# Vulnerabilities published in 2022


- [CVE-2022-1499](https://insights.sbomify.com/CVE-2022-1499/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2022-1498](https://insights.sbomify.com/CVE-2022-1498/): Information disclosure in Chrome (medium 4.3)
- [CVE-2022-1497](https://insights.sbomify.com/CVE-2022-1497/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-1496](https://insights.sbomify.com/CVE-2022-1496/): Use after free in Chrome (high 8.8)
- [CVE-2022-1495](https://insights.sbomify.com/CVE-2022-1495/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-1494](https://insights.sbomify.com/CVE-2022-1494/): Security feature bypass in Chrome (medium 6.1)
- [CVE-2022-1493](https://insights.sbomify.com/CVE-2022-1493/): Use after free in Chrome (high 8.8)
- [CVE-2022-1492](https://insights.sbomify.com/CVE-2022-1492/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2022-1491](https://insights.sbomify.com/CVE-2022-1491/): Use after free in Chrome (high 8.8)
- [CVE-2022-1490](https://insights.sbomify.com/CVE-2022-1490/): Use after free in Chrome (high 8.8)
- [CVE-2022-1489](https://insights.sbomify.com/CVE-2022-1489/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1488](https://insights.sbomify.com/CVE-2022-1488/): Information disclosure in Chrome (medium 4.3)
- [CVE-2022-1487](https://insights.sbomify.com/CVE-2022-1487/): Use after free in Chrome (high 7.5)
- [CVE-2022-1486](https://insights.sbomify.com/CVE-2022-1486/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1485](https://insights.sbomify.com/CVE-2022-1485/): Use after free in Chrome (high 7.5)
- [CVE-2022-1484](https://insights.sbomify.com/CVE-2022-1484/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1483](https://insights.sbomify.com/CVE-2022-1483/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1482](https://insights.sbomify.com/CVE-2022-1482/): Memory corruption in Chrome (medium 6.5)
- [CVE-2022-1481](https://insights.sbomify.com/CVE-2022-1481/): Use after free in Chrome (high 8.8)
- [CVE-2022-1479](https://insights.sbomify.com/CVE-2022-1479/): Use after free in Chrome (high 8.8)
- [CVE-2022-1478](https://insights.sbomify.com/CVE-2022-1478/): Use after free in Chrome (high 8.8)
- [CVE-2022-1477](https://insights.sbomify.com/CVE-2022-1477/): Use after free in Chrome (high 8.8)
- [CVE-2022-1476](https://insights.sbomify.com/CVE-2022-1476/): All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts (medium 6.6)
- [CVE-2022-1475](https://insights.sbomify.com/CVE-2022-1475/): Integer overflow in FFmpeg (medium 5.5)
- [CVE-2022-1474](https://insights.sbomify.com/CVE-2022-1474/): WP Event Manager < 3.1.28 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1473](https://insights.sbomify.com/CVE-2022-1473/): Resource leakage when decoding certificates and keys (high 7.5)
- [CVE-2022-1472](https://insights.sbomify.com/CVE-2022-1472/): Better Find and Replace < 1.3.6 - Admin+ SQLi (high 7.2)
- [CVE-2022-1471](https://insights.sbomify.com/CVE-2022-1471/): Remote Code execution in SnakeYAML (high 8.3)
- [CVE-2022-1470](https://insights.sbomify.com/CVE-2022-1470/): Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1469](https://insights.sbomify.com/CVE-2022-1469/): FiboSearch < 1.18.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1468](https://insights.sbomify.com/CVE-2022-1468/): Denial of service in BIG-IP (medium 4.3)
- [CVE-2022-1467](https://insights.sbomify.com/CVE-2022-1467/): AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere (high 7.4)
- [CVE-2022-1466](https://insights.sbomify.com/CVE-2022-1466/): Improper authorization in Keycloak (medium 6.5)
- [CVE-2022-1465](https://insights.sbomify.com/CVE-2022-1465/): WPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1464](https://insights.sbomify.com/CVE-2022-1464/): Stored xss bug in gogs/gogs (high 7.3)
- [CVE-2022-1463](https://insights.sbomify.com/CVE-2022-1463/): Booking Calendar <= 9.1 - PHP Object Injection via Shortcode (high 8.8)
