# Vulnerabilities published in 2022


- [CVE-2022-26344](https://insights.sbomify.com/CVE-2022-26344/): Misconfiguration in version (high 7.8)
- [CVE-2022-26343](https://insights.sbomify.com/CVE-2022-26343/): Privilege escalation in Intel(R) Processors (high 8.2)
- [CVE-2022-26342](https://insights.sbomify.com/CVE-2022-26342/): Memory corruption in LinkHub Mesh Wifi (high 8.8)
- [CVE-2022-26341](https://insights.sbomify.com/CVE-2022-26341/): Information disclosure in Intel(R) AMT SDK, Intel(R) EMA and Intel(R) MC (high 8.2)
- [CVE-2022-26340](https://insights.sbomify.com/CVE-2022-26340/): Misconfiguration in BIG-IP (medium 4.9)
- [CVE-2022-2634](https://insights.sbomify.com/CVE-2022-2634/): Digi ConnectPort X2D (critical 10.0)
- [CVE-2022-26338](https://insights.sbomify.com/CVE-2022-26338/): Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashx (critical 9.8)
- [CVE-2022-26337](https://insights.sbomify.com/CVE-2022-26337/): Privilege escalation in Trend Micro Password Manager (high 7.8)
- [CVE-2022-26336](https://insights.sbomify.com/CVE-2022-26336/): A carefully crafted TNEF file can cause an out of memory exception (medium 5.5)
- [CVE-2022-26335](https://insights.sbomify.com/CVE-2022-26335/): Memory corruption in SCALANCE X302-7 EEC (230V) (high 7.5)
- [CVE-2022-26334](https://insights.sbomify.com/CVE-2022-26334/): Memory corruption in SCALANCE X302-7 EEC (230V) (high 7.5)
- [CVE-2022-26332](https://insights.sbomify.com/CVE-2022-26332/): Cross-site Scripting in Cipi (medium 5.4)
- [CVE-2022-26331](https://insights.sbomify.com/CVE-2022-26331/): Cross-site scripting in Micro Focus ArcSight Logger (medium 6.1)
- [CVE-2022-26330](https://insights.sbomify.com/CVE-2022-26330/): Information disclosure in Micro Focus ArcSight Logger (medium 6.5)
- [CVE-2022-2633](https://insights.sbomify.com/CVE-2022-2633/): Server-side request forgery in All-in-One Video Gallery (high 7.5)
- [CVE-2022-26329](https://insights.sbomify.com/CVE-2022-26329/): File existence disclosue vulnerability in IDM plugin (low 1.8)
- [CVE-2022-26328](https://insights.sbomify.com/CVE-2022-26328/): User enumeration vulnerability has been discovered in OpenText™ Performance Center (low 2.0)
- [CVE-2022-26327](https://insights.sbomify.com/CVE-2022-26327/): Stored cross-site scripting (XSS) has been discovered in OpenText™ Performance Center (medium 5.1)
- [CVE-2022-26326](https://insights.sbomify.com/CVE-2022-26326/): Potential open redirection vulnerability in NetIQ Access Manager versions prior to version 5.0.2 (medium 4.0)
- [CVE-2022-26325](https://insights.sbomify.com/CVE-2022-26325/): Cross Site Scripting vulnerability in NetIQ Access Manager versions prior to version 5.0.2 (low 2.9)
- [CVE-2022-26324](https://insights.sbomify.com/CVE-2022-26324/): Possible XSS in iManager URL for access Component (high 7.6)
- [CVE-2022-26323](https://insights.sbomify.com/CVE-2022-26323/): Incorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product. (high 8.7)
- [CVE-2022-26322](https://insights.sbomify.com/CVE-2022-26322/): Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager (medium 4.9)
- [CVE-2022-26320](https://insights.sbomify.com/CVE-2022-26320/): Weak cryptography in canon:imageprograf firmware (critical 9.1)
- [CVE-2022-26319](https://insights.sbomify.com/CVE-2022-26319/): Privilege escalation in Trend Micro Portable Security (medium 6.5)
- [CVE-2022-26318](https://insights.sbomify.com/CVE-2022-26318/): WatchGuard Firebox and XTM Appliances Arbitrary Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-26317](https://insights.sbomify.com/CVE-2022-26317/): Information disclosure in Mendix Applications using Mendix 7 (medium 6.5)
- [CVE-2022-26315](https://insights.sbomify.com/CVE-2022-26315/): Path traversal in qrcp project:qrcp (medium 5.3)
- [CVE-2022-26314](https://insights.sbomify.com/CVE-2022-26314/): Weak cryptography in Mendix Forgot Password Appstore module (critical 9.8)
- [CVE-2022-26313](https://insights.sbomify.com/CVE-2022-26313/): Auth bypass in Mendix Forgot Password Appstore module (critical 9.8)
- [CVE-2022-26311](https://insights.sbomify.com/CVE-2022-26311/): Information disclosure in couchbase:cloud native operator (high 7.5)
