# Vulnerabilities published in 2022


- [CVE-2022-1912](https://insights.sbomify.com/CVE-2022-1912/): Button Widget Smartsoft <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-1911](https://insights.sbomify.com/CVE-2022-1911/): Information disclosure in M-Files Server (medium 5.3)
- [CVE-2022-1910](https://insights.sbomify.com/CVE-2022-1910/): Shortcodes and extra features for Phlox theme < 2.9.8 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1909](https://insights.sbomify.com/CVE-2022-1909/): Cross-site Scripting (XSS) - Stored in causefx/organizr (critical 9.0)
- [CVE-2022-1908](https://insights.sbomify.com/CVE-2022-1908/): Buffer Over-read in bfabiszewski/libmobi (low 3.6)
- [CVE-2022-1907](https://insights.sbomify.com/CVE-2022-1907/): Buffer Over-read in bfabiszewski/libmobi (low 3.6)
- [CVE-2022-1906](https://insights.sbomify.com/CVE-2022-1906/): Copyright Proof <= 4.16 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1905](https://insights.sbomify.com/CVE-2022-1905/): Events Made Easy < 2.2.81 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-1904](https://insights.sbomify.com/CVE-2022-1904/): Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting (medium 6.1)
- [CVE-2022-1903](https://insights.sbomify.com/CVE-2022-1903/): ARMember < 3.4.8 - Unauthenticated Admin Account Takeover (high 8.1)
- [CVE-2022-1902](https://insights.sbomify.com/CVE-2022-1902/): Information disclosure in Red Hat Advanced Cluster Security for Kubernetes (high 8.8)
- [CVE-2022-1901](https://insights.sbomify.com/CVE-2022-1901/): Information disclosure in Octopus Server (medium 5.3)
- [CVE-2022-1900](https://insights.sbomify.com/CVE-2022-1900/): Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-1899](https://insights.sbomify.com/CVE-2022-1899/): Out-of-bounds Read in radareorg/radare2 (high 7.7)
- [CVE-2022-1898](https://insights.sbomify.com/CVE-2022-1898/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-1897](https://insights.sbomify.com/CVE-2022-1897/): Out-of-bounds Write in vim/vim (high 7.8)
- [CVE-2022-1896](https://insights.sbomify.com/CVE-2022-1896/): underConstruction < 1.21 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1895](https://insights.sbomify.com/CVE-2022-1895/): underConstruction < 1.20 - Construction Mode Deactivation via CSRF (medium 4.3)
- [CVE-2022-1894](https://insights.sbomify.com/CVE-2022-1894/): Popup Builder < 4.1.11 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1893](https://insights.sbomify.com/CVE-2022-1893/): Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk (medium 4.6)
- [CVE-2022-1892](https://insights.sbomify.com/CVE-2022-1892/): Memory corruption in BIOS (medium 6.7)
- [CVE-2022-1891](https://insights.sbomify.com/CVE-2022-1891/): Memory corruption in BIOS (medium 6.7)
- [CVE-2022-1890](https://insights.sbomify.com/CVE-2022-1890/): Memory corruption in BIOS (medium 6.7)
- [CVE-2022-1889](https://insights.sbomify.com/CVE-2022-1889/): Newsletter < 7.4.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1888](https://insights.sbomify.com/CVE-2022-1888/): Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC Loader (high 7.8)
- [CVE-2022-1887](https://insights.sbomify.com/CVE-2022-1887/): SQL injection in Firefox for iOS (critical 9.8)
- [CVE-2022-1886](https://insights.sbomify.com/CVE-2022-1886/): Heap-based Buffer Overflow in vim/vim (high 7.1)
- [CVE-2022-1885](https://insights.sbomify.com/CVE-2022-1885/): Cimy Header Image Rotator <= 6.1.1 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1884](https://insights.sbomify.com/CVE-2022-1884/): Remote Command Execution in gogs/gogs (critical 10.0)
- [CVE-2022-1883](https://insights.sbomify.com/CVE-2022-1883/): SQL Injection in camptocamp/terraboard (critical 9.6)
- [CVE-2022-1882](https://insights.sbomify.com/CVE-2022-1882/): Use after free in kernel (high 7.8)
- [CVE-2022-1881](https://insights.sbomify.com/CVE-2022-1881/): Missing authorization in Octopus Server (medium 5.3)
