# Vulnerabilities published in 2022


- [CVE-2022-22807](https://insights.sbomify.com/CVE-2022-22807/): Other in EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) (high 7.4)
- [CVE-2022-22806](https://insights.sbomify.com/CVE-2022-22806/): Auth bypass in SmartConnect (critical 9.8)
- [CVE-2022-22805](https://insights.sbomify.com/CVE-2022-22805/): Memory corruption in SmartConnect (critical 9.8)
- [CVE-2022-22804](https://insights.sbomify.com/CVE-2022-22804/): Cross-site scripting in EcoStruxure Power Monitoring Expert (Versions 2020 and prior) (medium 5.4)
- [CVE-2022-2280](https://insights.sbomify.com/CVE-2022-2280/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 6.5)
- [CVE-2022-22798](https://insights.sbomify.com/CVE-2022-22798/): Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control (medium 6.8)
- [CVE-2022-22797](https://insights.sbomify.com/CVE-2022-22797/): Sysaid – sysaid Open Redirect (medium 4.6)
- [CVE-2022-22796](https://insights.sbomify.com/CVE-2022-22796/): Sysaid – Sysaid System Takeover (high 7.0)
- [CVE-2022-22795](https://insights.sbomify.com/CVE-2022-22795/): Signiant - Manager+Agents XML External Entity (XXE) (medium 6.8)
- [CVE-2022-22794](https://insights.sbomify.com/CVE-2022-22794/): Cybonet - PineApp Mail Relay Unauthenticated Sql Injection (medium 6.8)
- [CVE-2022-22793](https://insights.sbomify.com/CVE-2022-22793/): Cybonet - PineApp Mail Relay Local File Inclusion (medium 6.1)
- [CVE-2022-22792](https://insights.sbomify.com/CVE-2022-22792/): MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters (medium 6.6)
- [CVE-2022-22791](https://insights.sbomify.com/CVE-2022-22791/): SYNEL - eharmony Authenticated Blind & Stored XSS (medium 6.6)
- [CVE-2022-22790](https://insights.sbomify.com/CVE-2022-22790/): SYNEL - eharmony Directory Traversal (medium 5.6)
- [CVE-2022-2279](https://insights.sbomify.com/CVE-2022-2279/): NULL Pointer Dereference in bfabiszewski/libmobi (medium 6.6)
- [CVE-2022-22789](https://insights.sbomify.com/CVE-2022-22789/): Charactell - FormStorm Enterprise Account Take Over (medium 6.1)
- [CVE-2022-22788](https://insights.sbomify.com/CVE-2022-22788/): DLL injection in Zoom Opener installer for Zoom and Zoom Rooms clients (high 7.1)
- [CVE-2022-22787](https://insights.sbomify.com/CVE-2022-22787/): Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings (medium 5.9)
- [CVE-2022-22786](https://insights.sbomify.com/CVE-2022-22786/): Update package downgrade in Zoom Client for Meetings for Windows (high 7.5)
- [CVE-2022-22785](https://insights.sbomify.com/CVE-2022-22785/): Improperly constrained session cookies in Zoom Client for Meetings (medium 5.9)
- [CVE-2022-22784](https://insights.sbomify.com/CVE-2022-22784/): Improper XML Parsing in Zoom Client for Meetings (high 8.1)
- [CVE-2022-22783](https://insights.sbomify.com/CVE-2022-22783/): Process memory exposure in Zoom on-premise Meeting services (medium 6.5)
- [CVE-2022-22782](https://insights.sbomify.com/CVE-2022-22782/): Local privilege escalation in Windows Zoom Clients (high 7.9)
- [CVE-2022-22781](https://insights.sbomify.com/CVE-2022-22781/): Update package downgrade in Zoom Client for Meetings for MacOS (high 7.5)
- [CVE-2022-22780](https://insights.sbomify.com/CVE-2022-22780/): Zoom Chat Susceptible to Zip Bombing (medium 4.7)
- [CVE-2022-2278](https://insights.sbomify.com/CVE-2022-2278/): Featured Image from URL < 4.0.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-22779](https://insights.sbomify.com/CVE-2022-22779/): Retained exploded messages in Keybase clients for macOS and Windows (low 3.7)
- [CVE-2022-22778](https://insights.sbomify.com/CVE-2022-22778/): TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability (high 8.8)
- [CVE-2022-22777](https://insights.sbomify.com/CVE-2022-22777/): TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability (medium 6.1)
- [CVE-2022-22776](https://insights.sbomify.com/CVE-2022-22776/): TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting Vulnerability (high 8.0)
- [CVE-2022-22775](https://insights.sbomify.com/CVE-2022-22775/): TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability (high 8.1)