- [CVE-2022-26310](https://insights.sbomify.com/CVE-2022-26310/): Improper Authorization in User Management to Vertical Privilege Escalation (high 7.3)
- [CVE-2022-2631](https://insights.sbomify.com/CVE-2022-2631/): Improper Access Control in tooljet/tooljet (critical 9.8)
- [CVE-2022-26309](https://insights.sbomify.com/CVE-2022-26309/): Cross-Site Request en Bulk operation (User operation) (low 3.7)
- [CVE-2022-26308](https://insights.sbomify.com/CVE-2022-26308/): Improper Access Control in Configuration (Credential store) (low 3.7)
- [CVE-2022-26307](https://insights.sbomify.com/CVE-2022-26307/): Weak Master Keys (high 8.8)
- [CVE-2022-26306](https://insights.sbomify.com/CVE-2022-26306/): Execution of Untrusted Macros Due to Improper Certificate Validation (high 7.5)
- [CVE-2022-26305](https://insights.sbomify.com/CVE-2022-26305/): Execution of Untrusted Macros Due to Improper Certificate Validation (high 7.5)
- [CVE-2022-26303](https://insights.sbomify.com/CVE-2022-26303/): Missing authorization in OAS Platform (high 7.5)
- [CVE-2022-26302](https://insights.sbomify.com/CVE-2022-26302/): Memory corruption in V-SFT (high 7.8)
- [CVE-2022-26301](https://insights.sbomify.com/CVE-2022-26301/): SQL injection in yejiao:tuzicms (critical 9.8)
- [CVE-2022-26300](https://insights.sbomify.com/CVE-2022-26300/): Memory corruption in eosio project:eos (high 7.5)
- [CVE-2022-2630](https://insights.sbomify.com/CVE-2022-2630/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-26296](https://insights.sbomify.com/CVE-2022-26296/): Information disclosure in boom-core:risvc-boom (medium 5.5)
- [CVE-2022-26295](https://insights.sbomify.com/CVE-2022-26295/): Cross-site scripting in online project time management system project:online project time management system (medium 5.4)
- [CVE-2022-26293](https://insights.sbomify.com/CVE-2022-26293/): SQL injection in online project time management system project:online project time management system (critical 9.8)
- [CVE-2022-26291](https://insights.sbomify.com/CVE-2022-26291/): Use after free in debian:debian linux (medium 5.5)
- [CVE-2022-26290](https://insights.sbomify.com/CVE-2022-26290/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-2629](https://insights.sbomify.com/CVE-2022-2629/): Top Bar < 3.0.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-26289](https://insights.sbomify.com/CVE-2022-26289/): Command injection in tenda:m3 firmware (critical 9.8)
- [CVE-2022-26285](https://insights.sbomify.com/CVE-2022-26285/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-26284](https://insights.sbomify.com/CVE-2022-26284/): SQL injection in simple client management system project:simple client management system (critical 9.8)
- [CVE-2022-26283](https://insights.sbomify.com/CVE-2022-26283/): SQL injection in oretnom23:simple subscription website (critical 9.8)
- [CVE-2022-26281](https://insights.sbomify.com/CVE-2022-26281/): Missing authorization in bigantsoft:bigant server (high 7.5)
- [CVE-2022-26280](https://insights.sbomify.com/CVE-2022-26280/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2022-2628](https://insights.sbomify.com/CVE-2022-2628/): DSGVO All in one for WP < 4.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-26279](https://insights.sbomify.com/CVE-2022-26279/): Missing authorization in eyoucms:eyoucms (critical 9.8)
- [CVE-2022-26278](https://insights.sbomify.com/CVE-2022-26278/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-26276](https://insights.sbomify.com/CVE-2022-26276/): Path traversal in onenav:onenav (medium 5.3)
- [CVE-2022-26273](https://insights.sbomify.com/CVE-2022-26273/): Business logic in eyoucms:eyoucms (critical 9.8)
- [CVE-2022-26272](https://insights.sbomify.com/CVE-2022-26272/): Code injection in ionizecms:ionize (critical 9.8)
- [CVE-2022-26271](https://insights.sbomify.com/CVE-2022-26271/): Path traversal in 74cms:74cms (high 7.5)
- [CVE-2022-2627](https://insights.sbomify.com/CVE-2022-2627/): Newspaper < 12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-26269](https://insights.sbomify.com/CVE-2022-26269/): Other in globalsuzuki:suzuki connect (medium 4.6)
- [CVE-2022-26268](https://insights.sbomify.com/CVE-2022-26268/): SQL injection in xiaohuanxiong project:xiaohuanxiong (critical 9.8)
- [CVE-2022-26267](https://insights.sbomify.com/CVE-2022-26267/): Information disclosure in piwigo:piwigo (high 7.5)
