# Vulnerabilities published in 2022


- [CVE-2022-1602](https://insights.sbomify.com/CVE-2022-1602/): Other in HP ThinPro OS (medium 5.5)
- [CVE-2022-1601](https://insights.sbomify.com/CVE-2022-1601/): User Access Manager < 2.2.18 - IP Spoofing (medium 5.3)
- [CVE-2022-1600](https://insights.sbomify.com/CVE-2022-1600/): YOP Poll < 6.4.3 - IP Spoofing (medium 5.3)
- [CVE-2022-1599](https://insights.sbomify.com/CVE-2022-1599/): Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF (medium 6.5)
- [CVE-2022-1598](https://insights.sbomify.com/CVE-2022-1598/): WPQA < 5.5 - Unauthenticated Private Message Disclosure (medium 5.3)
- [CVE-2022-1597](https://insights.sbomify.com/CVE-2022-1597/): WPQA < 5.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1596](https://insights.sbomify.com/CVE-2022-1596/): ABB Relion REX640 Insufficient file access control (medium 6.5)
- [CVE-2022-1595](https://insights.sbomify.com/CVE-2022-1595/): HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure (medium 5.3)
- [CVE-2022-1594](https://insights.sbomify.com/CVE-2022-1594/): HC Custom WP-Admin URL <= 1.4 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1593](https://insights.sbomify.com/CVE-2022-1593/): Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF (medium 6.1)
- [CVE-2022-1592](https://insights.sbomify.com/CVE-2022-1592/): Server-Side Request Forgery in scout in clinical-genomics/scout (critical 9.4)
- [CVE-2022-1591](https://insights.sbomify.com/CVE-2022-1591/): WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1590](https://insights.sbomify.com/CVE-2022-1590/): Bludit New Content Module new-content cross site scripting (low 3.5)
- [CVE-2022-1589](https://insights.sbomify.com/CVE-2022-1589/): Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update (high 7.5)
- [CVE-2022-1587](https://insights.sbomify.com/CVE-2022-1587/): Memory corruption in pcre2 (critical 9.1)
- [CVE-2022-1586](https://insights.sbomify.com/CVE-2022-1586/): Memory corruption in pcre2 (critical 9.1)
- [CVE-2022-1585](https://insights.sbomify.com/CVE-2022-1585/): Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download (high 7.5)
- [CVE-2022-1584](https://insights.sbomify.com/CVE-2022-1584/): Reflected XSS in microweber/microweber (medium 6.3)
- [CVE-2022-1583](https://insights.sbomify.com/CVE-2022-1583/): External Links in New Window / New Tab < 1.43 - Tabnabbing (medium 6.5)
- [CVE-2022-1582](https://insights.sbomify.com/CVE-2022-1582/): External Links in New Window / New Tab < 1.43 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2022-1581](https://insights.sbomify.com/CVE-2022-1581/): WP-Polls < 2.76.0 - IP Validation Bypass (medium 5.3)
- [CVE-2022-1580](https://insights.sbomify.com/CVE-2022-1580/): Site Offline < 1.5.3 - Access Bypass (medium 4.3)
- [CVE-2022-1579](https://insights.sbomify.com/CVE-2022-1579/): Login Block IPs <= 1.0.0 - IP Spoofing Bypass (high 7.5)
- [CVE-2022-1578](https://insights.sbomify.com/CVE-2022-1578/): My wpdb < 2.5 - Arbitrary SQL Query via CSRF (high 8.8)
- [CVE-2022-1577](https://insights.sbomify.com/CVE-2022-1577/): Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF (medium 5.4)
- [CVE-2022-1576](https://insights.sbomify.com/CVE-2022-1576/): WP Maintenance Mode & Coming Soon < 2.4.5 - Subscribed Users Deletion via CSRF (medium 6.5)
- [CVE-2022-1575](https://insights.sbomify.com/CVE-2022-1575/): Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio (critical 9.6)
- [CVE-2022-1574](https://insights.sbomify.com/CVE-2022-1574/): HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2022-1573](https://insights.sbomify.com/CVE-2022-1573/): HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRF (medium 4.3)
- [CVE-2022-1572](https://insights.sbomify.com/CVE-2022-1572/): HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion (high 8.1)
- [CVE-2022-1571](https://insights.sbomify.com/CVE-2022-1571/): Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts (critical 9.9)
- [CVE-2022-1570](https://insights.sbomify.com/CVE-2022-1570/): Files Download Delay < 1.0.7 - Subscriber+ Settings Reset (medium 6.5)
