# Vulnerabilities published in 2022


- [CVE-2022-1183](https://insights.sbomify.com/CVE-2022-1183/): Destroying a TLS session early causes assertion failure (high 7.5)
- [CVE-2022-1182](https://insights.sbomify.com/CVE-2022-1182/): Visual Slide Box Builder <= 3.2.9 - Subscriber+ SQLi (high 8.8)
- [CVE-2022-1181](https://insights.sbomify.com/CVE-2022-1181/): Stored Cross Site Scripting in openemr/openemr (high 8.0)
- [CVE-2022-1180](https://insights.sbomify.com/CVE-2022-1180/): Reflected Cross Site Scripting in openemr/openemr (medium 4.6)
- [CVE-2022-1179](https://insights.sbomify.com/CVE-2022-1179/): Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr (medium 4.6)
- [CVE-2022-1178](https://insights.sbomify.com/CVE-2022-1178/): Stored Cross Site Scripting in openemr/openemr (high 7.3)
- [CVE-2022-1177](https://insights.sbomify.com/CVE-2022-1177/): Accounting User Can Download Patient Reports in openemr in openemr/openemr (medium 6.5)
- [CVE-2022-1176](https://insights.sbomify.com/CVE-2022-1176/): Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat (high 7.5)
- [CVE-2022-1175](https://insights.sbomify.com/CVE-2022-1175/): Cross-site scripting in GitLab (high 8.7)
- [CVE-2022-1174](https://insights.sbomify.com/CVE-2022-1174/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-1173](https://insights.sbomify.com/CVE-2022-1173/): stored xss in getgrav/grav (high 8.2)
- [CVE-2022-1172](https://insights.sbomify.com/CVE-2022-1172/): Null Pointer Dereference Caused Segmentation Fault in gpac/gpac (medium 5.6)
- [CVE-2022-1171](https://insights.sbomify.com/CVE-2022-1171/): Vertical scroll recent post < 14.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1170](https://insights.sbomify.com/CVE-2022-1170/): JobMonster < 4.5.2.9 - Unauthenticated Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1169](https://insights.sbomify.com/CVE-2022-1169/): Careerfy < 3.9.0 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-1168](https://insights.sbomify.com/CVE-2022-1168/): JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-1167](https://insights.sbomify.com/CVE-2022-1167/): CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1166](https://insights.sbomify.com/CVE-2022-1166/): JobMonster < 4.6.6.1 - Directory Listing in Upload Folder (medium 5.3)
- [CVE-2022-1165](https://insights.sbomify.com/CVE-2022-1165/): Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing (critical 9.1)
- [CVE-2022-1164](https://insights.sbomify.com/CVE-2022-1164/): Wyzi < 2.4.3 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-1163](https://insights.sbomify.com/CVE-2022-1163/): Cross-site Scripting (XSS) - Stored in mineweb/minewebcms (medium 6.8)
- [CVE-2022-1162](https://insights.sbomify.com/CVE-2022-1162/): Hardcoded credentials in GitLab (critical 9.1)
- [CVE-2022-1161](https://insights.sbomify.com/CVE-2022-1161/): ICSA-22-090-05 Rockwell Automation Logix Controllers (critical 10.0)
- [CVE-2022-1160](https://insights.sbomify.com/CVE-2022-1160/): heap buffer overflow in get_one_sourceline in vim/vim (high 7.3)
- [CVE-2022-1159](https://insights.sbomify.com/CVE-2022-1159/): Rockwell Automation Studio 5000 Logix Designer Code Injection (high 7.7)
- [CVE-2022-1158](https://insights.sbomify.com/CVE-2022-1158/): Memory corruption in kernel (high 7.8)
- [CVE-2022-1157](https://insights.sbomify.com/CVE-2022-1157/): Information disclosure in GitLab (low 2.6)
- [CVE-2022-1156](https://insights.sbomify.com/CVE-2022-1156/): Books & Papers <= 0.20210223 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1155](https://insights.sbomify.com/CVE-2022-1155/): Old sessions are not blocked by the login enable function. in snipe/snipe-it (high 7.4)
- [CVE-2022-1154](https://insights.sbomify.com/CVE-2022-1154/): Use after free in utf_ptr2char in vim/vim (high 7.8)
- [CVE-2022-1153](https://insights.sbomify.com/CVE-2022-1153/): LayerSlider < 7.1.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1152](https://insights.sbomify.com/CVE-2022-1152/): Menubar < 5.8 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2022-1148](https://insights.sbomify.com/CVE-2022-1148/): Missing authorization in GitLab (medium 5.3)
