# Vulnerabilities published in 2022


- [CVE-2022-2621](https://insights.sbomify.com/CVE-2022-2621/): Use after free in Chrome (high 8.8)
- [CVE-2022-26209](https://insights.sbomify.com/CVE-2022-26209/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26208](https://insights.sbomify.com/CVE-2022-26208/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26207](https://insights.sbomify.com/CVE-2022-26207/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26206](https://insights.sbomify.com/CVE-2022-26206/): Command injection in totolink:a3000ru firmware (critical 9.8)
- [CVE-2022-26205](https://insights.sbomify.com/CVE-2022-26205/): Code injection in marky project:marky (critical 9.8)
- [CVE-2022-26201](https://insights.sbomify.com/CVE-2022-26201/): SQL injection in victor cms project:victor cms (critical 9.8)
- [CVE-2022-2620](https://insights.sbomify.com/CVE-2022-2620/): Use after free in Chrome (high 8.8)
- [CVE-2022-26198](https://insights.sbomify.com/CVE-2022-26198/): Code injection in notable:notable (critical 9.8)
- [CVE-2022-26197](https://insights.sbomify.com/CVE-2022-26197/): Cross-site scripting in joget:joget dx (medium 5.4)
- [CVE-2022-2619](https://insights.sbomify.com/CVE-2022-2619/): Cross-site scripting in Chrome (medium 4.3)
- [CVE-2022-26189](https://insights.sbomify.com/CVE-2022-26189/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-26188](https://insights.sbomify.com/CVE-2022-26188/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-26187](https://insights.sbomify.com/CVE-2022-26187/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-26186](https://insights.sbomify.com/CVE-2022-26186/): Command injection in totolink:n600r firmware (critical 9.8)
- [CVE-2022-26184](https://insights.sbomify.com/CVE-2022-26184/): Poetry before v1.1.9 contains Untrusted Search Path (critical 9.8)
- [CVE-2022-26183](https://insights.sbomify.com/CVE-2022-26183/): Untrusted Search Path in PNPM (high 8.8)
- [CVE-2022-26181](https://insights.sbomify.com/CVE-2022-26181/): Memory corruption in dropbox:lepton (high 7.8)
- [CVE-2022-26180](https://insights.sbomify.com/CVE-2022-26180/): Cross-site request forgery in qdpm:qdpm (high 8.8)
- [CVE-2022-2618](https://insights.sbomify.com/CVE-2022-2618/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-26174](https://insights.sbomify.com/CVE-2022-26174/): Code injection in beekeeperstudio:beekeeper-studio (critical 9.8)
- [CVE-2022-26173](https://insights.sbomify.com/CVE-2022-26173/): Cross-site request forgery in jforum:jforum (high 8.8)
- [CVE-2022-26171](https://insights.sbomify.com/CVE-2022-26171/): SQL injection in bank management system project:bank management system (critical 9.8)
- [CVE-2022-26170](https://insights.sbomify.com/CVE-2022-26170/): SQL injection in simple mobile comparison website project:simple mobile comparison website (critical 9.8)
- [CVE-2022-2617](https://insights.sbomify.com/CVE-2022-2617/): Use after free in Chrome (high 8.8)
- [CVE-2022-26169](https://insights.sbomify.com/CVE-2022-26169/): SQL injection in air cargo management system project:air cargo management system (critical 9.8)
- [CVE-2022-2616](https://insights.sbomify.com/CVE-2022-2616/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-26159](https://insights.sbomify.com/CVE-2022-26159/): Information disclosure in ametys:ametys (medium 5.3)
- [CVE-2022-26158](https://insights.sbomify.com/CVE-2022-26158/): Open redirect in cherwell:cherwell service management (medium 6.1)
- [CVE-2022-26157](https://insights.sbomify.com/CVE-2022-26157/): Information disclosure in cherwell:cherwell service management (medium 5.3)
- [CVE-2022-26156](https://insights.sbomify.com/CVE-2022-26156/): Open redirect in cherwell:cherwell service management (medium 6.1)
- [CVE-2022-26155](https://insights.sbomify.com/CVE-2022-26155/): Cross-site scripting in cherwell:cherwell service management (medium 6.1)
- [CVE-2022-26151](https://insights.sbomify.com/CVE-2022-26151/): Command injection in citrix:xenmobile server (high 7.2)