- [CVE-2022-22774](https://insights.sbomify.com/CVE-2022-22774/): TIBCO Managed File Transfer Command Center XXE Vulnerability (high 8.6)
- [CVE-2022-22773](https://insights.sbomify.com/CVE-2022-22773/): TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability (high 7.7)
- [CVE-2022-22772](https://insights.sbomify.com/CVE-2022-22772/): TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability (high 8.5)
- [CVE-2022-22771](https://insights.sbomify.com/CVE-2022-22771/): TIBCO JasperReports Library Directory Traversal Vulnerability (critical 9.9)
- [CVE-2022-22770](https://insights.sbomify.com/CVE-2022-22770/): TIBCO AuditSafe API Authentication vulnerability (critical 9.8)
- [CVE-2022-2277](https://insights.sbomify.com/CVE-2022-2277/): Denial of service in MicroSCADA X SYS600 (high 7.5)
- [CVE-2022-22769](https://insights.sbomify.com/CVE-2022-22769/): TIBCO EBX vulnerabilities (high 8.0)
- [CVE-2022-22767](https://insights.sbomify.com/CVE-2022-22767/): BD Pyxis™ Products – Default Credentials (high 8.8)
- [CVE-2022-22766](https://insights.sbomify.com/CVE-2022-22766/): BD Pyxis Products - Hardcoded Credentials (high 7.0)
- [CVE-2022-22765](https://insights.sbomify.com/CVE-2022-22765/): BD Viper LT System - Hardcoded Credentials (high 8.0)
- [CVE-2022-22764](https://insights.sbomify.com/CVE-2022-22764/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-22763](https://insights.sbomify.com/CVE-2022-22763/): Race condition in Firefox (high 8.8)
- [CVE-2022-22762](https://insights.sbomify.com/CVE-2022-22762/): Other in Firefox (medium 4.3)
- [CVE-2022-22761](https://insights.sbomify.com/CVE-2022-22761/): Security feature bypass in Firefox (high 8.8)
- [CVE-2022-22760](https://insights.sbomify.com/CVE-2022-22760/): Information disclosure in Firefox (medium 6.5)
- [CVE-2022-2276](https://insights.sbomify.com/CVE-2022-2276/): WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion (medium 4.3)
- [CVE-2022-22759](https://insights.sbomify.com/CVE-2022-22759/): Security feature bypass in Firefox (critical 9.6)
- [CVE-2022-22758](https://insights.sbomify.com/CVE-2022-22758/): Other in Firefox (high 8.8)
- [CVE-2022-22757](https://insights.sbomify.com/CVE-2022-22757/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-22756](https://insights.sbomify.com/CVE-2022-22756/): Code injection in Firefox (high 8.8)
- [CVE-2022-22755](https://insights.sbomify.com/CVE-2022-22755/): Security feature bypass in Firefox (high 8.8)
- [CVE-2022-22754](https://insights.sbomify.com/CVE-2022-22754/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-22753](https://insights.sbomify.com/CVE-2022-22753/): Race condition in Firefox (high 7.1)
- [CVE-2022-22752](https://insights.sbomify.com/CVE-2022-22752/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-22751](https://insights.sbomify.com/CVE-2022-22751/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-22750](https://insights.sbomify.com/CVE-2022-22750/): Privilege escalation in Firefox (medium 6.5)
- [CVE-2022-2275](https://insights.sbomify.com/CVE-2022-2275/): WP Edit Menu <= 1.5.0 - Arbitrary Post Deletion via CSRF (medium 4.3)
- [CVE-2022-22749](https://insights.sbomify.com/CVE-2022-22749/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2022-22748](https://insights.sbomify.com/CVE-2022-22748/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-22747](https://insights.sbomify.com/CVE-2022-22747/): Denial of service in Firefox (medium 6.5)
- [CVE-2022-22746](https://insights.sbomify.com/CVE-2022-22746/): Race condition in Firefox (medium 5.9)
- [CVE-2022-22745](https://insights.sbomify.com/CVE-2022-22745/): Information disclosure in Firefox (medium 6.5)
- [CVE-2022-22744](https://insights.sbomify.com/CVE-2022-22744/): Command injection in Firefox (high 8.8)
- [CVE-2022-22743](https://insights.sbomify.com/CVE-2022-22743/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2022-22742](https://insights.sbomify.com/CVE-2022-22742/): Memory corruption in Firefox (medium 6.5)
- [CVE-2022-22741](https://insights.sbomify.com/CVE-2022-22741/): Other in Firefox (high 7.5)
- [CVE-2022-22740](https://insights.sbomify.com/CVE-2022-22740/): Use after free in Firefox (high 8.8)
