# Vulnerabilities published in 2022


- [CVE-2022-23980](https://insights.sbomify.com/CVE-2022-23980/): WordPress Yasr – Yet Another Stars Rating plugin <= 2.9.9 - Cross-Site Scripting (XSS) vulnerability (medium 4.7)
- [CVE-2022-2398](https://insights.sbomify.com/CVE-2022-2398/): WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23979](https://insights.sbomify.com/CVE-2022-23979/): WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2022-23976](https://insights.sbomify.com/CVE-2022-23976/): Cross-site request forgery in Access Demo Importer (WordPress plugin) (high 8.1)
- [CVE-2022-23975](https://insights.sbomify.com/CVE-2022-23975/): Cross-site request forgery in Access Demo Importer (WordPress plugin) (medium 6.5)
- [CVE-2022-23974](https://insights.sbomify.com/CVE-2022-23974/): Pinot segment push endpoint has a vulnerability in unprotected environments (high 7.5)
- [CVE-2022-23973](https://insights.sbomify.com/CVE-2022-23973/): ASUS RT-AX56U - Stack overflew (high 8.8)
- [CVE-2022-23972](https://insights.sbomify.com/CVE-2022-23972/): ASUS RT-AX56U - SQL Injection (high 8.8)
- [CVE-2022-23971](https://insights.sbomify.com/CVE-2022-23971/): ASUS RT-AX56U - Path Traversal (high 8.1)
- [CVE-2022-23970](https://insights.sbomify.com/CVE-2022-23970/): ASUS RT-AX56U - Path Traversal (high 8.1)
- [CVE-2022-23968](https://insights.sbomify.com/CVE-2022-23968/): Denial of service in xerox:versalink firmware (high 7.5)
- [CVE-2022-23961](https://insights.sbomify.com/CVE-2022-23961/): In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. (medium 6.1)
- [CVE-2022-23960](https://insights.sbomify.com/CVE-2022-23960/): Information disclosure in arm:cortex-a57 firmware (medium 5.6)
- [CVE-2022-2396](https://insights.sbomify.com/CVE-2022-2396/): SourceCodester Simple e-Learning System claire_blake cross site scripting (low 3.5)
- [CVE-2022-23959](https://insights.sbomify.com/CVE-2022-23959/): Other in debian:debian linux (critical 9.1)
- [CVE-2022-23958](https://insights.sbomify.com/CVE-2022-23958/): Denial of service in HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC (medium 5.5)
- [CVE-2022-23957](https://insights.sbomify.com/CVE-2022-23957/): Denial of service in HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC (medium 5.5)
- [CVE-2022-23956](https://insights.sbomify.com/CVE-2022-23956/): Denial of service in HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC (medium 5.5)
- [CVE-2022-23955](https://insights.sbomify.com/CVE-2022-23955/): Denial of service in HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC (medium 5.5)
- [CVE-2022-23954](https://insights.sbomify.com/CVE-2022-23954/): Denial of service in HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC (medium 5.5)
- [CVE-2022-23953](https://insights.sbomify.com/CVE-2022-23953/): Denial of service in HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC (medium 5.5)
- [CVE-2022-23952](https://insights.sbomify.com/CVE-2022-23952/): Information disclosure in keylime (high 7.5)
- [CVE-2022-23951](https://insights.sbomify.com/CVE-2022-23951/): Denial of service in keylime (medium 5.5)
- [CVE-2022-23950](https://insights.sbomify.com/CVE-2022-23950/): Misconfiguration in keylime (high 7.5)
- [CVE-2022-2395](https://insights.sbomify.com/CVE-2022-2395/): weForms < 1.6.14 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23949](https://insights.sbomify.com/CVE-2022-23949/): Other in keylime (high 7.5)
- [CVE-2022-23948](https://insights.sbomify.com/CVE-2022-23948/): Information disclosure in keylime (high 7.5)
- [CVE-2022-23947](https://insights.sbomify.com/CVE-2022-23947/): Memory corruption in KiCad (high 7.8)
- [CVE-2022-23946](https://insights.sbomify.com/CVE-2022-23946/): Memory corruption in KiCad (high 7.8)
- [CVE-2022-23945](https://insights.sbomify.com/CVE-2022-23945/): Apache ShenYu missing authentication allows gateway registration (high 7.5)
- [CVE-2022-23944](https://insights.sbomify.com/CVE-2022-23944/): Apache ShenYu 2.4.1 Improper access control (critical 9.1)
