# Vulnerabilities published in 2022


- [CVE-2022-1806](https://insights.sbomify.com/CVE-2022-1806/): Cross-site Scripting (XSS) - Reflected in rtxteam/rtx (medium 6.3)
- [CVE-2022-1805](https://insights.sbomify.com/CVE-2022-1805/): Security feature bypass in Tera2 Zero Client (high 8.1)
- [CVE-2022-1804](https://insights.sbomify.com/CVE-2022-1804/): Accountsservice incorrectly drops privileges (medium 5.5)
- [CVE-2022-1803](https://insights.sbomify.com/CVE-2022-1803/): Improper Restriction of Rendered UI Layers or Frames in polonel/trudesk (high 8.4)
- [CVE-2022-1802](https://insights.sbomify.com/CVE-2022-1802/): Code injection in Firefox (high 8.8)
- [CVE-2022-1801](https://insights.sbomify.com/CVE-2022-1801/): Very Simple Contact Form < 11.6 - Captcha bypass (high 7.5)
- [CVE-2022-1800](https://insights.sbomify.com/CVE-2022-1800/): Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-1799](https://insights.sbomify.com/CVE-2022-1799/): Incorrect signature verification on Google play-services-basement in Google Play SDK (medium 5.7)
- [CVE-2022-1798](https://insights.sbomify.com/CVE-2022-1798/): Path Traversal vulnerability in Kubevirt (high 8.7)
- [CVE-2022-1797](https://insights.sbomify.com/CVE-2022-1797/): Rockwell Automation Logix Controllers Uncontrolled Resource Consumption (medium 6.8)
- [CVE-2022-1796](https://insights.sbomify.com/CVE-2022-1796/): Use After Free in vim/vim (medium 6.6)
- [CVE-2022-1795](https://insights.sbomify.com/CVE-2022-1795/): Use After Free in gpac/gpac (high 7.3)
- [CVE-2022-1794](https://insights.sbomify.com/CVE-2022-1794/): Plaintext Storage of a password in CODESYS V3 OPC DA Server (medium 5.5)
- [CVE-2022-1793](https://insights.sbomify.com/CVE-2022-1793/): Private Files <= 0.40 - Protection Disabling via CSRF (medium 4.3)
- [CVE-2022-1792](https://insights.sbomify.com/CVE-2022-1792/): Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1791](https://insights.sbomify.com/CVE-2022-1791/): One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF (high 8.1)
- [CVE-2022-1790](https://insights.sbomify.com/CVE-2022-1790/): New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1789](https://insights.sbomify.com/CVE-2022-1789/): Null dereference in kernel (medium 6.8)
- [CVE-2022-1788](https://insights.sbomify.com/CVE-2022-1788/): Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF (medium 6.5)
- [CVE-2022-1787](https://insights.sbomify.com/CVE-2022-1787/): Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1786](https://insights.sbomify.com/CVE-2022-1786/): Use after free in kernel (high 7.8)
- [CVE-2022-1785](https://insights.sbomify.com/CVE-2022-1785/): Out-of-bounds Write in vim/vim (high 7.3)
- [CVE-2022-1784](https://insights.sbomify.com/CVE-2022-1784/): Server-Side Request Forgery (SSRF) in jgraph/drawio (high 7.5)
- [CVE-2022-1783](https://insights.sbomify.com/CVE-2022-1783/): Business logic in GitLab (low 2.7)
- [CVE-2022-1782](https://insights.sbomify.com/CVE-2022-1782/): Cross-site Scripting (XSS) - Generic in erudika/para (critical 9.4)
- [CVE-2022-1781](https://insights.sbomify.com/CVE-2022-1781/): postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1780](https://insights.sbomify.com/CVE-2022-1780/): LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1779](https://insights.sbomify.com/CVE-2022-1779/): Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRF (high 8.1)
- [CVE-2022-1778](https://insights.sbomify.com/CVE-2022-1778/): Memory corruption in MicroSCADA X SYS600 (high 7.5)
- [CVE-2022-1777](https://insights.sbomify.com/CVE-2022-1777/): Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls (high 8.8)
- [CVE-2022-1776](https://insights.sbomify.com/CVE-2022-1776/): Icegram < 2.1.8 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1775](https://insights.sbomify.com/CVE-2022-1775/): Weak Password Requirements in polonel/trudesk (high 8.4)
- [CVE-2022-1774](https://insights.sbomify.com/CVE-2022-1774/): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (high 8.2)
