# Vulnerabilities published in 2022


- [CVE-2022-25451](https://insights.sbomify.com/CVE-2022-25451/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25450](https://insights.sbomify.com/CVE-2022-25450/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25449](https://insights.sbomify.com/CVE-2022-25449/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25448](https://insights.sbomify.com/CVE-2022-25448/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25447](https://insights.sbomify.com/CVE-2022-25447/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25446](https://insights.sbomify.com/CVE-2022-25446/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25445](https://insights.sbomify.com/CVE-2022-25445/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25441](https://insights.sbomify.com/CVE-2022-25441/): Command injection in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25440](https://insights.sbomify.com/CVE-2022-25440/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-2544](https://insights.sbomify.com/CVE-2022-2544/): Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing (high 7.5)
- [CVE-2022-25439](https://insights.sbomify.com/CVE-2022-25439/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25438](https://insights.sbomify.com/CVE-2022-25438/): Command injection in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25437](https://insights.sbomify.com/CVE-2022-25437/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25435](https://insights.sbomify.com/CVE-2022-25435/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25434](https://insights.sbomify.com/CVE-2022-25434/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25433](https://insights.sbomify.com/CVE-2022-25433/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25431](https://insights.sbomify.com/CVE-2022-25431/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-2543](https://insights.sbomify.com/CVE-2022-2543/): Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection (medium 6.1)
- [CVE-2022-25429](https://insights.sbomify.com/CVE-2022-25429/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25428](https://insights.sbomify.com/CVE-2022-25428/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25427](https://insights.sbomify.com/CVE-2022-25427/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25420](https://insights.sbomify.com/CVE-2022-25420/): Code injection in nttr:goo blog (critical 9.8)
- [CVE-2022-2542](https://insights.sbomify.com/CVE-2022-2542/): uContext for Clickbank <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-25418](https://insights.sbomify.com/CVE-2022-25418/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25417](https://insights.sbomify.com/CVE-2022-25417/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25414](https://insights.sbomify.com/CVE-2022-25414/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2022-25413](https://insights.sbomify.com/CVE-2022-25413/): Cross-site scripting in max-3000:maxsite cms (medium 5.4)
- [CVE-2022-25412](https://insights.sbomify.com/CVE-2022-25412/): Path traversal in max-3000:maxsite cms (high 8.1)
- [CVE-2022-25411](https://insights.sbomify.com/CVE-2022-25411/): File upload in max-3000:maxsite cms (critical 9.8)
- [CVE-2022-25410](https://insights.sbomify.com/CVE-2022-25410/): Cross-site scripting in max-3000:maxsite cms (medium 5.4)
- [CVE-2022-2541](https://insights.sbomify.com/CVE-2022-2541/): uContext for Amazon <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-25409](https://insights.sbomify.com/CVE-2022-25409/): Cross-site scripting in hospital management system project:hospital management system (medium 5.4)
- [CVE-2022-25408](https://insights.sbomify.com/CVE-2022-25408/): Cross-site scripting in hospital management system project:hospital management system (medium 5.4)
- [CVE-2022-25407](https://insights.sbomify.com/CVE-2022-25407/): Cross-site scripting in hospital management system project:hospital management system (medium 5.4)
- [CVE-2022-25406](https://insights.sbomify.com/CVE-2022-25406/): SQL injection in tongda2000:tongda2000 (critical 9.8)
- [CVE-2022-25405](https://insights.sbomify.com/CVE-2022-25405/): SQL injection in tongda2000:tongda2000 (critical 9.8)