- [CVE-2022-1569](https://insights.sbomify.com/CVE-2022-1569/): WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1568](https://insights.sbomify.com/CVE-2022-1568/): Team Members < 5.1.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1567](https://insights.sbomify.com/CVE-2022-1567/): WP JS <= 2.0.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1566](https://insights.sbomify.com/CVE-2022-1566/): Quotes llama < 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1565](https://insights.sbomify.com/CVE-2022-1565/): Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload (high 7.2)
- [CVE-2022-1564](https://insights.sbomify.com/CVE-2022-1564/): Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1563](https://insights.sbomify.com/CVE-2022-1563/): WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure (medium 5.3)
- [CVE-2022-1562](https://insights.sbomify.com/CVE-2022-1562/): Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG (medium 5.4)
- [CVE-2022-1561](https://insights.sbomify.com/CVE-2022-1561/): Crafted backend URLs in Lura Project (medium 4.0)
- [CVE-2022-1560](https://insights.sbomify.com/CVE-2022-1560/): Amministrazione Aperta < 3.8 - Admin+ LFI (medium 6.5)
- [CVE-2022-1559](https://insights.sbomify.com/CVE-2022-1559/): Clipr <= 1.2.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1558](https://insights.sbomify.com/CVE-2022-1558/): Curtain <= 1.0.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1557](https://insights.sbomify.com/CVE-2022-1557/): ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1556](https://insights.sbomify.com/CVE-2022-1556/): StaffList < 3.1.5 - Admin+ SQLi (critical 9.8)
- [CVE-2022-1555](https://insights.sbomify.com/CVE-2022-1555/): DOM XSS in microweber ver 1.2.15 in microweber/microweber (high 8.8)
- [CVE-2022-1554](https://insights.sbomify.com/CVE-2022-1554/): Path Traversal due to `send_file` call in clinical-genomics/scout (medium 6.8)
- [CVE-2022-1553](https://insights.sbomify.com/CVE-2022-1553/): Leaking password protected articles content due to improper access control in publify/publify (high 8.8)
- [CVE-2022-1552](https://insights.sbomify.com/CVE-2022-1552/): Privilege escalation in postgresql (high 8.8)
- [CVE-2022-1551](https://insights.sbomify.com/CVE-2022-1551/): SP Project & Document Manager < 4.58 - Sensitive File Disclosure (medium 6.5)
- [CVE-2022-1549](https://insights.sbomify.com/CVE-2022-1549/): WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1548](https://insights.sbomify.com/CVE-2022-1548/): Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins. (low 3.7)
- [CVE-2022-1547](https://insights.sbomify.com/CVE-2022-1547/): Check & Log email < 1.0.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1546](https://insights.sbomify.com/CVE-2022-1546/): WooCommerce - Product Importer <= 1.5.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1545](https://insights.sbomify.com/CVE-2022-1545/): Information disclosure in GitLab (medium 4.3)
- [CVE-2022-1544](https://insights.sbomify.com/CVE-2022-1544/): Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers (high 8.0)
- [CVE-2022-1543](https://insights.sbomify.com/CVE-2022-1543/): Improper handling of Length parameter in erudika/scoold (critical 9.3)
- [CVE-2022-1542](https://insights.sbomify.com/CVE-2022-1542/): HPB Dashboard <= 1.3.1 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1541](https://insights.sbomify.com/CVE-2022-1541/): Video Slider - Slider Carousel < 1.4.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1540](https://insights.sbomify.com/CVE-2022-1540/): PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2022-1539](https://insights.sbomify.com/CVE-2022-1539/): Exports and Reports < 0.9.2 - Contributor+ CSV Injection (high 8.8)
- [CVE-2022-1538](https://insights.sbomify.com/CVE-2022-1538/): Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2022-1537](https://insights.sbomify.com/CVE-2022-1537/): Race Condition in Grunt (high 7.8)
- [CVE-2022-1536](https://insights.sbomify.com/CVE-2022-1536/): automad Dashboard cross site scripting (low 3.5)
- [CVE-2022-1534](https://insights.sbomify.com/CVE-2022-1534/): Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobi (medium 6.6)
