# Vulnerabilities published in 2022


- [CVE-2022-1391](https://insights.sbomify.com/CVE-2022-1391/): Cab fare calculator < 1.0.4 - Unauthenticated LFI (critical 9.8)
- [CVE-2022-1390](https://insights.sbomify.com/CVE-2022-1390/): Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read (critical 9.8)
- [CVE-2022-1389](https://insights.sbomify.com/CVE-2022-1389/): Cross-site request forgery in BIG-IP (low 3.1)
- [CVE-2022-1388](https://insights.sbomify.com/CVE-2022-1388/): F5 BIG-IP Missing Authentication (critical 9.8, exploited in the wild)
- [CVE-2022-1387](https://insights.sbomify.com/CVE-2022-1387/): No Future Posts <= 1.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1386](https://insights.sbomify.com/CVE-2022-1386/): Fusion Builder < 3.6.2 - Unauthenticated SSRF (critical 9.8)
- [CVE-2022-1385](https://insights.sbomify.com/CVE-2022-1385/): Invitation Email is resent as a Reminder after invalidating pending email invites (low 3.7)
- [CVE-2022-1384](https://insights.sbomify.com/CVE-2022-1384/): Authorized users are allowed to install old plugin versions from the Marketplace (medium 4.7)
- [CVE-2022-1383](https://insights.sbomify.com/CVE-2022-1383/): Heap-based Buffer Overflow in radareorg/radare2 (medium 4.8)
- [CVE-2022-1382](https://insights.sbomify.com/CVE-2022-1382/): NULL Pointer Dereference in radareorg/radare2 (medium 5.3)
- [CVE-2022-1381](https://insights.sbomify.com/CVE-2022-1381/): global heap buffer overflow in skip_range in vim/vim (high 7.8)
- [CVE-2022-1380](https://insights.sbomify.com/CVE-2022-1380/): Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it (critical 9.1)
- [CVE-2022-1379](https://insights.sbomify.com/CVE-2022-1379/): URL Restriction Bypass in plantuml/plantuml (high 7.2)
- [CVE-2022-1378](https://insights.sbomify.com/CVE-2022-1378/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1377](https://insights.sbomify.com/CVE-2022-1377/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1376](https://insights.sbomify.com/CVE-2022-1376/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1375](https://insights.sbomify.com/CVE-2022-1375/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1374](https://insights.sbomify.com/CVE-2022-1374/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1373](https://insights.sbomify.com/CVE-2022-1373/): Softing Secure Integration Server Relative Path Traversal (high 7.2)
- [CVE-2022-1372](https://insights.sbomify.com/CVE-2022-1372/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1371](https://insights.sbomify.com/CVE-2022-1371/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1370](https://insights.sbomify.com/CVE-2022-1370/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1369](https://insights.sbomify.com/CVE-2022-1369/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1368](https://insights.sbomify.com/CVE-2022-1368/): Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function (critical 9.8)
- [CVE-2022-1367](https://insights.sbomify.com/CVE-2022-1367/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1366](https://insights.sbomify.com/CVE-2022-1366/): SQL injection in DIAEnergie (critical 9.8)
- [CVE-2022-1365](https://insights.sbomify.com/CVE-2022-1365/): Exposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch (high 8.8)
- [CVE-2022-1364](https://insights.sbomify.com/CVE-2022-1364/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2022-1362](https://insights.sbomify.com/CVE-2022-1362/): Cambium Networks cnMaestro OS Command Injection (medium 5.0)
- [CVE-2022-1361](https://insights.sbomify.com/CVE-2022-1361/): Cambium Networks cnMaestro SQL Injection (high 7.4)
- [CVE-2022-1360](https://insights.sbomify.com/CVE-2022-1360/): Cambium Networks cnMaestro OS Command Injection (high 8.2)
- [CVE-2022-1359](https://insights.sbomify.com/CVE-2022-1359/): Cambium Networks cnMaestro Path Traversal (medium 5.7)
- [CVE-2022-1358](https://insights.sbomify.com/CVE-2022-1358/): Cambium Networks cnMaestro SQL Injection (medium 5.9)
- [CVE-2022-1357](https://insights.sbomify.com/CVE-2022-1357/): Cambium Networks cnMaestro OS Command Injection (critical 9.8)
