# Vulnerabilities published in 2022


- [CVE-2022-1077](https://insights.sbomify.com/CVE-2022-1077/): TEM FLEX-1080/FLEX-1085 Log information disclosure (medium 5.3)
- [CVE-2022-1076](https://insights.sbomify.com/CVE-2022-1076/): Automatic Question Paper Generator System My Account Page login.php cross site scripting (medium 4.3)
- [CVE-2022-1075](https://insights.sbomify.com/CVE-2022-1075/): College Website Management System Contact cross site scripting (low 3.5)
- [CVE-2022-1074](https://insights.sbomify.com/CVE-2022-1074/): TEM FLEX-1085 injection (medium 4.3)
- [CVE-2022-1073](https://insights.sbomify.com/CVE-2022-1073/): Automatic Question Paper Generator password recovery (high 7.3)
- [CVE-2022-1071](https://insights.sbomify.com/CVE-2022-1071/): User after free in mrb_vm_exec in mruby/mruby (high 7.7)
- [CVE-2022-1070](https://insights.sbomify.com/CVE-2022-1070/): CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300 (high 8.2)
- [CVE-2022-1069](https://insights.sbomify.com/CVE-2022-1069/): Softing Secure Integration Server Out-of-bounds Read (high 7.5)
- [CVE-2022-1068](https://insights.sbomify.com/CVE-2022-1068/): Modbus Tools Modbus Slave Stack-Based Buffer Overflow (medium 5.5)
- [CVE-2022-1067](https://insights.sbomify.com/CVE-2022-1067/): ICSMA-22-095-01 LifePoint Informatics Patient Portal (medium 6.5)
- [CVE-2022-1066](https://insights.sbomify.com/CVE-2022-1066/): MISSING AUTHORIZATION CWE-862 (high 8.2)
- [CVE-2022-1065](https://insights.sbomify.com/CVE-2022-1065/): Multi Factor Authentication Bypass in various versions of Abacus ERP (high 8.1)
- [CVE-2022-1064](https://insights.sbomify.com/CVE-2022-1064/): SQL injection through marking blog comments on bulk as spam in forkcms/forkcms (critical 9.0)
- [CVE-2022-1063](https://insights.sbomify.com/CVE-2022-1063/): Thank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1062](https://insights.sbomify.com/CVE-2022-1062/): th23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1061](https://insights.sbomify.com/CVE-2022-1061/): Heap Buffer Overflow in parseDragons in radareorg/radare2 (high 7.3)
- [CVE-2022-1059](https://insights.sbomify.com/CVE-2022-1059/): CROSS-SITE SCRIPTING CWE-79 (high 8.2)
- [CVE-2022-1058](https://insights.sbomify.com/CVE-2022-1058/): Open Redirect on login in go-gitea/gitea (high 7.2)
- [CVE-2022-1057](https://insights.sbomify.com/CVE-2022-1057/): Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-1056](https://insights.sbomify.com/CVE-2022-1056/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-1055](https://insights.sbomify.com/CVE-2022-1055/): Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel (high 8.6)
- [CVE-2022-1054](https://insights.sbomify.com/CVE-2022-1054/): RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export (medium 5.3)
- [CVE-2022-1053](https://insights.sbomify.com/CVE-2022-1053/): Tenant and Verifier might not use the same registrar data (critical 9.1)
- [CVE-2022-1052](https://insights.sbomify.com/CVE-2022-1052/): Heap Buffer Overflow in iterate_chained_fixups in radareorg/radare2 (high 7.3)
- [CVE-2022-1051](https://insights.sbomify.com/CVE-2022-1051/): WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields (medium 5.4)
- [CVE-2022-1050](https://insights.sbomify.com/CVE-2022-1050/): Use after free in QEMU (high 8.8)
- [CVE-2022-1049](https://insights.sbomify.com/CVE-2022-1049/): Auth bypass in clusterlabs/pcs (high 8.8)
- [CVE-2022-1048](https://insights.sbomify.com/CVE-2022-1048/): Use after free in kernel (high 7.0)
- [CVE-2022-1047](https://insights.sbomify.com/CVE-2022-1047/): Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1046](https://insights.sbomify.com/CVE-2022-1046/): Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1045](https://insights.sbomify.com/CVE-2022-1045/): Stored XSS viva .svg file upload in polonel/trudesk (critical 9.0)
