-2022-26532/): Command injection in ATP series firmware (high 7.8)
- [CVE-2022-26531](https://insights.sbomify.com/CVE-2022-26531/): Memory corruption in ATP series firmware (medium 6.1)
- [CVE-2022-26530](https://insights.sbomify.com/CVE-2022-26530/): Auth bypass in swaywm:swaylock (critical 9.1)
- [CVE-2022-2653](https://insights.sbomify.com/CVE-2022-2653/): Path Traversal in plankanban/planka (high 7.1)
- [CVE-2022-26529](https://insights.sbomify.com/CVE-2022-26529/): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (medium 6.5)
- [CVE-2022-26528](https://insights.sbomify.com/CVE-2022-26528/): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (medium 6.5)
- [CVE-2022-26527](https://insights.sbomify.com/CVE-2022-26527/): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (medium 6.5)
- [CVE-2022-26526](https://insights.sbomify.com/CVE-2022-26526/): Misconfiguration in anaconda:anaconda3 (high 7.8)
- [CVE-2022-26523](https://insights.sbomify.com/CVE-2022-26523/): The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute (medium 5.3)
- [CVE-2022-26522](https://insights.sbomify.com/CVE-2022-26522/): The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute (high 7.8)
- [CVE-2022-26521](https://insights.sbomify.com/CVE-2022-26521/): File upload in abantecart:abantecart (high 7.2)
- [CVE-2022-26520](https://insights.sbomify.com/CVE-2022-26520/): pgjdbc Arbitrary File Write Vulnerability (critical 9.8)
- [CVE-2022-2652](https://insights.sbomify.com/CVE-2022-2652/): Use of Externally-Controlled Format String in umlaeute/v4l2loopback (high 7.3)
- [CVE-2022-26519](https://insights.sbomify.com/CVE-2022-26519/): Interlogix Hills ComNav Improper Restriction of Excessive Authentication Attempts (medium 5.5)
- [CVE-2022-26518](https://insights.sbomify.com/CVE-2022-26518/): Command injection in InRouter302 (critical 9.9)
- [CVE-2022-26517](https://insights.sbomify.com/CVE-2022-26517/): Denial of service in BIG-IP (medium 5.9)
- [CVE-2022-26516](https://insights.sbomify.com/CVE-2022-26516/): ICSA-22-104-03 Red Lion DA50N (high 8.4)
- [CVE-2022-26514](https://insights.sbomify.com/CVE-2022-26514/): Delta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashx (critical 9.8)
- [CVE-2022-26513](https://insights.sbomify.com/CVE-2022-26513/): Memory corruption in Intel(R) XMM(TM) 7560 Modem software (high 8.0)
- [CVE-2022-26512](https://insights.sbomify.com/CVE-2022-26512/): Privilege escalation in Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit (medium 6.7)
- [CVE-2022-26511](https://insights.sbomify.com/CVE-2022-26511/): Code injection in WPS Presentation (high 7.8)
- [CVE-2022-26510](https://insights.sbomify.com/CVE-2022-26510/): Security feature bypass in InRouter302 (critical 9.9)
- [CVE-2022-2651](https://insights.sbomify.com/CVE-2022-2651/): Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm (critical 9.8)
- [CVE-2022-26509](https://insights.sbomify.com/CVE-2022-26509/): Information disclosure in Intel(R) SGX SDK software (low 2.5)
- [CVE-2022-26508](https://insights.sbomify.com/CVE-2022-26508/): Auth bypass in Intel(R) SDP Tool (medium 4.3)
- [CVE-2022-26507](https://insights.sbomify.com/CVE-2022-26507/): Memory corruption in att:xmill (critical 9.8)
- [CVE-2022-26505](https://insights.sbomify.com/CVE-2022-26505/): Security feature bypass in debian:debian linux (high 7.4)
- [CVE-2022-26504](https://insights.sbomify.com/CVE-2022-26504/): Auth bypass in veeam:veeam backup \& replication (high 8.8)
- [CVE-2022-26503](https://insights.sbomify.com/CVE-2022-26503/): Deserialization in veeam:veeam (high 7.8)
- [CVE-2022-26501](https://insights.sbomify.com/CVE-2022-26501/): Veeam Backup & Replication Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-26500](https://insights.sbomify.com/CVE-2022-26500/): Veeam Backup & Replication Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2022-2650](https://insights.sbomify.com/CVE-2022-2650/): Improper Restriction of Excessive Authentication Attempts in wger-project/wger (high 7.8)
- [CVE-2022-26499](https://insights.sbomify.com/CVE-2022-26499/): Server-side request forgery in debian:debian linux (critical 9.1)
- [CVE-2022-26498](https://insights.sbomify.com/CVE-2022-26498/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2022-26497](https://insights.sbomify.com/CVE-2022-26497/): Cross-site scripting in bigbluebutton:greenlight (medium 5.4)
- [CVE-2022-26496](https://insights.sbomify.com/CVE-2022-26496/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2022-26495](https://insights.sbomify.com/CVE-2022-26495/): Integer overflow in debian:debian linux (critical 9.8)
- [CVE-2022-26494](https://insights.sbomify.com/CVE-2022-26494/): Cross-site scripting in primekey:signserver (medium 4.8)
- [CVE-2022-26493](https://insights.sbomify.com/CVE-2022-26493/): miniOrange SAML Authentication Bypass (critical 9.8)
- [CVE-2022-26491](https://insights.sbomify.com/CVE-2022-26491/): Security feature bypass in debian:debian linux (medium 5.9)