- [CVE-2022-26266](https://insights.sbomify.com/CVE-2022-26266/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2022-26265](https://insights.sbomify.com/CVE-2022-26265/): Remote Code Execution in Contao Managed Edition (critical 9.8)
- [CVE-2022-26263](https://insights.sbomify.com/CVE-2022-26263/): Cross-site scripting in yonyou:u8\+ (medium 6.1)
- [CVE-2022-26260](https://insights.sbomify.com/CVE-2022-26260/): Prototype Pollution in simple-plist (critical 9.8)
- [CVE-2022-2626](https://insights.sbomify.com/CVE-2022-2626/): Incorrect Privilege Assignment in hestiacp/hestiacp (critical 9.1)
- [CVE-2022-26259](https://insights.sbomify.com/CVE-2022-26259/): Memory corruption in xiongmaitech:ahb80n16t-gs firmware (high 7.8)
- [CVE-2022-26258](https://insights.sbomify.com/CVE-2022-26258/): D-Link DIR-820L Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-26255](https://insights.sbomify.com/CVE-2022-26255/): Cross-site scripting in clash project:clash (critical 9.8)
- [CVE-2022-26254](https://insights.sbomify.com/CVE-2022-26254/): Missing authorization in wowonder:wowonder (medium 5.3)
- [CVE-2022-26252](https://insights.sbomify.com/CVE-2022-26252/): Path traversal in aapanel:aapanel (medium 6.5)
- [CVE-2022-26251](https://insights.sbomify.com/CVE-2022-26251/): Privilege escalation in synametrics:synaman (high 7.2)
- [CVE-2022-26250](https://insights.sbomify.com/CVE-2022-26250/): Privilege escalation in synametrics:synaman (high 7.8)
- [CVE-2022-2625](https://insights.sbomify.com/CVE-2022-2625/): Code injection in postgresql (high 8.0)
- [CVE-2022-26249](https://insights.sbomify.com/CVE-2022-26249/): Code injection in surveyking project:surveyking (critical 9.8)
- [CVE-2022-26247](https://insights.sbomify.com/CVE-2022-26247/): Missing authorization in teamwork management system project:teamwork management system (medium 5.9)
- [CVE-2022-26246](https://insights.sbomify.com/CVE-2022-26246/): Cross-site scripting in tms project:tms (medium 6.1)
- [CVE-2022-26245](https://insights.sbomify.com/CVE-2022-26245/): SQLinjection in falcon-plus (critical 9.8)
- [CVE-2022-26244](https://insights.sbomify.com/CVE-2022-26244/): Cross-site scripting in hospital\'s patient records management system project:hospital\'s patient records management system (medium 5.4)
- [CVE-2022-26243](https://insights.sbomify.com/CVE-2022-26243/): Memory corruption in tendacn:ac10 firmware (high 7.5)
- [CVE-2022-26240](https://insights.sbomify.com/CVE-2022-26240/): Misconfiguration in beckmancoulter:remisol advance (medium 6.5)
- [CVE-2022-2624](https://insights.sbomify.com/CVE-2022-2624/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-26239](https://insights.sbomify.com/CVE-2022-26239/): Misconfiguration in beckmancoulter:remisol advance (medium 5.5)
- [CVE-2022-26238](https://insights.sbomify.com/CVE-2022-26238/): Misconfiguration in beckmancoulter:remisol advance (medium 5.5)
- [CVE-2022-26237](https://insights.sbomify.com/CVE-2022-26237/): Misconfiguration in beckmancoulter:remisol advance (medium 5.5)
- [CVE-2022-26236](https://insights.sbomify.com/CVE-2022-26236/): Misconfiguration in beckmancoulter:remisol advance (medium 5.5)
- [CVE-2022-26235](https://insights.sbomify.com/CVE-2022-26235/): Misconfiguration in beckmancoulter:remisol advance (high 7.8)
- [CVE-2022-26233](https://insights.sbomify.com/CVE-2022-26233/): Path traversal in barco:control room management suite (high 7.5)
- [CVE-2022-2623](https://insights.sbomify.com/CVE-2022-2623/): Use after free in Chrome (high 8.8)
- [CVE-2022-2622](https://insights.sbomify.com/CVE-2022-2622/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-26214](https://insights.sbomify.com/CVE-2022-26214/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26213](https://insights.sbomify.com/CVE-2022-26213/): Command injection in totolink:x5000r firmware (critical 9.8)
- [CVE-2022-26212](https://insights.sbomify.com/CVE-2022-26212/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26211](https://insights.sbomify.com/CVE-2022-26211/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26210](https://insights.sbomify.com/CVE-2022-26210/): Command injection in totolink:a3000ru firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/358/