- [CVE-2022-1462](https://insights.sbomify.com/CVE-2022-1462/): Race condition in kernel (medium 6.3)
- [CVE-2022-1461](https://insights.sbomify.com/CVE-2022-1461/): Non Privilege User can Enable or Disable Registered in openemr/openemr (high 8.1)
- [CVE-2022-1460](https://insights.sbomify.com/CVE-2022-1460/): Missing authorization in GitLab (medium 6.1)
- [CVE-2022-1459](https://insights.sbomify.com/CVE-2022-1459/): Non-Privilege User Can View Patient’s Disclosures in openemr/openemr (high 8.3)
- [CVE-2022-1458](https://insights.sbomify.com/CVE-2022-1458/): Stored XSS Leads To Session Hijacking in openemr/openemr (high 7.3)
- [CVE-2022-1457](https://insights.sbomify.com/CVE-2022-1457/): Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts (critical 9.0)
- [CVE-2022-1456](https://insights.sbomify.com/CVE-2022-1456/): Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1455](https://insights.sbomify.com/CVE-2022-1455/): Call Now Button < 1.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1453](https://insights.sbomify.com/CVE-2022-1453/): RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-1452](https://insights.sbomify.com/CVE-2022-1452/): Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in radareorg/radare2 (high 7.1)
- [CVE-2022-1451](https://insights.sbomify.com/CVE-2022-1451/): Out-of-bounds Read in r_bin_java_constant_value_attr_new function in radareorg/radare2 (high 7.1)
- [CVE-2022-1445](https://insights.sbomify.com/CVE-2022-1445/): Stored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-it (critical 9.0)
- [CVE-2022-1444](https://insights.sbomify.com/CVE-2022-1444/): heap-use-after-free in radareorg/radare2 (high 7.5)
- [CVE-2022-1442](https://insights.sbomify.com/CVE-2022-1442/): Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure (high 7.5)
- [CVE-2022-1441](https://insights.sbomify.com/CVE-2022-1441/): Memory corruption in gpac (high 7.8)
- [CVE-2022-1440](https://insights.sbomify.com/CVE-2022-1440/): Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface (critical 9.8)
- [CVE-2022-1439](https://insights.sbomify.com/CVE-2022-1439/): Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber (medium 6.3)
- [CVE-2022-1438](https://insights.sbomify.com/CVE-2022-1438/): Keycloak: xss on impersonation under specific circumstances (medium 6.4)
- [CVE-2022-1437](https://insights.sbomify.com/CVE-2022-1437/): Heap-based Buffer Overflow in radareorg/radare2 (medium 5.3)
- [CVE-2022-1436](https://insights.sbomify.com/CVE-2022-1436/): WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting (medium 6.1)
- [CVE-2022-1435](https://insights.sbomify.com/CVE-2022-1435/): WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1434](https://insights.sbomify.com/CVE-2022-1434/): Incorrect MAC key used in the RC4-MD5 ciphersuite (medium 5.9)
- [CVE-2022-1433](https://insights.sbomify.com/CVE-2022-1433/): Cross-site scripting in GitLab (low 2.6)
- [CVE-2022-1432](https://insights.sbomify.com/CVE-2022-1432/): Cross-site Scripting (XSS) - Generic in octoprint/octoprint (high 7.5)
- [CVE-2022-1431](https://insights.sbomify.com/CVE-2022-1431/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-1430](https://insights.sbomify.com/CVE-2022-1430/): Cross-site Scripting (XSS) - DOM in octoprint/octoprint (high 7.5)
- [CVE-2022-1429](https://insights.sbomify.com/CVE-2022-1429/): SQL injection in GridHelperService.php in pimcore/pimcore (high 7.2)
- [CVE-2022-1428](https://insights.sbomify.com/CVE-2022-1428/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-1427](https://insights.sbomify.com/CVE-2022-1427/): Out-of-bounds Read in mrb_obj_is_kind_of in in mruby/mruby (high 7.7)
- [CVE-2022-1426](https://insights.sbomify.com/CVE-2022-1426/): Auth bypass in GitLab (low 2.0)
- [CVE-2022-1425](https://insights.sbomify.com/CVE-2022-1425/): WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR (medium 4.3)
- [CVE-2022-1424](https://insights.sbomify.com/CVE-2022-1424/): Ask Me < 6.8.2 - Multiple CSRF in AJAX Actions (medium 6.5)