- [CVE-2022-25404](https://insights.sbomify.com/CVE-2022-25404/): SQL injection in tongda2000:tongda2000 (critical 9.8)
- [CVE-2022-25403](https://insights.sbomify.com/CVE-2022-25403/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-25402](https://insights.sbomify.com/CVE-2022-25402/): Missing authorization in hospital management system project:hospital management system (critical 9.1)
- [CVE-2022-25401](https://insights.sbomify.com/CVE-2022-25401/): Path traversal in cuppacms:cuppacms (high 7.5)
- [CVE-2022-2540](https://insights.sbomify.com/CVE-2022-2540/): Link Optimizer Lite <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-25399](https://insights.sbomify.com/CVE-2022-25399/): SQL injection in simple real estate portal system project:simple real estate portal system (critical 9.8)
- [CVE-2022-25398](https://insights.sbomify.com/CVE-2022-25398/): SQL injection in auto spare parts management project:auto spare parts management (critical 9.8)
- [CVE-2022-25396](https://insights.sbomify.com/CVE-2022-25396/): SQL injection in cosmetics and beauty product online store project:cosmetics and beauty product online store (critical 9.8)
- [CVE-2022-25395](https://insights.sbomify.com/CVE-2022-25395/): Cross-site scripting in cosmetics and beauty product online store project:cosmetics and beauty product online store (critical 9.6)
- [CVE-2022-25394](https://insights.sbomify.com/CVE-2022-25394/): SQL injection in medical store management system project:medical store management system (critical 9.8)
- [CVE-2022-25393](https://insights.sbomify.com/CVE-2022-25393/): SQL injection in simple bakery shop management project:simple bakery shop management (high 7.5)
- [CVE-2022-25390](https://insights.sbomify.com/CVE-2022-25390/): Command injection in dcnglobal:dcme-520 firmware (critical 9.8)
- [CVE-2022-2539](https://insights.sbomify.com/CVE-2022-2539/): Missing authorization in GitLab (medium 5.3)
- [CVE-2022-25389](https://insights.sbomify.com/CVE-2022-25389/): Path traversal in dcnglobal:dcme-520 firmware (high 7.5)
- [CVE-2022-2538](https://insights.sbomify.com/CVE-2022-2538/): WP Hide & Security Enhancer < 1.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-25377](https://insights.sbomify.com/CVE-2022-25377/): Appwrite Directory Traversal vulnerability (high 7.5)
- [CVE-2022-25375](https://insights.sbomify.com/CVE-2022-25375/): Information disclosure in debian:debian linux (medium 5.5)
- [CVE-2022-25374](https://insights.sbomify.com/CVE-2022-25374/): Information disclosure in hashicorp:terraform enterprise (high 7.5)
- [CVE-2022-25373](https://insights.sbomify.com/CVE-2022-25373/): Cross-site scripting in zohocorp:manageengine supportcenter plus (medium 5.4)
- [CVE-2022-25372](https://insights.sbomify.com/CVE-2022-25372/): Privilege escalation in pritunl:pritunl-client-electron (high 7.8)
- [CVE-2022-25371](https://insights.sbomify.com/CVE-2022-25371/): Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz (critical 9.8)
- [CVE-2022-25370](https://insights.sbomify.com/CVE-2022-25370/): Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz (medium 5.4)
- [CVE-2022-2537](https://insights.sbomify.com/CVE-2022-2537/): WooCommerce PDF Invoices & Packing Slips < 3.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-25369](https://insights.sbomify.com/CVE-2022-25369/): An issue was discovered in Dynamicweb before 9.12.8. (critical 9.8)
- [CVE-2022-25368](https://insights.sbomify.com/CVE-2022-25368/): Information disclosure in amperecomputing:ampere altra firmware (medium 4.7)
- [CVE-2022-25366](https://insights.sbomify.com/CVE-2022-25366/): Security feature bypass in cryptomator:cryptomator (high 7.8)
- [CVE-2022-25365](https://insights.sbomify.com/CVE-2022-25365/): Other in docker:docker (high 7.8)
- [CVE-2022-25364](https://insights.sbomify.com/CVE-2022-25364/): Misconfiguration in gradle:enterprise (high 8.1)
- [CVE-2022-25363](https://insights.sbomify.com/CVE-2022-25363/): Missing authorization in watchguard:fireware (medium 6.5)
- [CVE-2022-25361](https://insights.sbomify.com/CVE-2022-25361/): Path traversal in watchguard:fireware (critical 9.1)
- [CVE-2022-25360](https://insights.sbomify.com/CVE-2022-25360/): File upload in watchguard:fireware (high 8.8)
