# Vulnerabilities published in 2022


- [CVE-2022-1706](https://insights.sbomify.com/CVE-2022-1706/): Ignition config accessible to unprivileged software on VMware (medium 6.5)
- [CVE-2022-1705](https://insights.sbomify.com/CVE-2022-1705/): Improper sanitization of Transfer-Encoding headers in net/http (medium 6.5)
- [CVE-2022-1704](https://insights.sbomify.com/CVE-2022-1704/): Inductive Automation Ignition (high 7.6)
- [CVE-2022-1703](https://insights.sbomify.com/CVE-2022-1703/): Command injection in SMA100 (high 8.8)
- [CVE-2022-1702](https://insights.sbomify.com/CVE-2022-1702/): Open redirect in SonicWall SMA1000 (medium 6.1)
- [CVE-2022-1701](https://insights.sbomify.com/CVE-2022-1701/): Hardcoded credentials in SonicWall SMA1000 (high 7.5)
- [CVE-2022-1700](https://insights.sbomify.com/CVE-2022-1700/): XML external entity in Cloud Security Gateway (high 7.5)
- [CVE-2022-1699](https://insights.sbomify.com/CVE-2022-1699/): Uncontrolled Resource Consumption in causefx/organizr (critical 9.9)
- [CVE-2022-1698](https://insights.sbomify.com/CVE-2022-1698/): Allowing long password leads to denial of service in causefx/organizr (critical 9.9)
- [CVE-2022-1697](https://insights.sbomify.com/CVE-2022-1697/): Privilege escalation in Okta Active Directory Agent (low 3.9)
- [CVE-2022-1695](https://insights.sbomify.com/CVE-2022-1695/): WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRF (medium 4.3)
- [CVE-2022-1694](https://insights.sbomify.com/CVE-2022-1694/): Useful Banner Manager <= 1.6.1 - Modify banners via CSRF (medium 6.5)
- [CVE-2022-1692](https://insights.sbomify.com/CVE-2022-1692/): CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-1691](https://insights.sbomify.com/CVE-2022-1691/): Realty Workstation < 1.0.15 - Agent SQLi (medium 4.9)
- [CVE-2022-1690](https://insights.sbomify.com/CVE-2022-1690/): Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions (low 2.7)
- [CVE-2022-1689](https://insights.sbomify.com/CVE-2022-1689/): Note Press <= 0.1.10 - Admin+ SQLi via Update (low 2.7)
- [CVE-2022-1688](https://insights.sbomify.com/CVE-2022-1688/): Note Press <= 0.1.10 - Admin+ SQLi via id (low 2.7)
- [CVE-2022-1687](https://insights.sbomify.com/CVE-2022-1687/): Logo Slider <= 1.4.8 - Admin+ SQLi (low 2.7)
- [CVE-2022-1686](https://insights.sbomify.com/CVE-2022-1686/): Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id (low 2.7)
- [CVE-2022-1685](https://insights.sbomify.com/CVE-2022-1685/): Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby (medium 4.9)
- [CVE-2022-1684](https://insights.sbomify.com/CVE-2022-1684/): Cube Slider <= 1.2 - Admin+ SQLi (low 2.7)
- [CVE-2022-1683](https://insights.sbomify.com/CVE-2022-1683/): amtyThumb <= 4.2.0 - Subscriber+ SQLi (high 8.8)
- [CVE-2022-1682](https://insights.sbomify.com/CVE-2022-1682/): Reflected Xss using url based payload in neorazorx/facturascripts (critical 9.4)
- [CVE-2022-1681](https://insights.sbomify.com/CVE-2022-1681/): Authentication Bypass Using an Alternate Path or Channel in requarks/wiki (high 7.2)
- [CVE-2022-1680](https://insights.sbomify.com/CVE-2022-1680/): Business logic in GitLab (critical 9.9)
- [CVE-2022-1679](https://insights.sbomify.com/CVE-2022-1679/): Use after free in Kernel (high 7.8)
- [CVE-2022-1678](https://insights.sbomify.com/CVE-2022-1678/): Denial of service in kernel (medium 5.9)
- [CVE-2022-1677](https://insights.sbomify.com/CVE-2022-1677/): Other in Openshift (medium 6.3)
- [CVE-2022-1674](https://insights.sbomify.com/CVE-2022-1674/): NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim (medium 6.6)
- [CVE-2022-1673](https://insights.sbomify.com/CVE-2022-1673/): WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page (medium 6.1)
- [CVE-2022-1672](https://insights.sbomify.com/CVE-2022-1672/): Insights from Google PageSpeed < 4.0.7 - Multiple CSRF (high 8.8)
- [CVE-2022-1671](https://insights.sbomify.com/CVE-2022-1671/): Null dereference in Kernel (high 7.1)
- [CVE-2022-1670](https://insights.sbomify.com/CVE-2022-1670/): Business logic in Octopus Server (high 7.5)
- [CVE-2022-1669](https://insights.sbomify.com/CVE-2022-1669/): Circutor COMPACT DC-S BASIC (medium 6.8)