- [CVE-2022-1146](https://insights.sbomify.com/CVE-2022-1146/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-1145](https://insights.sbomify.com/CVE-2022-1145/): Use after free in Chrome (high 7.5)
- [CVE-2022-1144](https://insights.sbomify.com/CVE-2022-1144/): Use after free in Chrome (high 8.8)
- [CVE-2022-1143](https://insights.sbomify.com/CVE-2022-1143/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1142](https://insights.sbomify.com/CVE-2022-1142/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1141](https://insights.sbomify.com/CVE-2022-1141/): Use after free in Chrome (high 8.8)
- [CVE-2022-1139](https://insights.sbomify.com/CVE-2022-1139/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-1138](https://insights.sbomify.com/CVE-2022-1138/): Other in Chrome (medium 6.5)
- [CVE-2022-1137](https://insights.sbomify.com/CVE-2022-1137/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-1136](https://insights.sbomify.com/CVE-2022-1136/): Use after free in Chrome (high 8.8)
- [CVE-2022-1135](https://insights.sbomify.com/CVE-2022-1135/): Use after free in Chrome (high 8.8)
- [CVE-2022-1134](https://insights.sbomify.com/CVE-2022-1134/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-1133](https://insights.sbomify.com/CVE-2022-1133/): Use after free in Chrome (high 8.8)
- [CVE-2022-1132](https://insights.sbomify.com/CVE-2022-1132/): Security feature bypass in Chrome (medium 6.1)
- [CVE-2022-1131](https://insights.sbomify.com/CVE-2022-1131/): Use after free in Chrome (high 8.8)
- [CVE-2022-1130](https://insights.sbomify.com/CVE-2022-1130/): Security feature bypass in Chrome (high 8.1)
- [CVE-2022-1129](https://insights.sbomify.com/CVE-2022-1129/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-1128](https://insights.sbomify.com/CVE-2022-1128/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-1127](https://insights.sbomify.com/CVE-2022-1127/): Use after free in Chrome (high 8.8)
- [CVE-2022-1125](https://insights.sbomify.com/CVE-2022-1125/): Use after free in Chrome (high 8.8)
- [CVE-2022-1124](https://insights.sbomify.com/CVE-2022-1124/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-1123](https://insights.sbomify.com/CVE-2022-1123/): Leaflet Maps Marker < 3.12.5 - Admin+ SQLi (high 7.2)
- [CVE-2022-1122](https://insights.sbomify.com/CVE-2022-1122/): Memory corruption in openjpeg2 (medium 5.5)
- [CVE-2022-1121](https://insights.sbomify.com/CVE-2022-1121/): Denial of service in GitLab Pages (medium 5.3)
- [CVE-2022-1120](https://insights.sbomify.com/CVE-2022-1120/): Information disclosure in GitLab (medium 4.8)
- [CVE-2022-1119](https://insights.sbomify.com/CVE-2022-1119/): Simple File List <= 3.2.7 - Arbitrary File Download (high 7.5)
- [CVE-2022-1118](https://insights.sbomify.com/CVE-2022-1118/): Rockwell Automation ISaGRAF Deserialization of Untrusted Data (high 8.6)
- [CVE-2022-1117](https://insights.sbomify.com/CVE-2022-1117/): Security feature bypass in fapolicyd (high 8.4)
- [CVE-2022-1116](https://insights.sbomify.com/CVE-2022-1116/): Integer overflow in Kernel (high 7.8)
- [CVE-2022-1115](https://insights.sbomify.com/CVE-2022-1115/): Memory corruption in ImageMagick (medium 5.5)
- [CVE-2022-1114](https://insights.sbomify.com/CVE-2022-1114/): Use after free in ImageMagick (high 7.1)
- [CVE-2022-1113](https://insights.sbomify.com/CVE-2022-1113/): Flower Delivery by Florist One <= 3.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1112](https://insights.sbomify.com/CVE-2022-1112/): Autolinks <= 1.0.1 - Stored Cross-Site Scripting via CSRF (medium 5.4)
- [CVE-2022-1111](https://insights.sbomify.com/CVE-2022-1111/): Business logic in GitLab (low 2.4)
- [CVE-2022-1110](https://insights.sbomify.com/CVE-2022-1110/): Memory corruption in Smart Standby Driver (medium 5.5)
- [CVE-2022-1109](https://insights.sbomify.com/CVE-2022-1109/): Misconfiguration in Leyun (medium 5.5)