- [CVE-2022-1356](https://insights.sbomify.com/CVE-2022-1356/): Cambium Networks cnMaestro use of Potentially Dangerous Function (high 7.1)
- [CVE-2022-1355](https://insights.sbomify.com/CVE-2022-1355/): Memory corruption in libtiff (medium 6.1)
- [CVE-2022-1354](https://insights.sbomify.com/CVE-2022-1354/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-1353](https://insights.sbomify.com/CVE-2022-1353/): Information disclosure in kernel (high 7.1)
- [CVE-2022-1352](https://insights.sbomify.com/CVE-2022-1352/): Missing authorization in GitLab (medium 5.3)
- [CVE-2022-1351](https://insights.sbomify.com/CVE-2022-1351/): Stored XSS in Tooltip in pimcore/pimcore (medium 6.8)
- [CVE-2022-1350](https://insights.sbomify.com/CVE-2022-1350/): GhostPCL gsmchunk.c chunk_free_object memory corruption (medium 4.3)
- [CVE-2022-1349](https://insights.sbomify.com/CVE-2022-1349/): WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR (medium 4.3)
- [CVE-2022-1348](https://insights.sbomify.com/CVE-2022-1348/): Misconfiguration in logrotate (medium 6.5)
- [CVE-2022-1347](https://insights.sbomify.com/CVE-2022-1347/): Cross-site scripting in causefx/organizr (critical 9.6)
- [CVE-2022-1346](https://insights.sbomify.com/CVE-2022-1346/): Multiple Stored XSS in causefx/organizr (critical 9.0)
- [CVE-2022-1345](https://insights.sbomify.com/CVE-2022-1345/): Stored XSS viva .svg file upload in causefx/organizr (critical 9.0)
- [CVE-2022-1344](https://insights.sbomify.com/CVE-2022-1344/): Stored XSS due to no sanitization in the filename in causefx/organizr (critical 9.0)
- [CVE-2022-1343](https://insights.sbomify.com/CVE-2022-1343/): OCSP_basic_verify may incorrectly verify the response signing certificate (medium 5.3)
- [CVE-2022-1342](https://insights.sbomify.com/CVE-2022-1342/): Information disclosure in Remote Desktop Manager (medium 4.6)
- [CVE-2022-1341](https://insights.sbomify.com/CVE-2022-1341/): Null dereference in bwm-ng (high 7.5)
- [CVE-2022-1340](https://insights.sbomify.com/CVE-2022-1340/): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (high 7.0)
- [CVE-2022-1339](https://insights.sbomify.com/CVE-2022-1339/): SQL injection in ElementController.php in pimcore/pimcore (high 8.8)
- [CVE-2022-1338](https://insights.sbomify.com/CVE-2022-1338/): Easily Generate Rest API Url <= 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1337](https://insights.sbomify.com/CVE-2022-1337/): OOM DoS in Mattermost image proxy (medium 4.3)
- [CVE-2022-1336](https://insights.sbomify.com/CVE-2022-1336/): Carousel CK <= 1.1.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1335](https://insights.sbomify.com/CVE-2022-1335/): Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1334](https://insights.sbomify.com/CVE-2022-1334/): WP YouTube Live < 1.8.3 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-1333](https://insights.sbomify.com/CVE-2022-1333/): A specifically drafted Playbook could trigger large amount of webhook requests leading to Denial of Service (low 3.5)
- [CVE-2022-1332](https://insights.sbomify.com/CVE-2022-1332/): Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents (medium 4.3)
- [CVE-2022-1331](https://insights.sbomify.com/CVE-2022-1331/): Delta Electronics DMARS Improper Restriction of XML External Entity Reference (medium 5.5)
- [CVE-2022-1330](https://insights.sbomify.com/CVE-2022-1330/): stored xss due to unsantized anchor url in alvarotrigo/fullpage.js (critical 9.4)
- [CVE-2022-1329](https://insights.sbomify.com/CVE-2022-1329/): Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution (high 8.8)
- [CVE-2022-1328](https://insights.sbomify.com/CVE-2022-1328/): Memory corruption in Mutt (medium 4.3)
- [CVE-2022-1327](https://insights.sbomify.com/CVE-2022-1327/): Image Gallery - Grid Gallery < 1.1.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1326](https://insights.sbomify.com/CVE-2022-1326/): Form - Contact Form <= 1.2.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1325](https://insights.sbomify.com/CVE-2022-1325/): Denial of service in Clmg (medium 5.5)