- [CVE-2022-1668](https://insights.sbomify.com/CVE-2022-1668/): Secheron SEPCOS Control and Protection Relay (critical 9.8)
- [CVE-2022-1667](https://insights.sbomify.com/CVE-2022-1667/): Secheron SEPCOS Control and Protection Relay (high 7.5)
- [CVE-2022-1666](https://insights.sbomify.com/CVE-2022-1666/): Secheron SEPCOS Control and Protection Relay (medium 6.5)
- [CVE-2022-1665](https://insights.sbomify.com/CVE-2022-1665/): Security feature bypass in Red Hat Enterprise Linux (high 8.2)
- [CVE-2022-1664](https://insights.sbomify.com/CVE-2022-1664/): directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar (critical 9.8)
- [CVE-2022-1663](https://insights.sbomify.com/CVE-2022-1663/): Stop Spam Comments <= 0.2.1.2 - Access Token Bypass (medium 6.5)
- [CVE-2022-1662](https://insights.sbomify.com/CVE-2022-1662/): Information disclosure in convert2rhel (medium 5.5)
- [CVE-2022-1661](https://insights.sbomify.com/CVE-2022-1661/): Keysight N6854A Geolocation server and N6841A RF Sensor software (high 7.5)
- [CVE-2022-1660](https://insights.sbomify.com/CVE-2022-1660/): Keysight N6854A Geolocation server and N6841A RF Sensor software (critical 9.8)
- [CVE-2022-1659](https://insights.sbomify.com/CVE-2022-1659/): JupiterX Core <= 2.0.6 - Information Disclosure, Modification, and Denial of Service (medium 5.4)
- [CVE-2022-1658](https://insights.sbomify.com/CVE-2022-1658/): Jupiter Theme <= 6.10.1 - Authenticated Arbitrary Plugin Deletion (medium 5.4)
- [CVE-2022-1657](https://insights.sbomify.com/CVE-2022-1657/): JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File Inclusion (high 8.8)
- [CVE-2022-1656](https://insights.sbomify.com/CVE-2022-1656/): Missing authorization in Jupiter X (medium 5.4)
- [CVE-2022-1655](https://insights.sbomify.com/CVE-2022-1655/): Misconfiguration in OpenStack (medium 6.5)
- [CVE-2022-1654](https://insights.sbomify.com/CVE-2022-1654/): Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation (high 8.8)
- [CVE-2022-1653](https://insights.sbomify.com/CVE-2022-1653/): Social Share Buttons by Supsystic < 2.2.4 - Multiple CSRF (medium 4.3)
- [CVE-2022-1652](https://insights.sbomify.com/CVE-2022-1652/): Use after free in kernel (high 7.8)
- [CVE-2022-1651](https://insights.sbomify.com/CVE-2022-1651/): Denial of service in Kernel (high 7.1)
- [CVE-2022-1650](https://insights.sbomify.com/CVE-2022-1650/): Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource (high 8.1)
- [CVE-2022-1649](https://insights.sbomify.com/CVE-2022-1649/): Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in radareorg/radare2 (high 7.6)
- [CVE-2022-1648](https://insights.sbomify.com/CVE-2022-1648/): Relative Path Traversal to Remote Code Execution in File Manager (medium 5.7)
- [CVE-2022-1647](https://insights.sbomify.com/CVE-2022-1647/): FormCraft Basic < 1.2.6 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1646](https://insights.sbomify.com/CVE-2022-1646/): Simple Real Estate Pack <= 1.4.8 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1645](https://insights.sbomify.com/CVE-2022-1645/): Amazon Link <= 3.2.10 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1644](https://insights.sbomify.com/CVE-2022-1644/): Call&Book Mobile Bar <= 1.2.2 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1643](https://insights.sbomify.com/CVE-2022-1643/): Birthdays Widget <= 1.7.18 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1642](https://insights.sbomify.com/CVE-2022-1642/): Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder (high 7.5)
- [CVE-2022-1641](https://insights.sbomify.com/CVE-2022-1641/): Use after free in Chrome (high 8.8)
- [CVE-2022-1640](https://insights.sbomify.com/CVE-2022-1640/): Use after free in Chrome (high 8.8)
- [CVE-2022-1639](https://insights.sbomify.com/CVE-2022-1639/): Use after free in Chrome (high 8.8)
- [CVE-2022-1638](https://insights.sbomify.com/CVE-2022-1638/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1637](https://insights.sbomify.com/CVE-2022-1637/): Information disclosure in Chrome (medium 4.3)
