# Vulnerabilities published in 2022 - [CVE-2022-25213](https://insights.sbomify.com/CVE-2022-25213/): Hardcoded credentials in Phicomm Routers (medium 6.8) - [CVE-2022-25212](https://insights.sbomify.com/CVE-2022-25212/): CSRF vulnerability in Jenkins SWAMP Plugin allows capturing credentials (high 8.8) - [CVE-2022-25211](https://insights.sbomify.com/CVE-2022-25211/): Missing permission check in Jenkins SWAMP Plugin allows capturing credentials (high 8.8) - [CVE-2022-25210](https://insights.sbomify.com/CVE-2022-25210/): Improper Synchronization in Jenkins Convertigo Mobile Platform Plugin (medium 6.5) - [CVE-2022-2521](https://insights.sbomify.com/CVE-2022-2521/): Memory corruption in libtiff (medium 6.5) - [CVE-2022-25209](https://insights.sbomify.com/CVE-2022-25209/): Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra (high 8.8) - [CVE-2022-25208](https://insights.sbomify.com/CVE-2022-25208/): Missing permission checks in Jenkins Chef Sinatra Plugin allow XXE (high 8.8) - [CVE-2022-25207](https://insights.sbomify.com/CVE-2022-25207/): CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE (high 8.8) - [CVE-2022-25206](https://insights.sbomify.com/CVE-2022-25206/): Missing Authorization in Jenkins dbCharts Plugin (high 8.8) - [CVE-2022-25205](https://insights.sbomify.com/CVE-2022-25205/): Cross-Site Request Forgery in Jenkins dbCharts Plugin (high 8.8) - [CVE-2022-25204](https://insights.sbomify.com/CVE-2022-25204/): Protection Mechanism Failure in Jenkins Doktor Plugin (medium 5.4) - [CVE-2022-25203](https://insights.sbomify.com/CVE-2022-25203/): Stored Cross-site Scripting vulnerability in Jenkins Team Views Plugin (medium 5.4) - [CVE-2022-25202](https://insights.sbomify.com/CVE-2022-25202/): Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds (Simple) Plugin (medium 4.8) - [CVE-2022-25201](https://insights.sbomify.com/CVE-2022-25201/): Missing permission checks in Jenkins Checkmarx Plugin allow capturing credentials (medium 6.5) - [CVE-2022-25200](https://insights.sbomify.com/CVE-2022-25200/): CSRF vulnerability in Jenkins Checkmarx Plugin allow capturing credentials (high 8.8) - [CVE-2022-2520](https://insights.sbomify.com/CVE-2022-2520/): Denial of service in libtiff (medium 6.5) - [CVE-2022-25199](https://insights.sbomify.com/CVE-2022-25199/): Missing permission check in Jenkins SCP publisher Plugin (high 8.8) - [CVE-2022-25198](https://insights.sbomify.com/CVE-2022-25198/): CSRF vulnerability in Jenkins SCP publisher Plugin (high 8.8) - [CVE-2022-25197](https://insights.sbomify.com/CVE-2022-25197/): Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files (medium 6.5) - [CVE-2022-25196](https://insights.sbomify.com/CVE-2022-25196/): Open redirect vulnerability in Jenkins GitLab Authentication Plugin (medium 5.4) - [CVE-2022-25195](https://insights.sbomify.com/CVE-2022-25195/): Missing permission check in Jenkins autonomiq Plugin (medium 4.3) - [CVE-2022-25194](https://insights.sbomify.com/CVE-2022-25194/): CSRF vulnerability in Jenkins autonomiq plugin (high 8.8) - [CVE-2022-25193](https://insights.sbomify.com/CVE-2022-25193/): Jenkins Snow Commander Plugin prior to 2.0 vulnerable to Missing Authorization (medium 6.5) - [CVE-2022-25192](https://insights.sbomify.com/CVE-2022-25192/): Jenkins Snow Commander Plugin 2.0 vulnerable to Cross-Site Request Forgery (high 8.8) - [CVE-2022-25191](https://insights.sbomify.com/CVE-2022-25191/): Stored Cross-site Scripting vulnerability in Jenkins Agent Server Parameter Plugin (medium 5.4) - [CVE-2022-25190](https://insights.sbomify.com/CVE-2022-25190/): Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs (medium 4.3) - [CVE-2022-2519](https://insights.sbomify.com/CVE-2022-2519/): Memory corruption in libtiff (medium 6.5) - [CVE-2022-25189](https://insights.sbomify.com/CVE-2022-25189/): Stored Cross-site Scripting vulnerability in Jenkins Custom Checkbox Parameter Plugin (medium 5.4) - [CVE-2022-25188](https://insights.sbomify.com/CVE-2022-25188/): Path traversal vulnerability in Jenkins Fortify Plugin (medium 4.3) - [CVE-2022-25187](https://insights.sbomify.com/CVE-2022-25187/): Jenkins Support Core Plugin stores sensitive data in plain text (medium 6.5) - [CVE-2022-25186](https://insights.sbomify.com/CVE-2022-25186/): Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin (medium 6.5) - [CVE-2022-25185](https://insights.sbomify.com/CVE-2022-25185/): Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin (medium 5.4) - [CVE-2022-25184](https://insights.sbomify.com/CVE-2022-25184/): Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin (medium 6.5) - [CVE-2022-25183](https://insights.sbomify.com/CVE-2022-25183/): Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure (high 8.8) - [CVE-2022-25182](https://insights.sbomify.com/CVE-2022-25182/): Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure (high 8.8) - [CVE-2022-25181](https://insights.sbomify.com/CVE-2022-25181/): Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure (high 8.8) - [CVE-2022-25180](https://insights.sbomify.com/CVE-2022-25180/): Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials (medium 4.3) - [CVE-2022-2518](https://insights.sbomify.com/CVE-2022-2518/): Stockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8) - [CVE-2022-25179](https://insights.sbomify.com/CVE-2022-25179/): Link Following in Jenkins Pipeline Multibranch Plugin (medium 6.5) - [CVE-2022-25178](https://insights.sbomify.com/CVE-2022-25178/): Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin (medium 6.5) - [CVE-2022-25177](https://insights.sbomify.com/CVE-2022-25177/): Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin (medium 6.5) - [CVE-2022-25176](https://insights.sbomify.com/CVE-2022-25176/): Improper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin (medium 6.5) - [CVE-2022-25175](https://insights.sbomify.com/CVE-2022-25175/): Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection (high 8.8) - [CVE-2022-25174](https://insights.sbomify.com/CVE-2022-25174/): Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin (high 8.8) - [CVE-2022-25173](https://insights.sbomify.com/CVE-2022-25173/): Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin (high 8.8) - [CVE-2022-25172](https://insights.sbomify.com/CVE-2022-25172/): Misconfiguration in InRouter302 (high 7.5) - [CVE-2022-25171](https://insights.sbomify.com/CVE-2022-25171/): Command Injection (high 7.4) - [CVE-2022-25170](https://insights.sbomify.com/CVE-2022-25170/): ICSA-22-055-01 FATEK Automation FvDesigner (high 7.8) - [CVE-2022-2517](https://insights.sbomify.com/CVE-2022-2517/): Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover (medium 6.4) - [CVE-2022-25169](https://insights.sbomify.com/CVE-2022-25169/): Apache Tika BPGParser Memory Usage DoS (medium 5.5) - [CVE-2022-25168](https://insights.sbomify.com/CVE-2022-25168/): Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar (critical 9.8) - [CVE-2022-25167](https://insights.sbomify.com/CVE-2022-25167/): Apache Flume vulnerable to a JNDI RCE in JMSSource (critical 9.8) - [CVE-2022-25166](https://insights.sbomify.com/CVE-2022-25166/): Information disclosure in amazon:aws client vpn (medium 5.0) - [CVE-2022-25165](https://insights.sbomify.com/CVE-2022-25165/): Race condition in amazon:aws client vpn (high 7.0) - [CVE-2022-25164](https://insights.sbomify.com/CVE-2022-25164/): Information disclosure in GX Works3 (high 8.6) - [CVE-2022-25163](https://insights.sbomify.com/CVE-2022-25163/): Other in Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N (critical 9.8) - [CVE-2022-25162](https://insights.sbomify.com/CVE-2022-25162/): Denial of service in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS); Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R); Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) (medium 5.3) - [CVE-2022-25161](https://insights.sbomify.com/CVE-2022-25161/): Denial of service in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS); Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R); Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) (high 8.6) - [CVE-2022-25160](https://insights.sbomify.com/CVE-2022-25160/): Information disclosure in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100 (medium 5.9) - [CVE-2022-2516](https://insights.sbomify.com/CVE-2022-2516/): Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title' (medium 6.4) - [CVE-2022-25159](https://insights.sbomify.com/CVE-2022-25159/): Auth bypass in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100 (high 8.1) - [CVE-2022-25158](https://insights.sbomify.com/CVE-2022-25158/): Information disclosure in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; itsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ71GF11-T2; Mitsubishi Electric MELSEC iQ-R series RJ71GP21(S)-SX; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2 (critical 9.1) - [CVE-2022-25157](https://insights.sbomify.com/CVE-2022-25157/): Auth bypass in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ71GF11-T2; Mitsubishi Electric MELSEC iQ-R series RJ71GP21(S)-SX; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2 (critical 9.1) - [CVE-2022-25156](https://insights.sbomify.com/CVE-2022-25156/): Weak cryptography in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC Q series QJ72BR15; Mitsubishi Electric MELSEC Q series QJ72LP25(-25/G/GE); Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2 (high 8.1) - [CVE-2022-25155](https://insights.sbomify.com/CVE-2022-25155/): Auth bypass in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series RJ71GN11-T2; Mitsubishi Electric MELSEC iQ-R series