- [CVE-2022-1324](https://insights.sbomify.com/CVE-2022-1324/): Event Timeline <= 1.1.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1323](https://insights.sbomify.com/CVE-2022-1323/): Discy < 5.0 - Subscriber+ Broken Access Control to change settings (medium 6.5)
- [CVE-2022-1322](https://insights.sbomify.com/CVE-2022-1322/): Coming Soon - Under Construction <= 1.1.9 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1321](https://insights.sbomify.com/CVE-2022-1321/): miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1320](https://insights.sbomify.com/CVE-2022-1320/): Sliderby10Web < 1.2.52 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1319](https://insights.sbomify.com/CVE-2022-1319/): Other in undertow (high 7.5)
- [CVE-2022-1318](https://insights.sbomify.com/CVE-2022-1318/): Hills ComNav Inadequate Encryption Strength (medium 6.2)
- [CVE-2022-1316](https://insights.sbomify.com/CVE-2022-1316/): Incorrect Permission Assignment for Critical Resource in zerotier/zerotierone (high 8.8)
- [CVE-2022-1314](https://insights.sbomify.com/CVE-2022-1314/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1313](https://insights.sbomify.com/CVE-2022-1313/): Use after free in Chrome (high 8.8)
- [CVE-2022-1312](https://insights.sbomify.com/CVE-2022-1312/): Use after free in Chrome (critical 9.6)
- [CVE-2022-1311](https://insights.sbomify.com/CVE-2022-1311/): Use after free in Chrome (high 8.8)
- [CVE-2022-1310](https://insights.sbomify.com/CVE-2022-1310/): Use after free in Chrome (high 8.8)
- [CVE-2022-1309](https://insights.sbomify.com/CVE-2022-1309/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2022-1308](https://insights.sbomify.com/CVE-2022-1308/): Use after free in Chrome (high 8.8)
- [CVE-2022-1307](https://insights.sbomify.com/CVE-2022-1307/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-1306](https://insights.sbomify.com/CVE-2022-1306/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-1305](https://insights.sbomify.com/CVE-2022-1305/): Use after free in Chrome (high 8.8)
- [CVE-2022-1304](https://insights.sbomify.com/CVE-2022-1304/): Memory corruption in e2fsprogs (high 7.8)
- [CVE-2022-1303](https://insights.sbomify.com/CVE-2022-1303/): Slide Anything < 2.3.44 - Editor+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1302](https://insights.sbomify.com/CVE-2022-1302/): Malformed Goose Message in LibIEC61850 may result in a denial of service (high 7.5)
- [CVE-2022-1301](https://insights.sbomify.com/CVE-2022-1301/): WP Contact Slider < 2.4.7 - Editor+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1300](https://insights.sbomify.com/CVE-2022-1300/): Missing authentication in TRUMPF products may result in corruption of data (critical 9.8)
- [CVE-2022-1299](https://insights.sbomify.com/CVE-2022-1299/): Slideshow <= 2.3.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1298](https://insights.sbomify.com/CVE-2022-1298/): Tabs Responsive < 2.2.8 - Editor+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1297](https://insights.sbomify.com/CVE-2022-1297/): Out-of-bounds Read in r_bin_ne_get_entrypoints function in radareorg/radare2 (medium 6.6)
- [CVE-2022-1296](https://insights.sbomify.com/CVE-2022-1296/): Out-of-bounds read in `r_bin_ne_get_relocs` function in radareorg/radare2 (medium 6.6)
- [CVE-2022-1295](https://insights.sbomify.com/CVE-2022-1295/): Prototype Pollution in alvarotrigo/fullpage.js (high 7.3)
- [CVE-2022-1294](https://insights.sbomify.com/CVE-2022-1294/): IMDB info box <= 2.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1293](https://insights.sbomify.com/CVE-2022-1293/): XSS vulnerability in Citadel (medium 5.7)
- [CVE-2022-1292](https://insights.sbomify.com/CVE-2022-1292/): The c_rehash script allows command injection (critical 9.8)
- [CVE-2022-1291](https://insights.sbomify.com/CVE-2022-1291/): XSS vulnerability with default `onCellHtmlData` function in hhurz/tableexport.jquery.plugin (high 7.6)
- [CVE-2022-1290](https://insights.sbomify.com/CVE-2022-1290/): Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk (critical 9.0)
- [CVE-2022-1289](https://insights.sbomify.com/CVE-2022-1289/): tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/421/