- [CVE-2022-1044](https://insights.sbomify.com/CVE-2022-1044/): Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk (high 8.2)
- [CVE-2022-1043](https://insights.sbomify.com/CVE-2022-1043/): Use after free in Kernel (high 8.8)
- [CVE-2022-1042](https://insights.sbomify.com/CVE-2022-1042/): Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning (high 8.2)
- [CVE-2022-1041](https://insights.sbomify.com/CVE-2022-1041/): Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning (high 8.2)
- [CVE-2022-1040](https://insights.sbomify.com/CVE-2022-1040/): Sophos Firewall Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2022-1039](https://insights.sbomify.com/CVE-2022-1039/): ICSA-22-104-03 Red Lion DA50N (critical 9.6)
- [CVE-2022-1038](https://insights.sbomify.com/CVE-2022-1038/): Privilege escalation in HP Jumpstart (high 7.8)
- [CVE-2022-1037](https://insights.sbomify.com/CVE-2022-1037/): EXMAGE < 1.0.7 - Admin+ Blind SSRF (high 7.2)
- [CVE-2022-1036](https://insights.sbomify.com/CVE-2022-1036/): Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber (medium 5.3)
- [CVE-2022-1035](https://insights.sbomify.com/CVE-2022-1035/): Segmentation Fault caused by MP4Box -lsr in gpac/gpac (low 2.9)
- [CVE-2022-1034](https://insights.sbomify.com/CVE-2022-1034/): There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in star7th/showdoc (critical 9.1)
- [CVE-2022-1033](https://insights.sbomify.com/CVE-2022-1033/): Unrestricted Upload of File with Dangerous Type in crater-invoice/crater (high 7.2)
- [CVE-2022-1032](https://insights.sbomify.com/CVE-2022-1032/): Insecure deserialization of not validated module file in crater-invoice/crater (high 7.2)
- [CVE-2022-1031](https://insights.sbomify.com/CVE-2022-1031/): Use After Free in op_is_set_bp in radareorg/radare2 (high 7.3)
- [CVE-2022-1030](https://insights.sbomify.com/CVE-2022-1030/): Command injection in Advanced Server Access Client (high 8.8)
- [CVE-2022-1029](https://insights.sbomify.com/CVE-2022-1029/): Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1028](https://insights.sbomify.com/CVE-2022-1028/): WordPress Security < 4.2.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1027](https://insights.sbomify.com/CVE-2022-1027/): Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1026](https://insights.sbomify.com/CVE-2022-1026/): Kyocera Net View Address Book Exposure (high 8.6)
- [CVE-2022-1025](https://insights.sbomify.com/CVE-2022-1025/): Privilege escalation in ArgoCD (high 8.8)
- [CVE-2022-1023](https://insights.sbomify.com/CVE-2022-1023/): Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi (high 7.2)
- [CVE-2022-1022](https://insights.sbomify.com/CVE-2022-1022/): Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot (high 8.1)
- [CVE-2022-1021](https://insights.sbomify.com/CVE-2022-1021/): Insecure Storage of Sensitive Information in chatwoot/chatwoot (high 7.6)
- [CVE-2022-1020](https://insights.sbomify.com/CVE-2022-1020/): Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call (critical 9.8)
- [CVE-2022-1019](https://insights.sbomify.com/CVE-2022-1019/): Automated Logic WebCtrl Server Open Redirection Vulnerability (medium 5.2)
- [CVE-2022-1018](https://insights.sbomify.com/CVE-2022-1018/): ICSA-22-088-01 Rockwell Automation ISaGRAF (medium 5.5)
- [CVE-2022-1016](https://insights.sbomify.com/CVE-2022-1016/): Use after free in Kernel (medium 5.5)
- [CVE-2022-1015](https://insights.sbomify.com/CVE-2022-1015/): Memory corruption in kernel (medium 6.6)
- [CVE-2022-1014](https://insights.sbomify.com/CVE-2022-1014/): WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-1013](https://insights.sbomify.com/CVE-2022-1013/): Personal Dictionary < 1.3.4 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-1012](https://insights.sbomify.com/CVE-2022-1012/): Denial of service in Kernel (high 8.2)