- [CVE-2022-1773](https://insights.sbomify.com/CVE-2022-1773/): WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1772](https://insights.sbomify.com/CVE-2022-1772/): Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1771](https://insights.sbomify.com/CVE-2022-1771/): Uncontrolled Recursion in vim/vim (medium 5.5)
- [CVE-2022-1770](https://insights.sbomify.com/CVE-2022-1770/): Improper Privilege Management in polonel/trudesk (critical 9.9)
- [CVE-2022-1769](https://insights.sbomify.com/CVE-2022-1769/): Buffer Over-read in vim/vim (medium 6.6)
- [CVE-2022-1768](https://insights.sbomify.com/CVE-2022-1768/): RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-1767](https://insights.sbomify.com/CVE-2022-1767/): Server-Side Request Forgery (SSRF) in jgraph/drawio (high 7.5)
- [CVE-2022-1766](https://insights.sbomify.com/CVE-2022-1766/): Information disclosure in Anchore Enterprise (high 7.5)
- [CVE-2022-1765](https://insights.sbomify.com/CVE-2022-1765/): Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF (high 8.8)
- [CVE-2022-1764](https://insights.sbomify.com/CVE-2022-1764/): WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1763](https://insights.sbomify.com/CVE-2022-1763/): Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1762](https://insights.sbomify.com/CVE-2022-1762/): iQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing (high 7.5)
- [CVE-2022-1761](https://insights.sbomify.com/CVE-2022-1761/): Peter’s Collaboration E-mails <= 2.2.0 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1760](https://insights.sbomify.com/CVE-2022-1760/): Core Control <= 1.2.1 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1759](https://insights.sbomify.com/CVE-2022-1759/): RB Internal Links <= 2.0.16 - Stored Cross-Site Scripting via CSRF (medium 5.4)
- [CVE-2022-1758](https://insights.sbomify.com/CVE-2022-1758/): Genki Pre-Publish Reminder <= 1.4.1 - Stored XSS & RCE via CSRF (high 8.8)
- [CVE-2022-1757](https://insights.sbomify.com/CVE-2022-1757/): Pagebar < 2.70 - Arbitrary Settings Update via CSRF to Stored XSS (medium 5.4)
- [CVE-2022-1756](https://insights.sbomify.com/CVE-2022-1756/): Newsletter < 7.4.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1755](https://insights.sbomify.com/CVE-2022-1755/): SVG Support < 2.5 - Author+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1754](https://insights.sbomify.com/CVE-2022-1754/): Integer Overflow or Wraparound in polonel/trudesk (high 8.4)
- [CVE-2022-1753](https://insights.sbomify.com/CVE-2022-1753/): WoWonder Group requests.php access control (medium 5.4)
- [CVE-2022-1752](https://insights.sbomify.com/CVE-2022-1752/): Unrestricted Upload of File with Dangerous Type in polonel/trudesk (critical 9.0)
- [CVE-2022-1751](https://insights.sbomify.com/CVE-2022-1751/): Skitter Slideshow <= 2.5.2 - Unauthenticated Server-Side Request Forgery (high 7.2)
- [CVE-2022-1750](https://insights.sbomify.com/CVE-2022-1750/): Sticky Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-1749](https://insights.sbomify.com/CVE-2022-1749/): WPMK Ajax Finder <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting (high 8.8)
- [CVE-2022-1748](https://insights.sbomify.com/CVE-2022-1748/): Softing Secure Integration Server NULL Pointer Dereference (high 7.5)
- [CVE-2022-1747](https://insights.sbomify.com/CVE-2022-1747/): Auth bypass in ImageCast X application (medium 4.6)
- [CVE-2022-1746](https://insights.sbomify.com/CVE-2022-1746/): 2.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266 (high 7.6)
- [CVE-2022-1745](https://insights.sbomify.com/CVE-2022-1745/): 2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290 (medium 6.8)
- [CVE-2022-1744](https://insights.sbomify.com/CVE-2022-1744/): 2.2.6 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250 (medium 6.8)
- [CVE-2022-1743](https://insights.sbomify.com/CVE-2022-1743/): 2.2.5 PATH TRAVERSAL: '../FILEDIR' CWE-24 (medium 6.8)
- [CVE-2022-1742](https://insights.sbomify.com/CVE-2022-1742/): 2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424 (medium 6.8)
- [CVE-2022-1741](https://insights.sbomify.com/CVE-2022-1741/): 2.2.3 HIDDEN FUNCTIONALITY CWE-912 (medium 6.8)