- [CVE-2022-1876](https://insights.sbomify.com/CVE-2022-1876/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1875](https://insights.sbomify.com/CVE-2022-1875/): Information disclosure in Chrome (medium 4.3)
- [CVE-2022-1874](https://insights.sbomify.com/CVE-2022-1874/): Security feature bypass in Chrome (high 8.8)
- [CVE-2022-1873](https://insights.sbomify.com/CVE-2022-1873/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-1872](https://insights.sbomify.com/CVE-2022-1872/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-1871](https://insights.sbomify.com/CVE-2022-1871/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-1870](https://insights.sbomify.com/CVE-2022-1870/): Use after free in Chrome (high 8.8)
- [CVE-2022-1869](https://insights.sbomify.com/CVE-2022-1869/): Memory corruption in Chrome (medium 6.5)
- [CVE-2022-1868](https://insights.sbomify.com/CVE-2022-1868/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-1867](https://insights.sbomify.com/CVE-2022-1867/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-1866](https://insights.sbomify.com/CVE-2022-1866/): Use after free in Chrome (high 8.8)
- [CVE-2022-1865](https://insights.sbomify.com/CVE-2022-1865/): Use after free in Chrome (high 8.8)
- [CVE-2022-1864](https://insights.sbomify.com/CVE-2022-1864/): Use after free in Chrome (high 8.8)
- [CVE-2022-1863](https://insights.sbomify.com/CVE-2022-1863/): Use after free in Chrome (high 8.8)
- [CVE-2022-1862](https://insights.sbomify.com/CVE-2022-1862/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-1861](https://insights.sbomify.com/CVE-2022-1861/): Use after free in Chrome (high 8.8)
- [CVE-2022-1860](https://insights.sbomify.com/CVE-2022-1860/): Use after free in Chrome (high 8.8)
- [CVE-2022-1859](https://insights.sbomify.com/CVE-2022-1859/): Use after free in Chrome (high 8.8)
- [CVE-2022-1858](https://insights.sbomify.com/CVE-2022-1858/): Memory corruption in Chrome (medium 6.5)
- [CVE-2022-1857](https://insights.sbomify.com/CVE-2022-1857/): Security feature bypass in Chrome (high 8.8)
- [CVE-2022-1856](https://insights.sbomify.com/CVE-2022-1856/): Use after free in Chrome (high 8.8)
- [CVE-2022-1855](https://insights.sbomify.com/CVE-2022-1855/): Use after free in Chrome (high 8.8)
- [CVE-2022-1854](https://insights.sbomify.com/CVE-2022-1854/): Use after free in Chrome (high 8.8)
- [CVE-2022-1853](https://insights.sbomify.com/CVE-2022-1853/): Use after free in Chrome (critical 9.6)
- [CVE-2022-1852](https://insights.sbomify.com/CVE-2022-1852/): Null dereference in kernel (medium 5.5)
- [CVE-2022-1851](https://insights.sbomify.com/CVE-2022-1851/): Out-of-bounds Read in vim/vim (high 7.8)
- [CVE-2022-1850](https://insights.sbomify.com/CVE-2022-1850/): Path Traversal in filegator/filegator (medium 5.4)
- [CVE-2022-1849](https://insights.sbomify.com/CVE-2022-1849/): Session Fixation in filegator/filegator (medium 4.3)
- [CVE-2022-1848](https://insights.sbomify.com/CVE-2022-1848/): Business Logic Errors in erudika/para (critical 9.0)
- [CVE-2022-1847](https://insights.sbomify.com/CVE-2022-1847/): Rotating Posts <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF (medium 4.3)
- [CVE-2022-1846](https://insights.sbomify.com/CVE-2022-1846/): Tiny Contact Form <= 0.7 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1845](https://insights.sbomify.com/CVE-2022-1845/): WP Post Styling < 1.3.1 - Multiple CSRF (medium 4.3)
- [CVE-2022-1844](https://insights.sbomify.com/CVE-2022-1844/): WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF (medium 4.3)
- [CVE-2022-1843](https://insights.sbomify.com/CVE-2022-1843/): MailPress <= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRF (medium 6.5)
- [CVE-2022-1842](https://insights.sbomify.com/CVE-2022-1842/): OpenBook Book Data <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF (medium 4.3)
- [CVE-2022-1841](https://insights.sbomify.com/CVE-2022-1841/): Out-of-bound write in tcp_flags (high 7.2)
- [CVE-2022-1840](https://insights.sbomify.com/CVE-2022-1840/): Home Clean Services Management System cross site scripting (low 2.4)