- [CVE-2022-2536](https://insights.sbomify.com/CVE-2022-2536/): Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass (medium 5.3)
- [CVE-2022-25359](https://insights.sbomify.com/CVE-2022-25359/): Missing authorization in iclinks:scadaflex ii firmware (critical 9.1)
- [CVE-2022-25358](https://insights.sbomify.com/CVE-2022-25358/): Path traversal in awful-salmonella-tar project:awful-salmonella-tar (medium 5.3)
- [CVE-2022-25357](https://insights.sbomify.com/CVE-2022-25357/): Auth bypass in pexip:pexip infinity (medium 5.3)
- [CVE-2022-25356](https://insights.sbomify.com/CVE-2022-25356/): Code injection in altn:securitygateway (medium 5.3)
- [CVE-2022-25355](https://insights.sbomify.com/CVE-2022-25355/): EC-CUBE improperly handles HTTP Host header values (medium 5.3)
- [CVE-2022-25354](https://insights.sbomify.com/CVE-2022-25354/): Prototype Pollution (high 8.6)
- [CVE-2022-25352](https://insights.sbomify.com/CVE-2022-25352/): Prototype Pollution (high 7.5)
- [CVE-2022-25350](https://insights.sbomify.com/CVE-2022-25350/): Command Injection in puppet-facter (high 7.4)
- [CVE-2022-2535](https://insights.sbomify.com/CVE-2022-2535/): SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure (medium 5.3)
- [CVE-2022-25349](https://insights.sbomify.com/CVE-2022-25349/): Cross-site Scripting (XSS) (medium 5.4)
- [CVE-2022-25348](https://insights.sbomify.com/CVE-2022-25348/): Other in AttacheCase (high 7.8)
- [CVE-2022-25347](https://insights.sbomify.com/CVE-2022-25347/): Delta Electronics DIAEnergie Path Traversal (critical 9.8)
- [CVE-2022-25345](https://insights.sbomify.com/CVE-2022-25345/): Denial of Service (DoS) (high 7.5)
- [CVE-2022-25344](https://insights.sbomify.com/CVE-2022-25344/): Cross-site scripting in olivetti:d-color mf3555 firmware (medium 6.1)
- [CVE-2022-25343](https://insights.sbomify.com/CVE-2022-25343/): Denial of service in olivetti:d-color mf3555 firmware (high 7.5)
- [CVE-2022-25342](https://insights.sbomify.com/CVE-2022-25342/): Missing authorization in olivetti:d-color mf3555 firmware (high 8.1)
- [CVE-2022-2534](https://insights.sbomify.com/CVE-2022-2534/): Information disclosure in GitLab (low 2.2)
- [CVE-2022-25339](https://insights.sbomify.com/CVE-2022-25339/): Missing authorization in owncloud:owncloud client (medium 5.5)
- [CVE-2022-25338](https://insights.sbomify.com/CVE-2022-25338/): Missing authorization in owncloud:owncloud client (medium 6.8)
- [CVE-2022-25337](https://insights.sbomify.com/CVE-2022-25337/): Code injection in ezsystems/ezpublish-kernel (critical 9.8)
- [CVE-2022-25336](https://insights.sbomify.com/CVE-2022-25336/): Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel (medium 5.3)
- [CVE-2022-25335](https://insights.sbomify.com/CVE-2022-25335/): Missing authorization in rigoblock:drago (high 7.5)
- [CVE-2022-25334](https://insights.sbomify.com/CVE-2022-25334/): Stack overflow on SK_LOAD signature length field in Texas Instruments OMAP L138 (high 8.2)
- [CVE-2022-25333](https://insights.sbomify.com/CVE-2022-25333/): Flawed SK_LOAD module authenticity check in Texas Instruments OMAP L138 (high 8.2)
- [CVE-2022-25332](https://insights.sbomify.com/CVE-2022-25332/): SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138 (medium 4.4)
- [CVE-2022-25331](https://insights.sbomify.com/CVE-2022-25331/): Denial of service in Trend Micro ServerProtect for EMC Celerra (high 7.5)
- [CVE-2022-25330](https://insights.sbomify.com/CVE-2022-25330/): Integer overflow in Trend Micro ServerProtect for EMC Celerra (critical 9.8)
- [CVE-2022-2533](https://insights.sbomify.com/CVE-2022-2533/): Auth bypass in GitLab (medium 6.5)
- [CVE-2022-25329](https://insights.sbomify.com/CVE-2022-25329/): Hardcoded credentials in Trend Micro ServerProtect for EMC Celerra (critical 9.8)
- [CVE-2022-25328](https://insights.sbomify.com/CVE-2022-25328/): Privilege escalation through command injection in fscrypt (medium 5.0)
- [CVE-2022-25327](https://insights.sbomify.com/CVE-2022-25327/): Local Denial of Service in fscrypt PAM module (medium 5.5)
- [CVE-2022-25326](https://insights.sbomify.com/CVE-2022-25326/): Denial of Service in fscrypt (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/365/