- [CVE-2022-2274](https://insights.sbomify.com/CVE-2022-2274/): RSA implementation bug in AVX512IFMA instructions (critical 9.8)
- [CVE-2022-22739](https://insights.sbomify.com/CVE-2022-22739/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-22738](https://insights.sbomify.com/CVE-2022-22738/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-22737](https://insights.sbomify.com/CVE-2022-22737/): Use after free in Firefox (high 7.5)
- [CVE-2022-22736](https://insights.sbomify.com/CVE-2022-22736/): Privilege escalation in Firefox (high 7.0)
- [CVE-2022-22735](https://insights.sbomify.com/CVE-2022-22735/): Simple Quotation <= 1.3.2 - Subscriber+ SQL injection (high 8.8)
- [CVE-2022-22734](https://insights.sbomify.com/CVE-2022-22734/): Simple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2022-22733](https://insights.sbomify.com/CVE-2022-22733/): Access-Token in ElasticJob UI causes password disclosure (medium 6.5)
- [CVE-2022-22732](https://insights.sbomify.com/CVE-2022-22732/): Information disclosure in EcoStruxure Power Commission (low 3.9)
- [CVE-2022-22731](https://insights.sbomify.com/CVE-2022-22731/): Path traversal in EcoStruxure Power Commission (medium 6.5)
- [CVE-2022-22730](https://insights.sbomify.com/CVE-2022-22730/): Auth bypass in Intel(R) Edge Insights for Industrial software (critical 9.8)
- [CVE-2022-2273](https://insights.sbomify.com/CVE-2022-2273/): Simple Membership < 4.1.3 - Membership Privilege Escalation (high 8.8)
- [CVE-2022-22729](https://insights.sbomify.com/CVE-2022-22729/): Auth bypass in CENTUM CS 3000 (high 8.8)
- [CVE-2022-22728](https://insights.sbomify.com/CVE-2022-22728/): libapreq2 multipart form parse memory corruption (high 7.5)
- [CVE-2022-22727](https://insights.sbomify.com/CVE-2022-22727/): Other in EcoStruxure Power Monitoring Expert (Versions 2020 and prior) (high 8.8)
- [CVE-2022-22726](https://insights.sbomify.com/CVE-2022-22726/): Path traversal in EcoStruxure Power Monitoring Expert (Versions 2020 and prior) (medium 6.5)
- [CVE-2022-22725](https://insights.sbomify.com/CVE-2022-22725/): Memory corruption in Easergy P3 (All versions prior to V30.205) (high 8.8)
- [CVE-2022-22724](https://insights.sbomify.com/CVE-2022-22724/): Denial of service in Modicon M340 CPUs: BMXP34 (All Versions) (high 7.5)
- [CVE-2022-22723](https://insights.sbomify.com/CVE-2022-22723/): Memory corruption in Easergy P5 (All firmware versions prior to V01.401.101) (high 8.8)
- [CVE-2022-22722](https://insights.sbomify.com/CVE-2022-22722/): Hardcoded credentials in Easergy P5 (high 7.5)
- [CVE-2022-22721](https://insights.sbomify.com/CVE-2022-22721/): core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (critical 9.1)
- [CVE-2022-22720](https://insights.sbomify.com/CVE-2022-22720/): HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier (critical 9.8)
- [CVE-2022-2272](https://insights.sbomify.com/CVE-2022-2272/): SQL injection in PACS Server (critical 9.8)
- [CVE-2022-22719](https://insights.sbomify.com/CVE-2022-22719/): mod_lua Use of uninitialized value of in r:parsebody (high 7.5)
- [CVE-2022-22718](https://insights.sbomify.com/CVE-2022-22718/): Microsoft Windows Print Spooler Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2022-22717](https://insights.sbomify.com/CVE-2022-22717/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-22716](https://insights.sbomify.com/CVE-2022-22716/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-22715](https://insights.sbomify.com/CVE-2022-22715/): Named Pipe File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-22713](https://insights.sbomify.com/CVE-2022-22713/): Windows Hyper-V Denial of Service Vulnerability (medium 5.6)
- [CVE-2022-22712](https://insights.sbomify.com/CVE-2022-22712/): Windows Hyper-V Denial of Service Vulnerability (medium 5.6)
- [CVE-2022-22711](https://insights.sbomify.com/CVE-2022-22711/): Windows BitLocker Information Disclosure Vulnerability (medium 5.7)
- [CVE-2022-22710](https://insights.sbomify.com/CVE-2022-22710/): Windows Common Log File System Driver Denial of Service Vulnerability (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/388/