- [CVE-2022-1636](https://insights.sbomify.com/CVE-2022-1636/): Use after free in Chrome (high 8.8)
- [CVE-2022-1635](https://insights.sbomify.com/CVE-2022-1635/): Use after free in Chrome (high 8.8)
- [CVE-2022-1634](https://insights.sbomify.com/CVE-2022-1634/): Use after free in Chrome (high 8.8)
- [CVE-2022-1633](https://insights.sbomify.com/CVE-2022-1633/): Use after free in Chrome (high 8.8)
- [CVE-2022-1632](https://insights.sbomify.com/CVE-2022-1632/): Security feature bypass in Openshift (medium 6.5)
- [CVE-2022-1631](https://insights.sbomify.com/CVE-2022-1631/): Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber (medium 6.8)
- [CVE-2022-1630](https://insights.sbomify.com/CVE-2022-1630/): WP-Email < 2.69.0 - Log Deletion via CSRF (medium 6.5)
- [CVE-2022-1629](https://insights.sbomify.com/CVE-2022-1629/): Buffer Over-read in function find_next_quote in vim/vim (medium 6.6)
- [CVE-2022-1628](https://insights.sbomify.com/CVE-2022-1628/): Simple SEO <= 1.7.91 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2022-1627](https://insights.sbomify.com/CVE-2022-1627/): My Private Site < 3.0.8 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1626](https://insights.sbomify.com/CVE-2022-1626/): Sharebar <= 1.4.1 - Arbitrary Settings Update to Stored XSS via CSRF (medium 5.4)
- [CVE-2022-1625](https://insights.sbomify.com/CVE-2022-1625/): New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF (medium 4.3)
- [CVE-2022-1624](https://insights.sbomify.com/CVE-2022-1624/): Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1623](https://insights.sbomify.com/CVE-2022-1623/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-1622](https://insights.sbomify.com/CVE-2022-1622/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-1621](https://insights.sbomify.com/CVE-2022-1621/): Heap buffer overflow in vim_strncpy find_word in vim/vim (high 7.3)
- [CVE-2022-1620](https://insights.sbomify.com/CVE-2022-1620/): NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim (medium 6.6)
- [CVE-2022-1619](https://insights.sbomify.com/CVE-2022-1619/): Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim (medium 6.1)
- [CVE-2022-1618](https://insights.sbomify.com/CVE-2022-1618/): Coru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRF (medium 6.1)
- [CVE-2022-1617](https://insights.sbomify.com/CVE-2022-1617/): WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF (medium 6.1)
- [CVE-2022-1616](https://insights.sbomify.com/CVE-2022-1616/): Use after free in append_command in vim/vim (high 7.3)
- [CVE-2022-1615](https://insights.sbomify.com/CVE-2022-1615/): Weak cryptography in Samba (medium 5.5)
- [CVE-2022-1614](https://insights.sbomify.com/CVE-2022-1614/): WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing (high 7.5)
- [CVE-2022-1613](https://insights.sbomify.com/CVE-2022-1613/): Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing (medium 5.3)
- [CVE-2022-1612](https://insights.sbomify.com/CVE-2022-1612/): Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1611](https://insights.sbomify.com/CVE-2022-1611/): Bulk Page Creator < 1.1.4 - Arbitrary Page Creation via CSRF (high 8.8)
- [CVE-2022-1610](https://insights.sbomify.com/CVE-2022-1610/): Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1609](https://insights.sbomify.com/CVE-2022-1609/): The School Management < 9.9.7 - Unauthenticated RCE via REST api (critical 9.8)
- [CVE-2022-1608](https://insights.sbomify.com/CVE-2022-1608/): OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1607](https://insights.sbomify.com/CVE-2022-1607/): Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller (medium 4.6)
- [CVE-2022-1606](https://insights.sbomify.com/CVE-2022-1606/): Incorrect privilege assignment in M-Files Server (low 2.4)
- [CVE-2022-1605](https://insights.sbomify.com/CVE-2022-1605/): Email Users <= 4.8.8 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-1604](https://insights.sbomify.com/CVE-2022-1604/): MailerLite < 1.5.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1603](https://insights.sbomify.com/CVE-2022-1603/): Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/418/