# Vulnerabilities published in 2022


- [CVE-2022-1288](https://insights.sbomify.com/CVE-2022-1288/): School Club Application System cross site scripting (medium 4.3)
- [CVE-2022-1287](https://insights.sbomify.com/CVE-2022-1287/): School Club Application System resource injection (medium 6.5)
- [CVE-2022-1286](https://insights.sbomify.com/CVE-2022-1286/): heap-buffer-overflow in mrb_vm_exec in mruby/mruby in mruby/mruby (medium 5.9)
- [CVE-2022-1285](https://insights.sbomify.com/CVE-2022-1285/): Server-Side Request Forgery (SSRF) in gogs/gogs (high 8.3)
- [CVE-2022-1284](https://insights.sbomify.com/CVE-2022-1284/): heap-use-after-free in radareorg/radare2 (high 7.5)
- [CVE-2022-1283](https://insights.sbomify.com/CVE-2022-1283/): NULL Pointer Dereference in r_bin_ne_get_entrypoints function in radareorg/radare2 (medium 6.6)
- [CVE-2022-1282](https://insights.sbomify.com/CVE-2022-1282/): Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1281](https://insights.sbomify.com/CVE-2022-1281/): Photo Gallery < 1.6.3 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-1280](https://insights.sbomify.com/CVE-2022-1280/): Use after free in kernel (medium 6.3)
- [CVE-2022-1279](https://insights.sbomify.com/CVE-2022-1279/): Weak cryptography in ebics-java-client (medium 6.5)
- [CVE-2022-1278](https://insights.sbomify.com/CVE-2022-1278/): WildFly vulnerable to Insecure Default Initialization of Resource (high 7.5)
- [CVE-2022-1277](https://insights.sbomify.com/CVE-2022-1277/): SQL Injection in Inavitas Solar Log (critical 9.4)
- [CVE-2022-1276](https://insights.sbomify.com/CVE-2022-1276/): Out-of-bounds Read in mrb_get_args in mruby/mruby (high 8.4)
- [CVE-2022-1275](https://insights.sbomify.com/CVE-2022-1275/): BannerMan <= 0.2.4 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1274](https://insights.sbomify.com/CVE-2022-1274/): HTML Injection in Keycloak Admin REST API (medium 5.4)
- [CVE-2022-1273](https://insights.sbomify.com/CVE-2022-1273/): Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE (high 7.2)
- [CVE-2022-1271](https://insights.sbomify.com/CVE-2022-1271/): Path traversal in gzip, xz-utils (high 8.8)
- [CVE-2022-1270](https://insights.sbomify.com/CVE-2022-1270/): Memory corruption in GraphicsMagick (high 7.8)
- [CVE-2022-1269](https://insights.sbomify.com/CVE-2022-1269/): Fast Flow < 1.2.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1268](https://insights.sbomify.com/CVE-2022-1268/): Donate Extra <= 2.02 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1267](https://insights.sbomify.com/CVE-2022-1267/): BMI BMR Calculator <= 1.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1266](https://insights.sbomify.com/CVE-2022-1266/): Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-1265](https://insights.sbomify.com/CVE-2022-1265/): BulletProof Security < 6.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1264](https://insights.sbomify.com/CVE-2022-1264/): Inductive Automation Ignition (medium 6.8)
- [CVE-2022-1263](https://insights.sbomify.com/CVE-2022-1263/): Null dereference in Kernel:KVM (medium 5.5)
- [CVE-2022-1262](https://insights.sbomify.com/CVE-2022-1262/): Command injection in D-Link Routers (high 7.8)
- [CVE-2022-1261](https://insights.sbomify.com/CVE-2022-1261/): Matrikon OPC Server Improper Access Control (medium 5.8)
- [CVE-2022-1259](https://insights.sbomify.com/CVE-2022-1259/): Denial of service in undertow (high 7.5)
- [CVE-2022-1258](https://insights.sbomify.com/CVE-2022-1258/): SQL injection vulnerability in McAfee Agent's ePO extension (high 8.4)
- [CVE-2022-1257](https://insights.sbomify.com/CVE-2022-1257/): Improper Verification of Cryptographic Signature by McAfee Agent (medium 6.1)
- [CVE-2022-1256](https://insights.sbomify.com/CVE-2022-1256/): Improper Privilege Management in McAfee Agent for Windows (high 7.8)
- [CVE-2022-1255](https://insights.sbomify.com/CVE-2022-1255/): Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1254](https://insights.sbomify.com/CVE-2022-1254/): SWG URL redirection vulnerability (medium 6.1)