- [CVE-2022-1740](https://insights.sbomify.com/CVE-2022-1740/): 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283 (medium 4.6)
- [CVE-2022-1739](https://insights.sbomify.com/CVE-2022-1739/): 2.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347 (medium 6.8)
- [CVE-2022-1738](https://insights.sbomify.com/CVE-2022-1738/): Fuji Electric D300win Out-of-bounds Read (high 8.7)
- [CVE-2022-1737](https://insights.sbomify.com/CVE-2022-1737/): Pyramid Solutions EtherNet/IP Adapter Development Kit Out-of-bound Write (critical 9.8)
- [CVE-2022-1736](https://insights.sbomify.com/CVE-2022-1736/): Misconfiguration in Ubuntu's gnome-control-center (critical 9.8)
- [CVE-2022-1735](https://insights.sbomify.com/CVE-2022-1735/): Classic Buffer Overflow in vim/vim (medium 6.6)
- [CVE-2022-1734](https://insights.sbomify.com/CVE-2022-1734/): Use after free in kernel (high 7.0)
- [CVE-2022-1733](https://insights.sbomify.com/CVE-2022-1733/): Heap-based Buffer Overflow in vim/vim (medium 6.6)
- [CVE-2022-1732](https://insights.sbomify.com/CVE-2022-1732/): Rename wp-login.php <= 2.6.0 - Secret URL Update via CSRF (medium 6.5)
- [CVE-2022-1731](https://insights.sbomify.com/CVE-2022-1731/): SQL injection in Metasonic Doc WebClient (critical 9.8)
- [CVE-2022-1730](https://insights.sbomify.com/CVE-2022-1730/): Cross-site Scripting (XSS) - Stored in jgraph/drawio (medium 6.3)
- [CVE-2022-1729](https://insights.sbomify.com/CVE-2022-1729/): Race condition in linux kernel (high 7.0)
- [CVE-2022-1728](https://insights.sbomify.com/CVE-2022-1728/): Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk (high 7.6)
- [CVE-2022-1727](https://insights.sbomify.com/CVE-2022-1727/): Improper Input Validation in jgraph/drawio (high 8.3)
- [CVE-2022-1726](https://insights.sbomify.com/CVE-2022-1726/): Cross-site Scripting in bootstrap-table (medium 6.8)
- [CVE-2022-1725](https://insights.sbomify.com/CVE-2022-1725/): NULL Pointer Dereference in vim/vim (medium 6.6)
- [CVE-2022-1724](https://insights.sbomify.com/CVE-2022-1724/): Simple Membership < 4.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1723](https://insights.sbomify.com/CVE-2022-1723/): Server-Side Request Forgery (SSRF) in jgraph/drawio (high 7.5)
- [CVE-2022-1722](https://insights.sbomify.com/CVE-2022-1722/): SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio (high 7.5)
- [CVE-2022-1721](https://insights.sbomify.com/CVE-2022-1721/): Path Traversal in WellKnownServlet in jgraph/drawio (high 7.5)
- [CVE-2022-1720](https://insights.sbomify.com/CVE-2022-1720/): Buffer Over-read in function grab_file_name in vim/vim (medium 6.6)
- [CVE-2022-1719](https://insights.sbomify.com/CVE-2022-1719/): Reflected XSS on ticket filter function in polonel/trudesk (medium 5.5)
- [CVE-2022-1718](https://insights.sbomify.com/CVE-2022-1718/): Denial of service in polonel/trudesk (high 7.2)
- [CVE-2022-1717](https://insights.sbomify.com/CVE-2022-1717/): Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-1716](https://insights.sbomify.com/CVE-2022-1716/): Security feature bypass in Keep My Notes (medium 4.6)
- [CVE-2022-1715](https://insights.sbomify.com/CVE-2022-1715/): Account Takeover in neorazorx/facturascripts (critical 9.8)
- [CVE-2022-1714](https://insights.sbomify.com/CVE-2022-1714/): Out-of-bounds Read in radareorg/radare2 (high 7.9)
- [CVE-2022-1713](https://insights.sbomify.com/CVE-2022-1713/): SSRF on /proxy in jgraph/drawio (high 7.5)
- [CVE-2022-1712](https://insights.sbomify.com/CVE-2022-1712/): LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1711](https://insights.sbomify.com/CVE-2022-1711/): Server-Side Request Forgery (SSRF) in jgraph/drawio (high 7.5)
- [CVE-2022-1710](https://insights.sbomify.com/CVE-2022-1710/): Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1709](https://insights.sbomify.com/CVE-2022-1709/): Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF (medium 4.3)
- [CVE-2022-1708](https://insights.sbomify.com/CVE-2022-1708/): Node DOS by way of memory exhaustion through ExecSync request in CRI-O (high 7.5)
- [CVE-2022-1707](https://insights.sbomify.com/CVE-2022-1707/): Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/417/