- [CVE-2022-1423](https://insights.sbomify.com/CVE-2022-1423/): Missing authorization in GitLab (high 7.1)
- [CVE-2022-1422](https://insights.sbomify.com/CVE-2022-1422/): Discy < 5.2 - Restore Default Settings via CSRF (medium 6.5)
- [CVE-2022-1421](https://insights.sbomify.com/CVE-2022-1421/): Discy < 5.2 - Settings Update via CSRF (medium 4.3)
- [CVE-2022-1420](https://insights.sbomify.com/CVE-2022-1420/): Use of Out-of-range Pointer Offset in vim/vim (medium 6.8)
- [CVE-2022-1419](https://insights.sbomify.com/CVE-2022-1419/): Use after free in kernel (high 7.8)
- [CVE-2022-1418](https://insights.sbomify.com/CVE-2022-1418/): Social Stickers <= 2.2.9 - Stored Cross-Site Scripting via CSRF (medium 6.1)
- [CVE-2022-1417](https://insights.sbomify.com/CVE-2022-1417/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-1416](https://insights.sbomify.com/CVE-2022-1416/): Cross-site scripting in GitLab (medium 4.3)
- [CVE-2022-1415](https://insights.sbomify.com/CVE-2022-1415/): Drools: unsafe data deserialization in streamutils (high 8.1)
- [CVE-2022-1414](https://insights.sbomify.com/CVE-2022-1414/): Cross-site scripting in 3scale-amp-system (high 8.8)
- [CVE-2022-1413](https://insights.sbomify.com/CVE-2022-1413/): Information disclosure in GitLab (medium 5.4)
- [CVE-2022-1412](https://insights.sbomify.com/CVE-2022-1412/): Log WP_Mail <= 0.1 - Email Logs Publicly Accessible (high 7.5)
- [CVE-2022-1411](https://insights.sbomify.com/CVE-2022-1411/): Unrestructed file upload in yetiforcecompany/yetiforcecrm (critical 9.1)
- [CVE-2022-1410](https://insights.sbomify.com/CVE-2022-1410/): Remote Code Execution in Device42 ApplianceManager console (high 8.0)
- [CVE-2022-1409](https://insights.sbomify.com/CVE-2022-1409/): VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload (high 7.2)
- [CVE-2022-1408](https://insights.sbomify.com/CVE-2022-1408/): VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1407](https://insights.sbomify.com/CVE-2022-1407/): VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF (medium 6.5)
- [CVE-2022-1406](https://insights.sbomify.com/CVE-2022-1406/): Information disclosure in GitLab (medium 6.5)
- [CVE-2022-1405](https://insights.sbomify.com/CVE-2022-1405/): Delta Electronics CNCSoft Stack-based Buffer Overflow (high 7.8)
- [CVE-2022-1404](https://insights.sbomify.com/CVE-2022-1404/): Delta Electronics CNCSoft Out-of-bounds Read (low 3.3)
- [CVE-2022-1403](https://insights.sbomify.com/CVE-2022-1403/): Delta Electronics ASDA-Soft Out-of-bounds Write (high 7.8)
- [CVE-2022-1402](https://insights.sbomify.com/CVE-2022-1402/): Delta Electronics ASDA-Soft Out-of-bounds Read (high 7.8)
- [CVE-2022-1401](https://insights.sbomify.com/CVE-2022-1401/): Insufficient validation of provided paths in Exago WrImageResource.axd (medium 6.9)
- [CVE-2022-1400](https://insights.sbomify.com/CVE-2022-1400/): Hardcoded encryption key IV in Exago WebReportsApi.dll (high 7.1)
- [CVE-2022-1399](https://insights.sbomify.com/CVE-2022-1399/): Remote code execution in scheduled tasks component (critical 9.1)
- [CVE-2022-1398](https://insights.sbomify.com/CVE-2022-1398/): External Media without Import <= 1.1.2 - Subscriber+ Blind SSRF (medium 6.5)
- [CVE-2022-1397](https://insights.sbomify.com/CVE-2022-1397/): API Privilege Escalation in alextselegidis/easyappointments (high 8.8)
- [CVE-2022-1396](https://insights.sbomify.com/CVE-2022-1396/): Donorbox < 7.1.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1395](https://insights.sbomify.com/CVE-2022-1395/): Easy FAQ with Expanding Text <= 3.2.8.3.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1394](https://insights.sbomify.com/CVE-2022-1394/): Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1393](https://insights.sbomify.com/CVE-2022-1393/): WP Subtitle < 3.4.1 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-1392](https://insights.sbomify.com/CVE-2022-1392/): Videos sync PDF <= 1.7.4 - Unauthenticated LFI (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/420/