- [CVE-2022-1839](https://insights.sbomify.com/CVE-2022-1839/): Home Clean Services Management System login.php sql injection (medium 6.3)
- [CVE-2022-1838](https://insights.sbomify.com/CVE-2022-1838/): Home Clean Services Management System login.php sql injection (medium 4.7)
- [CVE-2022-1837](https://insights.sbomify.com/CVE-2022-1837/): Home Clean Services Management System unrestricted upload (medium 4.7)
- [CVE-2022-1834](https://insights.sbomify.com/CVE-2022-1834/): Security feature bypass in Thunderbird (medium 6.5)
- [CVE-2022-1833](https://insights.sbomify.com/CVE-2022-1833/): Privilege escalation in AMQ Broker Operator (high 8.8)
- [CVE-2022-1832](https://insights.sbomify.com/CVE-2022-1832/): CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1831](https://insights.sbomify.com/CVE-2022-1831/): WPlite <= 1.3.1 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1830](https://insights.sbomify.com/CVE-2022-1830/): Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF (medium 6.5)
- [CVE-2022-1829](https://insights.sbomify.com/CVE-2022-1829/): Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF (medium 6.5)
- [CVE-2022-1828](https://insights.sbomify.com/CVE-2022-1828/): PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1827](https://insights.sbomify.com/CVE-2022-1827/): PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1826](https://insights.sbomify.com/CVE-2022-1826/): Cross-Linker <= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRF (medium 6.5)
- [CVE-2022-1825](https://insights.sbomify.com/CVE-2022-1825/): Cross-site Scripting (XSS) - Reflected in collectiveaccess/providence (medium 5.5)
- [CVE-2022-1824](https://insights.sbomify.com/CVE-2022-1824/): McAfee MCPR privilege escalation (high 7.9)
- [CVE-2022-1823](https://insights.sbomify.com/CVE-2022-1823/): McAfee MCPR privilege escalation (high 7.9)
- [CVE-2022-1822](https://insights.sbomify.com/CVE-2022-1822/): Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1821](https://insights.sbomify.com/CVE-2022-1821/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-1820](https://insights.sbomify.com/CVE-2022-1820/): Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1819](https://insights.sbomify.com/CVE-2022-1819/): Student Information System Student Roll Module cross site scripting (low 2.4)
- [CVE-2022-1818](https://insights.sbomify.com/CVE-2022-1818/): Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF (medium 5.4)
- [CVE-2022-1817](https://insights.sbomify.com/CVE-2022-1817/): Badminton Center Management System Userlist Module cross site scripting (low 3.5)
- [CVE-2022-1816](https://insights.sbomify.com/CVE-2022-1816/): Zoo Management System Content Module cross site scripting (low 3.5)
- [CVE-2022-1815](https://insights.sbomify.com/CVE-2022-1815/): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (medium 5.3)
- [CVE-2022-1814](https://insights.sbomify.com/CVE-2022-1814/): WP Admin Style <= 0.1.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1813](https://insights.sbomify.com/CVE-2022-1813/): OS Command Injection in yogeshojha/rengine (high 8.3)
- [CVE-2022-1812](https://insights.sbomify.com/CVE-2022-1812/): Integer Overflow or Wraparound in publify/publify (high 7.6)
- [CVE-2022-1811](https://insights.sbomify.com/CVE-2022-1811/): Unrestricted Upload of File with Dangerous Type in publify/publify (critical 9.1)
- [CVE-2022-1810](https://insights.sbomify.com/CVE-2022-1810/): Authorization Bypass Through User-Controlled Key in publify/publify (critical 9.9)
- [CVE-2022-1809](https://insights.sbomify.com/CVE-2022-1809/): Access of Uninitialized Pointer in radareorg/radare2 (high 7.4)
- [CVE-2022-1808](https://insights.sbomify.com/CVE-2022-1808/): Execution with Unnecessary Privileges in polonel/trudesk (high 8.8)
- [CVE-2022-1807](https://insights.sbomify.com/CVE-2022-1807/): SQL injection in Sophos Firewall (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/416/