- [CVE-2022-1253](https://insights.sbomify.com/CVE-2022-1253/): Heap-based Buffer Overflow in strukturag/libde265 (high 7.4)
- [CVE-2022-1252](https://insights.sbomify.com/CVE-2022-1252/): Use of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5 (high 8.2)
- [CVE-2022-1251](https://insights.sbomify.com/CVE-2022-1251/): Ask Me < 6.8.4 - CSRF in Edit Profile (medium 4.3)
- [CVE-2022-1250](https://insights.sbomify.com/CVE-2022-1250/): LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1249](https://insights.sbomify.com/CVE-2022-1249/): Null dereference in pesign (low 3.3)
- [CVE-2022-1248](https://insights.sbomify.com/CVE-2022-1248/): SAP Information System POST Request add_admin.php improper authentication (high 7.3)
- [CVE-2022-1247](https://insights.sbomify.com/CVE-2022-1247/): Race condition in Kernel (high 7.0)
- [CVE-2022-1245](https://insights.sbomify.com/CVE-2022-1245/): Keycloak vulnerable to privilege escalation on Token Exchange feature (critical 9.8)
- [CVE-2022-1244](https://insights.sbomify.com/CVE-2022-1244/): heap-buffer-overflow in radareorg/radare2 (high 7.5)
- [CVE-2022-1243](https://insights.sbomify.com/CVE-2022-1243/): CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js (high 7.2)
- [CVE-2022-1242](https://insights.sbomify.com/CVE-2022-1242/): Other in Apport (high 7.8)
- [CVE-2022-1241](https://insights.sbomify.com/CVE-2022-1241/): Ask Me < 6.8.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1240](https://insights.sbomify.com/CVE-2022-1240/): Heap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2 (high 7.6)
- [CVE-2022-1239](https://insights.sbomify.com/CVE-2022-1239/): HubSpot < 8.8.15 - Contributor+ Blind SSRF (high 8.8)
- [CVE-2022-1238](https://insights.sbomify.com/CVE-2022-1238/): Out-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2 (high 7.6)
- [CVE-2022-1237](https://insights.sbomify.com/CVE-2022-1237/): Improper Validation of Array Index in radareorg/radare2 (high 7.6)
- [CVE-2022-1236](https://insights.sbomify.com/CVE-2022-1236/): Weak Password Requirements in weseek/growi (medium 4.3)
- [CVE-2022-1235](https://insights.sbomify.com/CVE-2022-1235/): Weak secrethash can be brute-forced in livehelperchat/livehelperchat (high 7.5)
- [CVE-2022-1234](https://insights.sbomify.com/CVE-2022-1234/): XSS in livehelperchat in livehelperchat/livehelperchat (high 8.8)
- [CVE-2022-1233](https://insights.sbomify.com/CVE-2022-1233/): URL Confusion When Scheme Not Supplied in medialize/uri.js (medium 6.5)
- [CVE-2022-1232](https://insights.sbomify.com/CVE-2022-1232/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1231](https://insights.sbomify.com/CVE-2022-1231/): XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml (critical 9.3)
- [CVE-2022-1230](https://insights.sbomify.com/CVE-2022-1230/): Open redirect in Galaxy S21 (low 3.9)
- [CVE-2022-1229](https://insights.sbomify.com/CVE-2022-1229/): Memory corruption in MicroStation CONNECT (high 7.8)
- [CVE-2022-1228](https://insights.sbomify.com/CVE-2022-1228/): Opensea < 1.0.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-1227](https://insights.sbomify.com/CVE-2022-1227/): Podman publishes a malicious image to public registries (high 8.8)
- [CVE-2022-1226](https://insights.sbomify.com/CVE-2022-1226/): Cross-site Scripting (XSS) in phpipam/phpipam (low 3.5)
- [CVE-2022-1225](https://insights.sbomify.com/CVE-2022-1225/): Incorrect Privilege Assignment in phpipam/phpipam (medium 6.5)
- [CVE-2022-1224](https://insights.sbomify.com/CVE-2022-1224/): Improper Authorization in phpipam/phpipam (medium 6.5)
- [CVE-2022-1223](https://insights.sbomify.com/CVE-2022-1223/): Incorrect Authorization in phpipam/phpipam (medium 6.5)
- [CVE-2022-1222](https://insights.sbomify.com/CVE-2022-1222/): Inf loop in gpac/gpac (medium 4.0)
- [CVE-2022-1221](https://insights.sbomify.com/CVE-2022-1221/): Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1220](https://insights.sbomify.com/CVE-2022-1220/): FoxyShop < 4.8.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1219](https://insights.sbomify.com/CVE-2022-1219/): SQL injection in RecyclebinController.php in pimcore/pimcore (high 7.2)