- [CVE-2022-23943](https://insights.sbomify.com/CVE-2022-23943/): mod_sed: Read/write beyond bounds (critical 9.8)
- [CVE-2022-23942](https://insights.sbomify.com/CVE-2022-23942/): Apache Doris hardcoded cryptography initialization (high 7.5)
- [CVE-2022-23940](https://insights.sbomify.com/CVE-2022-23940/): Deserialization in salesagility:suitecrm (high 8.8)
- [CVE-2022-2394](https://insights.sbomify.com/CVE-2022-2394/): Sensitive Parameter Exposure in Puppet Bolt prior to 3.24 (medium 4.1)
- [CVE-2022-23937](https://insights.sbomify.com/CVE-2022-23937/): Memory corruption in windriver:vxworks (medium 5.3)
- [CVE-2022-23935](https://insights.sbomify.com/CVE-2022-23935/): Command injection in exiftool project:exiftool (high 7.8)
- [CVE-2022-23934](https://insights.sbomify.com/CVE-2022-23934/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23933](https://insights.sbomify.com/CVE-2022-23933/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23932](https://insights.sbomify.com/CVE-2022-23932/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23931](https://insights.sbomify.com/CVE-2022-23931/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23930](https://insights.sbomify.com/CVE-2022-23930/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-2393](https://insights.sbomify.com/CVE-2022-2393/): Auth bypass in pki-core (medium 5.7)
- [CVE-2022-23929](https://insights.sbomify.com/CVE-2022-23929/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23928](https://insights.sbomify.com/CVE-2022-23928/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23927](https://insights.sbomify.com/CVE-2022-23927/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23926](https://insights.sbomify.com/CVE-2022-23926/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23925](https://insights.sbomify.com/CVE-2022-23925/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23924](https://insights.sbomify.com/CVE-2022-23924/): Other in HP PC BIOS (high 8.2)
- [CVE-2022-23923](https://insights.sbomify.com/CVE-2022-23923/): Sandbox Bypass (high 8.6)
- [CVE-2022-23922](https://insights.sbomify.com/CVE-2022-23922/): WIN-911 2021 Incorrect Default Permissions (medium 5.6)
- [CVE-2022-23921](https://insights.sbomify.com/CVE-2022-23921/): ICSA-22-053-01 GE Proficy CIMPLICITY-IPM (high 7.5)
- [CVE-2022-2392](https://insights.sbomify.com/CVE-2022-2392/): Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download (medium 6.5)
- [CVE-2022-23919](https://insights.sbomify.com/CVE-2022-23919/): Memory corruption in LinkHub Mesh Wifi (high 8.8)
- [CVE-2022-23918](https://insights.sbomify.com/CVE-2022-23918/): Memory corruption in LinkHub Mesh Wifi (high 8.8)
- [CVE-2022-23916](https://insights.sbomify.com/CVE-2022-23916/): Cross-site scripting in a-blog cms (medium 6.1)
- [CVE-2022-23915](https://insights.sbomify.com/CVE-2022-23915/): Remote Code Execution (RCE) (high 7.2)
- [CVE-2022-23913](https://insights.sbomify.com/CVE-2022-23913/): Apache ActiveMQ Artemis DoS (high 7.5)
- [CVE-2022-23912](https://insights.sbomify.com/CVE-2022-23912/): AP Custom Testimonial < 1.4.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-23911](https://insights.sbomify.com/CVE-2022-23911/): AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-2391](https://insights.sbomify.com/CVE-2022-2391/): Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-23909](https://insights.sbomify.com/CVE-2022-23909/): Privilege escalation in gimmal:sherpa connector service (high 7.8)
- [CVE-2022-23907](https://insights.sbomify.com/CVE-2022-23907/): Cross-site scripting in cmsmadesimple:cms made simple (medium 6.1)
- [CVE-2022-23906](https://insights.sbomify.com/CVE-2022-23906/): File upload in cmsmadesimple:cms made simple (high 7.2)
- [CVE-2022-23904](https://insights.sbomify.com/CVE-2022-23904/): Cross-site request forgery in rainworx:auctionworx (high 8.0)
- [CVE-2022-23903](https://insights.sbomify.com/CVE-2022-23903/): Cross-site scripting in pearadmin:pear admin think (medium 5.4)
- [CVE-2022-23902](https://insights.sbomify.com/CVE-2022-23902/): SQL injection in tongda2000:tongda office anywhere (critical 9.8)