- [CVE-2022-2615](https://insights.sbomify.com/CVE-2022-2615/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-26149](https://insights.sbomify.com/CVE-2022-26149/): Unrestricted Upload of File with Dangerous Type in MODX Revolution (high 7.2)
- [CVE-2022-26148](https://insights.sbomify.com/CVE-2022-26148/): Information disclosure in grafana:grafana (critical 9.8)
- [CVE-2022-26147](https://insights.sbomify.com/CVE-2022-26147/): Command injection in quectel:rg502q-ea firmware (critical 9.8)
- [CVE-2022-26146](https://insights.sbomify.com/CVE-2022-26146/): Cross-site scripting in tricentis:qtest (medium 5.4)
- [CVE-2022-26144](https://insights.sbomify.com/CVE-2022-26144/): MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php (medium 6.1)
- [CVE-2022-26143](https://insights.sbomify.com/CVE-2022-26143/): MiCollab, MiVoice Business Express Access Control (critical 9.8, exploited in the wild)
- [CVE-2022-2614](https://insights.sbomify.com/CVE-2022-2614/): Use after free in Chrome (high 8.8)
- [CVE-2022-26138](https://insights.sbomify.com/CVE-2022-26138/): Atlassian Questions For Confluence App Hard-coded Credentials (critical 9.8, exploited in the wild)
- [CVE-2022-26137](https://insights.sbomify.com/CVE-2022-26137/): Security feature bypass in Bamboo Data Center (high 8.8)
- [CVE-2022-26136](https://insights.sbomify.com/CVE-2022-26136/): Auth bypass in Bamboo Data Center (critical 9.8)
- [CVE-2022-26135](https://insights.sbomify.com/CVE-2022-26135/): Server-side request forgery in Jira Core Server (medium 6.5)
- [CVE-2022-26134](https://insights.sbomify.com/CVE-2022-26134/): Atlassian Confluence Server and Data Center Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-26133](https://insights.sbomify.com/CVE-2022-26133/): Deserialization in Bitbucket Data Center (critical 9.8)
- [CVE-2022-26131](https://insights.sbomify.com/CVE-2022-26131/): Other in PLC4TRUCKS (critical 9.3)
- [CVE-2022-26130](https://insights.sbomify.com/CVE-2022-26130/): Denial of service in BIG-IP (medium 5.3)
- [CVE-2022-2613](https://insights.sbomify.com/CVE-2022-2613/): Use after free in Chrome (high 8.8)
- [CVE-2022-26129](https://insights.sbomify.com/CVE-2022-26129/): Memory corruption in FRRouting (high 7.8)
- [CVE-2022-26128](https://insights.sbomify.com/CVE-2022-26128/): Memory corruption in FRRouting (high 7.8)
- [CVE-2022-26127](https://insights.sbomify.com/CVE-2022-26127/): Memory corruption in FRRouting (high 7.8)
- [CVE-2022-26126](https://insights.sbomify.com/CVE-2022-26126/): Memory corruption in FRRouting (high 7.8)
- [CVE-2022-26125](https://insights.sbomify.com/CVE-2022-26125/): Memory corruption in FRRouting (high 7.5)
- [CVE-2022-26124](https://insights.sbomify.com/CVE-2022-26124/): Memory corruption in Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits (high 7.5)
- [CVE-2022-26122](https://insights.sbomify.com/CVE-2022-26122/): Security feature bypass in Fortinet AV Engine, FortiMail, FortiOS, FortiClient (medium 4.7)
- [CVE-2022-26121](https://insights.sbomify.com/CVE-2022-26121/): Missing authorization in fortinet:fortianalyzer (low 3.7)
- [CVE-2022-26120](https://insights.sbomify.com/CVE-2022-26120/): SQL injection in Fortinet FortiADC (medium 5.4)
- [CVE-2022-2612](https://insights.sbomify.com/CVE-2022-2612/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-26119](https://insights.sbomify.com/CVE-2022-26119/): Hardcoded credentials in Fortinet FortiSIEM (high 7.8)
- [CVE-2022-26118](https://insights.sbomify.com/CVE-2022-26118/): Privilege escalation in Fortinet FortiManager , FortiAnalyzer (medium 6.7)
- [CVE-2022-26117](https://insights.sbomify.com/CVE-2022-26117/): Hardcoded credentials in Fortinet FortiNAC (high 8.8)
- [CVE-2022-26116](https://insights.sbomify.com/CVE-2022-26116/): SQL injection in Fortinet FortiNAC (high 7.2)
- [CVE-2022-26115](https://insights.sbomify.com/CVE-2022-26115/): Weak cryptography in FortiSandbox (medium 5.4)
- [CVE-2022-26114](https://insights.sbomify.com/CVE-2022-26114/): Cross-site scripting in Fortinet FortiMail (medium 5.4)