RJ71GN11-EIP; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC Q series QJ72BR15; Mitsubishi Electric MELSEC Q series QJ72LP25(-25/G/GE); Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2 (high 8.1) - [CVE-2022-25154](https://insights.sbomify.com/CVE-2022-25154/): Privilege escalation in samsung:t5 firmware (high 7.3) - [CVE-2022-25153](https://insights.sbomify.com/CVE-2022-25153/): ITarian - Local privilege escalation in Endpoint Manager agent on Windows (high 7.8) - [CVE-2022-25152](https://insights.sbomify.com/CVE-2022-25152/): ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals (critical 9.9) - [CVE-2022-25151](https://insights.sbomify.com/CVE-2022-25151/): ITarian - Session cookie not protected by HttpOnly flag (high 7.5) - [CVE-2022-25150](https://insights.sbomify.com/CVE-2022-25150/): Privilege escalation in malwarebytes:binisoft windows firewall control (high 7.8) - [CVE-2022-2515](https://insights.sbomify.com/CVE-2022-2515/): Simple Banner <= 2.11.0 - Authenticated Stored Cross-Site Scripting (medium 6.4) - [CVE-2022-25149](https://insights.sbomify.com/CVE-2022-25149/): WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP (critical 9.8) - [CVE-2022-25148](https://insights.sbomify.com/CVE-2022-25148/): WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id (critical 9.8) - [CVE-2022-25147](https://insights.sbomify.com/CVE-2022-25147/): Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions (medium 6.5) - [CVE-2022-25146](https://insights.sbomify.com/CVE-2022-25146/): Liferay Portal and Liferay DXP fails to check origin of event messages (medium 5.3) - [CVE-2022-2514](https://insights.sbomify.com/CVE-2022-2514/): Cross-site Scripting (XSS) - Reflected in beancount/fava (high 8.0) - [CVE-2022-25139](https://insights.sbomify.com/CVE-2022-25139/): Use after free in f5:njs (critical 9.8) - [CVE-2022-25138](https://insights.sbomify.com/CVE-2022-25138/): Cross-site scripting in axelor:open suite (medium 5.4) - [CVE-2022-25137](https://insights.sbomify.com/CVE-2022-25137/): Command injection in totolink:t10 firmware (critical 9.8) - [CVE-2022-25136](https://insights.sbomify.com/CVE-2022-25136/): Command injection in totolink:t10 firmware (critical 9.8) - [CVE-2022-25135](https://insights.sbomify.com/CVE-2022-25135/): Command injection in totolink:t6 firmware (critical 9.8) - [CVE-2022-25134](https://insights.sbomify.com/CVE-2022-25134/): Command injection in totolink:t6 firmware (critical 9.8) - [CVE-2022-25133](https://insights.sbomify.com/CVE-2022-25133/): Command injection in totolink:t6 firmware (critical 9.8) - [CVE-2022-25132](https://insights.sbomify.com/CVE-2022-25132/): Command injection in totolink:t10 firmware (critical 9.8) - [CVE-2022-25131](https://insights.sbomify.com/CVE-2022-25131/): Command injection in totolink:t10 firmware (critical 9.8) - [CVE-2022-25130](https://insights.sbomify.com/CVE-2022-25130/): Command injection in totolink:t10 firmware (critical 9.8) - [CVE-2022-2513](https://insights.sbomify.com/CVE-2022-2513/): Information disclosure in 650 Connectivity Package (high 7.1) - [CVE-2022-25125](https://insights.sbomify.com/CVE-2022-25125/): SQL injection in mingsoft:mcms (critical 9.8) - [CVE-2022-2512](https://insights.sbomify.com/CVE-2022-2512/): Information disclosure in GitLab (medium 6.5) - [CVE-2022-25115](https://insights.sbomify.com/CVE-2022-25115/): File upload in home owners collection management system project:home owners collection management system (high 7.8) - [CVE-2022-25114](https://insights.sbomify.com/CVE-2022-25114/): Cross-site scripting in event management project:event management (medium 6.1) - [CVE-2022-2511](https://insights.sbomify.com/CVE-2022-2511/): Potential XSS in title URL parameter (medium 4.3) - [CVE-2022-25108](https://insights.sbomify.com/CVE-2022-25108/): Null dereference in foxit:pdf editor (medium 5.5) - [CVE-2022-25106](https://insights.sbomify.com/CVE-2022-25106/): Memory corruption in dlink:dir-859 a3 firmware (medium 5.5) - [CVE-2022-25104](https://insights.sbomify.com/CVE-2022-25104/): Path traversal in horizontcms project:horizontcms (high 7.5) - [CVE-2022-25101](https://insights.sbomify.com/CVE-2022-25101/): Code injection in wbce:wbce cms (high 7.8) - [CVE-2022-2510](https://insights.sbomify.com/CVE-2022-2510/): Potential XSS on Special:SearchCenter (medium 4.3) - [CVE-2022-25099](https://insights.sbomify.com/CVE-2022-25099/): Code injection in wbce:wbce cms (high 7.8) - [CVE-2022-25098](https://insights.sbomify.com/CVE-2022-25098/): Arbitrary file delete in ectouch/ectouch (critical 9.1) - [CVE-2022-25096](https://insights.sbomify.com/CVE-2022-25096/): SQL injection in home owners collection management system project:home owners collection management system (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2022/page/367/