- [CVE-2022-1218](https://insights.sbomify.com/CVE-2022-1218/): Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1217](https://insights.sbomify.com/CVE-2022-1217/): Custom TinyMCE Shortcode Button <= 1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1216](https://insights.sbomify.com/CVE-2022-1216/): Advanced Image Sitemap <= 1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1215](https://insights.sbomify.com/CVE-2022-1215/): Memory corruption in libinput (high 7.8)
- [CVE-2022-1213](https://insights.sbomify.com/CVE-2022-1213/): SSRF filter bypass port 80, 433 in livehelperchat/livehelperchat (high 7.7)
- [CVE-2022-1212](https://insights.sbomify.com/CVE-2022-1212/): Use-After-Free in str_escape in mruby/mruby in mruby/mruby (critical 9.3)
- [CVE-2022-1211](https://insights.sbomify.com/CVE-2022-1211/): tildearrow Furnace FUR to VGM Converter stack-based overflow (medium 6.3)
- [CVE-2022-1210](https://insights.sbomify.com/CVE-2022-1210/): LibTIFF tiff2ps resource consumption (medium 4.3)
- [CVE-2022-1209](https://insights.sbomify.com/CVE-2022-1209/): Ultimate Member <= 2.3.1 - Arbitrary Redirect (medium 4.3)
- [CVE-2022-1208](https://insights.sbomify.com/CVE-2022-1208/): Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting (medium 6.4)
- [CVE-2022-1207](https://insights.sbomify.com/CVE-2022-1207/): Out-of-bounds read in radareorg/radare2 (medium 6.6)
- [CVE-2022-1206](https://insights.sbomify.com/CVE-2022-1206/): AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload (high 7.2)
- [CVE-2022-1205](https://insights.sbomify.com/CVE-2022-1205/): Null dereference in Kernel (medium 4.7)
- [CVE-2022-1204](https://insights.sbomify.com/CVE-2022-1204/): Use after free in Kernel (medium 5.5)
- [CVE-2022-1203](https://insights.sbomify.com/CVE-2022-1203/): Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update (medium 4.3)
- [CVE-2022-1202](https://insights.sbomify.com/CVE-2022-1202/): WP-CRM <= 1.2.1 - CSV Injection (high 7.8)
- [CVE-2022-1201](https://insights.sbomify.com/CVE-2022-1201/): NULL Pointer Dereference in mrb_vm_exec with super in mruby/mruby (high 7.1)
- [CVE-2022-1199](https://insights.sbomify.com/CVE-2022-1199/): Null dereference in Kernel (high 7.5)
- [CVE-2022-1198](https://insights.sbomify.com/CVE-2022-1198/): Use after free in kernel (medium 5.5)
- [CVE-2022-1197](https://insights.sbomify.com/CVE-2022-1197/): Security feature bypass in Thunderbird (medium 5.4)
- [CVE-2022-1196](https://insights.sbomify.com/CVE-2022-1196/): Use after free in Firefox ESR (medium 6.5)
- [CVE-2022-1195](https://insights.sbomify.com/CVE-2022-1195/): Use after free in kernel (medium 5.5)
- [CVE-2022-1194](https://insights.sbomify.com/CVE-2022-1194/): Mobile Events Manager < 1.4.8 - Admin+ CSV Injection (high 8.8)
- [CVE-2022-1193](https://insights.sbomify.com/CVE-2022-1193/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-1192](https://insights.sbomify.com/CVE-2022-1192/): Turn off all comments <= 1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1191](https://insights.sbomify.com/CVE-2022-1191/): SSRF on index.php/cobrowse/proxycss/ in livehelperchat/livehelperchat (high 8.7)
- [CVE-2022-1190](https://insights.sbomify.com/CVE-2022-1190/): Cross-site scripting in GitLab (high 8.7)
- [CVE-2022-1189](https://insights.sbomify.com/CVE-2022-1189/): Missing authorization in GitLab (low 3.1)
- [CVE-2022-1188](https://insights.sbomify.com/CVE-2022-1188/): Server-side request forgery in GitLab (low 3.7)
- [CVE-2022-1187](https://insights.sbomify.com/CVE-2022-1187/): WP YouTube Live <= 1.7.21 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1186](https://insights.sbomify.com/CVE-2022-1186/): Be POPIA Compliant <= 1.1.5 - Sensitive Information Exposure (medium 5.3)
- [CVE-2022-1185](https://insights.sbomify.com/CVE-2022-1185/): Memory corruption in GitLab (medium 6.5)
- [CVE-2022-1184](https://insights.sbomify.com/CVE-2022-1184/): Use after free in Kernel (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/422/