- [CVE-2022-1533](https://insights.sbomify.com/CVE-2022-1533/): Buffer Over-read in bfabiszewski/libmobi (medium 6.6)
- [CVE-2022-1532](https://insights.sbomify.com/CVE-2022-1532/): Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1531](https://insights.sbomify.com/CVE-2022-1531/): SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in rtxteam/rtx (critical 10.0)
- [CVE-2022-1530](https://insights.sbomify.com/CVE-2022-1530/): Cross-site Scripting (XSS) in livehelperchat/livehelperchat (low 3.8)
- [CVE-2022-1529](https://insights.sbomify.com/CVE-2022-1529/): Code injection in Firefox (high 8.8)
- [CVE-2022-1528](https://insights.sbomify.com/CVE-2022-1528/): VikBooking < 1.5.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1527](https://insights.sbomify.com/CVE-2022-1527/): WP 2FA < 2.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1526](https://insights.sbomify.com/CVE-2022-1526/): Emlog Pro POST Parameter cross site scripting (low 3.5)
- [CVE-2022-1525](https://insights.sbomify.com/CVE-2022-1525/): Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side Security (critical 9.1)
- [CVE-2022-1524](https://insights.sbomify.com/CVE-2022-1524/): 3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319 (high 7.4)
- [CVE-2022-1523](https://insights.sbomify.com/CVE-2022-1523/): Fuji Electric D300win Write-what-where condition (medium 6.1)
- [CVE-2022-1522](https://insights.sbomify.com/CVE-2022-1522/): Cognex 3D-A1000 Dimensioning System Improper Output Neutralization for Logs (medium 5.3)
- [CVE-2022-1521](https://insights.sbomify.com/CVE-2022-1521/): 3.2.4 IMPROPER ACCESS CONTROL CWE-284 (critical 9.1)
- [CVE-2022-1520](https://insights.sbomify.com/CVE-2022-1520/): Security feature bypass in Thunderbird (medium 4.3)
- [CVE-2022-1519](https://insights.sbomify.com/CVE-2022-1519/): File upload in MiSeq Dx (critical 10.0)
- [CVE-2022-1518](https://insights.sbomify.com/CVE-2022-1518/): 3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22 (critical 10.0)
- [CVE-2022-1517](https://insights.sbomify.com/CVE-2022-1517/): 3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250 (critical 10.0)
- [CVE-2022-1516](https://insights.sbomify.com/CVE-2022-1516/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-1515](https://insights.sbomify.com/CVE-2022-1515/): Denial of service in matio (medium 5.5)
- [CVE-2022-1514](https://insights.sbomify.com/CVE-2022-1514/): Stored XSS via upload plugin functionality in zip format in neorazorx/facturascripts (critical 9.0)
- [CVE-2022-1513](https://insights.sbomify.com/CVE-2022-1513/): Command injection in PCManager (high 7.3)
- [CVE-2022-1512](https://insights.sbomify.com/CVE-2022-1512/): ScrollReveal.js Effects <= 1.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1511](https://insights.sbomify.com/CVE-2022-1511/): Missing Authorization in snipe/snipe-it (medium 6.5)
- [CVE-2022-1510](https://insights.sbomify.com/CVE-2022-1510/): Denial of service in GitLab (medium 6.5)
- [CVE-2022-1509](https://insights.sbomify.com/CVE-2022-1509/): Command Injection Vulnerability in hestiacp/hestiacp (critical 9.9)
- [CVE-2022-1508](https://insights.sbomify.com/CVE-2022-1508/): Memory corruption in Kernel (medium 6.1)
- [CVE-2022-1507](https://insights.sbomify.com/CVE-2022-1507/): Null dereference in hpjansson/chafa (medium 5.5)
- [CVE-2022-1506](https://insights.sbomify.com/CVE-2022-1506/): WP Born Babies <= 1.0 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1505](https://insights.sbomify.com/CVE-2022-1505/): RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-1504](https://insights.sbomify.com/CVE-2022-1504/): XSS in /demo/module/?module=HERE in microweber/microweber (medium 6.3)
- [CVE-2022-1503](https://insights.sbomify.com/CVE-2022-1503/): GetSimple CMS Content Module edit.php cross site scripting (low 3.5)
- [CVE-2022-1502](https://insights.sbomify.com/CVE-2022-1502/): Missing authorization in Octopus Server (medium 4.3)
- [CVE-2022-1501](https://insights.sbomify.com/CVE-2022-1501/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-1500](https://insights.sbomify.com/CVE-2022-1500/): Security feature bypass in Chrome (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/419/