- [CVE-2022-1108](https://insights.sbomify.com/CVE-2022-1108/): Memory corruption in ThinkPad BIOS (medium 6.7)
- [CVE-2022-1107](https://insights.sbomify.com/CVE-2022-1107/): Privilege escalation in ThinkPad BIOS (medium 6.7)
- [CVE-2022-1106](https://insights.sbomify.com/CVE-2022-1106/): use after free in mrb_vm_exec in mruby/mruby (high 7.2)
- [CVE-2022-1105](https://insights.sbomify.com/CVE-2022-1105/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-1104](https://insights.sbomify.com/CVE-2022-1104/): Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1103](https://insights.sbomify.com/CVE-2022-1103/): Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload (high 8.8)
- [CVE-2022-1102](https://insights.sbomify.com/CVE-2022-1102/): SourceCodester Royale Event Management System companyprofile.php cross site scripting (medium 4.3)
- [CVE-2022-1101](https://insights.sbomify.com/CVE-2022-1101/): SourceCodester Royale Event Management System userregister.php improper authentication (high 7.3)
- [CVE-2022-1100](https://insights.sbomify.com/CVE-2022-1100/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-1099](https://insights.sbomify.com/CVE-2022-1099/): Denial of service in GitLab (medium 4.3)
- [CVE-2022-1098](https://insights.sbomify.com/CVE-2022-1098/): Delta Electronics DIAEnergie Uncontrolledly Search Path Element (high 7.8)
- [CVE-2022-1097](https://insights.sbomify.com/CVE-2022-1097/): Use after free in Firefox (medium 6.5)
- [CVE-2022-1096](https://insights.sbomify.com/CVE-2022-1096/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2022-1095](https://insights.sbomify.com/CVE-2022-1095/): Mihdan: No External Links < 5.0.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1094](https://insights.sbomify.com/CVE-2022-1094/): Amr Users < 4.59.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1093](https://insights.sbomify.com/CVE-2022-1093/): WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs (medium 4.8)
- [CVE-2022-1092](https://insights.sbomify.com/CVE-2022-1092/): myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure (medium 4.3)
- [CVE-2022-1091](https://insights.sbomify.com/CVE-2022-1091/): Safe SVG < 1.9.10 - SVG Sanitisation Bypass (medium 6.1)
- [CVE-2022-1090](https://insights.sbomify.com/CVE-2022-1090/): Good & Bad Comments <= 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1089](https://insights.sbomify.com/CVE-2022-1089/): Bulk Edit and Create User Profiles < 1.5.14 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1088](https://insights.sbomify.com/CVE-2022-1088/): Page Security & Membership <= 1.5.15 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1087](https://insights.sbomify.com/CVE-2022-1087/): htmly Edit Profile Module cross site scripting (low 3.5)
- [CVE-2022-1086](https://insights.sbomify.com/CVE-2022-1086/): DolphinPHP User Management Page cross site scripting (low 3.5)
- [CVE-2022-1085](https://insights.sbomify.com/CVE-2022-1085/): CLTPHP POST Parameter cross site scripting (low 3.5)
- [CVE-2022-1084](https://insights.sbomify.com/CVE-2022-1084/): SourceCodester One Church Management System Session userregister.php improper authentication (high 7.3)
- [CVE-2022-1083](https://insights.sbomify.com/CVE-2022-1083/): Microfinance Management System sql injection (high 7.3)
- [CVE-2022-1082](https://insights.sbomify.com/CVE-2022-1082/): SourceCodester Microfinance Management System Login Page login.php sql injection (high 7.3)
- [CVE-2022-1081](https://insights.sbomify.com/CVE-2022-1081/): SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting (medium 4.3)
- [CVE-2022-1080](https://insights.sbomify.com/CVE-2022-1080/): SourceCodester One Church Management System attendancy.php sql injection (high 7.3)
- [CVE-2022-1079](https://insights.sbomify.com/CVE-2022-1079/): SourceCodester One Church Management System churchprofile.php cross site scripting (medium 4.3)
- [CVE-2022-1078](https://insights.sbomify.com/CVE-2022-1078/): SourceCodester College Website Management System sql injection (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/423/