- [CVE-2022-23901](https://insights.sbomify.com/CVE-2022-23901/): Memory corruption in re2c:re2c (critical 9.8)
- [CVE-2022-23900](https://insights.sbomify.com/CVE-2022-23900/): Command injection in wavlink:wl-wn531p3 firmware (critical 9.8)
- [CVE-2022-2390](https://insights.sbomify.com/CVE-2022-2390/): Mutable pending intent in Google Play services SDK (medium 6.1)
- [CVE-2022-23899](https://insights.sbomify.com/CVE-2022-23899/): SQL injection in net.mingsoft:ms-mcms (critical 9.8)
- [CVE-2022-23898](https://insights.sbomify.com/CVE-2022-23898/): SQL injection in net.mingsoft:ms-mcms (critical 9.8)
- [CVE-2022-23896](https://insights.sbomify.com/CVE-2022-23896/): Cross-site Scripting in admidio (medium 5.4)
- [CVE-2022-2389](https://insights.sbomify.com/CVE-2022-2389/): Automations By Autonami < 2.1.2 - Subscriber+ Automation Creation (medium 4.3)
- [CVE-2022-23889](https://insights.sbomify.com/CVE-2022-23889/): Denial of service in yzmcms:yzmcms (medium 5.3)
- [CVE-2022-23888](https://insights.sbomify.com/CVE-2022-23888/): Cross-site request forgery in yzmcms:yzmcms (high 8.8)
- [CVE-2022-23887](https://insights.sbomify.com/CVE-2022-23887/): Cross-site request forgery in yzmcms:yzmcms (medium 6.5)
- [CVE-2022-23884](https://insights.sbomify.com/CVE-2022-23884/): Integer overflow in minecraft:bedrock server (critical 9.8)
- [CVE-2022-23882](https://insights.sbomify.com/CVE-2022-23882/): SQL injection in tuzicms:tuzicms (critical 9.8)
- [CVE-2022-23881](https://insights.sbomify.com/CVE-2022-23881/): Code injection in zzzcms:zzzphp (critical 9.8)
- [CVE-2022-23880](https://insights.sbomify.com/CVE-2022-23880/): File upload in taogogo:taocms (critical 9.8)
- [CVE-2022-2388](https://insights.sbomify.com/CVE-2022-2388/): WP Coder < 2.5.3 - Code Deletion via CSRF (medium 6.5)
- [CVE-2022-23878](https://insights.sbomify.com/CVE-2022-23878/): Code injection in seacms:seacms (critical 9.8)
- [CVE-2022-23873](https://insights.sbomify.com/CVE-2022-23873/): SQL injection in victor cms project:victor cms (high 8.8)
- [CVE-2022-23872](https://insights.sbomify.com/CVE-2022-23872/): Cross-site scripting in emlog:emlog (medium 4.8)
- [CVE-2022-23871](https://insights.sbomify.com/CVE-2022-23871/): Cross-site scripting in gibbonedu:gibbon (medium 5.4)
- [CVE-2022-2387](https://insights.sbomify.com/CVE-2022-2387/): Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRF (medium 4.3)
- [CVE-2022-23869](https://insights.sbomify.com/CVE-2022-23869/): Missing authorization in ruoyi:ruoyi (medium 6.5)
- [CVE-2022-23868](https://insights.sbomify.com/CVE-2022-23868/): Code injection in ruoyi:ruoyi (high 7.8)
- [CVE-2022-23865](https://insights.sbomify.com/CVE-2022-23865/): SQL injection in wecul:nyron (critical 9.8)
- [CVE-2022-23863](https://insights.sbomify.com/CVE-2022-23863/): Missing authorization in zohocorp:manageengine desktop central (medium 6.5)
- [CVE-2022-23862](https://insights.sbomify.com/CVE-2022-23862/): Missing authorization in ysoft:safeq (high 8.4)
- [CVE-2022-23861](https://insights.sbomify.com/CVE-2022-23861/): Cross-site scripting in ysoft:safeq (medium 6.1)
- [CVE-2022-2386](https://insights.sbomify.com/CVE-2022-2386/): Crowdsignal Polls & Ratings < 3.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-23858](https://insights.sbomify.com/CVE-2022-23858/): Privilege escalation in starwindsoftware:command center (high 8.8)
- [CVE-2022-23857](https://insights.sbomify.com/CVE-2022-23857/): SQL injection in github.com/navidrome/navidrome (medium 6.5)
- [CVE-2022-23856](https://insights.sbomify.com/CVE-2022-23856/): Information disclosure in saviynt:enterprise identity cloud (medium 5.3)
- [CVE-2022-23855](https://insights.sbomify.com/CVE-2022-23855/): Auth bypass in saviynt:enterprise identity cloud (critical 9.8)
- [CVE-2022-23854](https://insights.sbomify.com/CVE-2022-23854/): Path traversal in InTouch Access Anywhere (high 7.5)
- [CVE-2022-23853](https://insights.sbomify.com/CVE-2022-23853/): Code injection in kde:kate (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/378/