- [CVE-2022-26490](https://insights.sbomify.com/CVE-2022-26490/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-26488](https://insights.sbomify.com/CVE-2022-26488/): Privilege escalation in netapp:active iq unified manager (high 7.0)
- [CVE-2022-26486](https://insights.sbomify.com/CVE-2022-26486/): Mozilla Firefox Use-After-Free (critical 9.6, exploited in the wild)
- [CVE-2022-26485](https://insights.sbomify.com/CVE-2022-26485/): Mozilla Firefox Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2022-26484](https://insights.sbomify.com/CVE-2022-26484/): Path traversal in veritas:infoscale operations manager (medium 4.9)
- [CVE-2022-26483](https://insights.sbomify.com/CVE-2022-26483/): Cross-site scripting in veritas:infoscale operations manager (medium 4.8)
- [CVE-2022-26482](https://insights.sbomify.com/CVE-2022-26482/): Command injection in poly:eagleeye director ii firmware (high 7.2)
- [CVE-2022-26481](https://insights.sbomify.com/CVE-2022-26481/): Command injection in poly:g7500 firmware (high 8.8)
- [CVE-2022-2648](https://insights.sbomify.com/CVE-2022-2648/): SourceCodester Multi Language Hotel Management Software sql injection (medium 6.3)
- [CVE-2022-26479](https://insights.sbomify.com/CVE-2022-26479/): Auth bypass in poly:eagleeye director ii firmware (critical 9.8)
- [CVE-2022-26477](https://insights.sbomify.com/CVE-2022-26477/): Denial of service in readExternal method (high 7.5)
- [CVE-2022-26476](https://insights.sbomify.com/CVE-2022-26476/): Hardcoded credentials in Spectrum Power 4 (high 8.8)
- [CVE-2022-26475](https://insights.sbomify.com/CVE-2022-26475/): Memory corruption in MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT6853, MT6855, MT6873, MT6875, MT6879, MT6883, MT6885, MT6889, MT6895, MT6983, MT7663, MT7902, MT7921, MT8167S, MT8175, MT8183, MT8185, MT8362A, MT8365, MT8385, MT8512A, MT8518, MT8532, MT8667, MT8695, MT8696, MT8766, MT8768, MT8786, MT8788, MT8789 (medium 6.7)
- [CVE-2022-26474](https://insights.sbomify.com/CVE-2022-26474/): Memory corruption in MT6789, MT6855, MT6879, MT6895, MT6983 (medium 6.7)
- [CVE-2022-26473](https://insights.sbomify.com/CVE-2022-26473/): Use after free in MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT8365, MT8695, MT8696, MT8798 (medium 6.7)
- [CVE-2022-26472](https://insights.sbomify.com/CVE-2022-26472/): Privilege escalation in MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8666, MT8675, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797 (high 7.8)
- [CVE-2022-26471](https://insights.sbomify.com/CVE-2022-26471/): Privilege escalation in MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8321, MT8385, MT8666, MT8675, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797 (high 7.8)
- [CVE-2022-26470](https://insights.sbomify.com/CVE-2022-26470/): Memory corruption in MT6879, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789 (medium 6.7)
- [CVE-2022-2647](https://insights.sbomify.com/CVE-2022-2647/): jeecg-boot unrestricted upload (high 7.3)
- [CVE-2022-26469](https://insights.sbomify.com/CVE-2022-26469/): Privilege escalation in MT6580, MT6735, MT6737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6895, MT6983, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8321, MT8362A, MT8365, MT8385, MT8666, MT8675, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8797 (high 7.8)
- [CVE-2022-26468](https://insights.sbomify.com/CVE-2022-26468/): Memory corruption in MT6735, MT6739, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6885, MT6893, MT6895, MT6983, MT8163, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8183, MT8185, MT8321, MT8362A, MT8365, MT8385, MT8666, MT8667, MT8675, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8797 (medium 6.6)
- [CVE-2022-26467](https://insights.sbomify.com/CVE-2022-26467/): Memory corruption in MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8168, MT8183, MT8321, MT8365, MT8385, MT8666, MT8675, MT8765, MT8768, MT8786, MT8788, MT8797 (medium 6.7)
- [CVE-2022-26466](https://insights.sbomify.com/CVE-2022-26466/): Integer overflow in MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8512A, MT8518, MT8519 M1V1, MT8519 P1V1, MT8791, MT8797, MT8798 (medium 6.7)
- [CVE-2022-26465](https://insights.sbomify.com/CVE-2022-26465/): Memory corruption in MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8512A, MT8518, MT8791, MT8797, MT8798 (medium 6.7)
- [CVE-2022-26464](https://insights.sbomify.com/CVE-2022-26464/): Memory corruption in MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797 (medium 6.7)
- [CVE-2022-26463](https://insights.sbomify.com/CVE-2022-26463/): Memory corruption in MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797 (medium 4.4)
- [CVE-2022-26462](https://insights.sbomify.com/CVE-2022-26462/): Memory corruption in MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8791, MT8797 (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/356/