- [CVE-2022-26113](https://insights.sbomify.com/CVE-2022-26113/): Privilege escalation in Fortinet FortiClientWindows (high 7.7)
- [CVE-2022-26112](https://insights.sbomify.com/CVE-2022-26112/): Apache Pinot has Groovy Function support enabled by default (critical 9.8)
- [CVE-2022-26111](https://insights.sbomify.com/CVE-2022-26111/): Code injection in canon:irisnext (high 8.8)
- [CVE-2022-26110](https://insights.sbomify.com/CVE-2022-26110/): Auth bypass in debian:debian linux (high 8.8)
- [CVE-2022-2611](https://insights.sbomify.com/CVE-2022-2611/): Other in Chrome (medium 4.3)
- [CVE-2022-26109](https://insights.sbomify.com/CVE-2022-26109/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-26108](https://insights.sbomify.com/CVE-2022-26108/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-26107](https://insights.sbomify.com/CVE-2022-26107/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-26106](https://insights.sbomify.com/CVE-2022-26106/): Denial of service in SAP 3D Visual Enterprise Viewer (medium 6.5)
- [CVE-2022-26105](https://insights.sbomify.com/CVE-2022-26105/): Cross-site scripting in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2022-26104](https://insights.sbomify.com/CVE-2022-26104/): Missing authorization in SAP Financial Consolidation (medium 5.3)
- [CVE-2022-26103](https://insights.sbomify.com/CVE-2022-26103/): Missing authorization in SAP NetWeaver (Real Time Messaging Framework) (medium 5.3)
- [CVE-2022-26102](https://insights.sbomify.com/CVE-2022-26102/): Missing authorization in SAP NetWeaver Application Server for ABAP (medium 5.4)
- [CVE-2022-26101](https://insights.sbomify.com/CVE-2022-26101/): Cross-site scripting in Fiori Launchpad (medium 6.1)
- [CVE-2022-26100](https://insights.sbomify.com/CVE-2022-26100/): Memory corruption in SAPCAR (critical 9.8)
- [CVE-2022-2610](https://insights.sbomify.com/CVE-2022-2610/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-26099](https://insights.sbomify.com/CVE-2022-26099/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-26098](https://insights.sbomify.com/CVE-2022-26098/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2022-26097](https://insights.sbomify.com/CVE-2022-26097/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-26096](https://insights.sbomify.com/CVE-2022-26096/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-26095](https://insights.sbomify.com/CVE-2022-26095/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-26094](https://insights.sbomify.com/CVE-2022-26094/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-26093](https://insights.sbomify.com/CVE-2022-26093/): Null dereference in Samsung Mobile Devices (medium 5.9)
- [CVE-2022-26092](https://insights.sbomify.com/CVE-2022-26092/): Memory corruption in Samsung Mobile Devices (high 7.4)
- [CVE-2022-26091](https://insights.sbomify.com/CVE-2022-26091/): Auth bypass in Samsung Mobile Devices (medium 5.7)
- [CVE-2022-26090](https://insights.sbomify.com/CVE-2022-26090/): Missing authorization in SamsungContacts (medium 5.3)
- [CVE-2022-2609](https://insights.sbomify.com/CVE-2022-2609/): Use after free in Chrome (high 8.8)
- [CVE-2022-26088](https://insights.sbomify.com/CVE-2022-26088/): Cross-site scripting in bmc:remedy it service management suite (medium 5.4)
- [CVE-2022-26086](https://insights.sbomify.com/CVE-2022-26086/): Privilege escalation in PresentMon software maintained by Intel(R) (medium 6.7)
- [CVE-2022-26085](https://insights.sbomify.com/CVE-2022-26085/): Command injection in InRouter302 (critical 9.9)
- [CVE-2022-26083](https://insights.sbomify.com/CVE-2022-26083/): Weak cryptography in Intel(R) IPP Cryptography software library (high 7.5)
- [CVE-2022-26082](https://insights.sbomify.com/CVE-2022-26082/): Missing authorization in OAS Platform (critical 9.1)
- [CVE-2022-26081](https://insights.sbomify.com/CVE-2022-26081/): Other in The installer of WPS Office (high 7.8)
- [CVE-2022-26080](https://insights.sbomify.com/CVE-2022-26080/): Easily guessable session ID's in NE843 Pulsar Plus Controller (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/359/