- [CVE-2022-1011](https://insights.sbomify.com/CVE-2022-1011/): Use after free in kernel (high 7.8)
- [CVE-2022-1010](https://insights.sbomify.com/CVE-2022-1010/): Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1009](https://insights.sbomify.com/CVE-2022-1009/): Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1008](https://insights.sbomify.com/CVE-2022-1008/): One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2022-1007](https://insights.sbomify.com/CVE-2022-1007/): Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1006](https://insights.sbomify.com/CVE-2022-1006/): Advanced Booking Calendar < 1.7.1 - Admin+ SQLi (high 7.2)
- [CVE-2022-1005](https://insights.sbomify.com/CVE-2022-1005/): WP Statistics < 13.2.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-1004](https://insights.sbomify.com/CVE-2022-1004/): Information disclosure in the External Interface (medium 4.3)
- [CVE-2022-1003](https://insights.sbomify.com/CVE-2022-1003/): Sysadmin can override existing configs & bypass restrictions like EnableUploads (low 3.3)
- [CVE-2022-1002](https://insights.sbomify.com/CVE-2022-1002/): HTML Injection while inviting Guests (low 2.0)
- [CVE-2022-1001](https://insights.sbomify.com/CVE-2022-1001/): WP Downgrade < 1.2.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-1000](https://insights.sbomify.com/CVE-2022-1000/): Path Traversal in prasathmani/tinyfilemanager (high 8.8)
- [CVE-2022-0999](https://insights.sbomify.com/CVE-2022-0999/): mySCADA myPRO Command Injection (high 8.8)
- [CVE-2022-0998](https://insights.sbomify.com/CVE-2022-0998/): Integer overflow in Kernel (high 7.8)
- [CVE-2022-0997](https://insights.sbomify.com/CVE-2022-0997/): Local Privilege Escalation Vulnerability in Fidelis Network and Deception (low 3.9)
- [CVE-2022-0996](https://insights.sbomify.com/CVE-2022-0996/): Auth bypass in 389-ds-base (medium 6.5)
- [CVE-2022-0995](https://insights.sbomify.com/CVE-2022-0995/): Linux Kernel Out-of-Bounds Write (high 7.8, exploited in the wild)
- [CVE-2022-0994](https://insights.sbomify.com/CVE-2022-0994/): Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0993](https://insights.sbomify.com/CVE-2022-0993/): SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass (high 8.1)
- [CVE-2022-0992](https://insights.sbomify.com/CVE-2022-0992/): SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup (critical 9.8)
- [CVE-2022-0991](https://insights.sbomify.com/CVE-2022-0991/): Insufficient Session Expiration in admidio/admidio (high 8.2)
- [CVE-2022-0990](https://insights.sbomify.com/CVE-2022-0990/): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (critical 9.3)
- [CVE-2022-0989](https://insights.sbomify.com/CVE-2022-0989/): NS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality (high 7.5)
- [CVE-2022-0988](https://insights.sbomify.com/CVE-2022-0988/): Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information (high 7.1)
- [CVE-2022-0987](https://insights.sbomify.com/CVE-2022-0987/): Information disclosure in PackageKit (low 3.3)
- [CVE-2022-0986](https://insights.sbomify.com/CVE-2022-0986/): Reflected Cross-site Scripting (XSS) Vulnerability in hestiacp/hestiacp (low 2.4)
- [CVE-2022-0985](https://insights.sbomify.com/CVE-2022-0985/): Improper Authentication in moodle (medium 4.3)
- [CVE-2022-0984](https://insights.sbomify.com/CVE-2022-0984/): Missing authorization in Moodle (medium 4.3)
- [CVE-2022-0983](https://insights.sbomify.com/CVE-2022-0983/): SQL Injection in Moodle (high 8.8)
- [CVE-2022-0982](https://insights.sbomify.com/CVE-2022-0982/): Buffer Overflow via crafted client request in Accel-PPP v1.12 (critical 9.8)
- [CVE-2022-0981](https://insights.sbomify.com/CVE-2022-0981/): Privilege escalation in quarkus (high 8.8)
- [CVE-2022-0980](https://insights.sbomify.com/CVE-2022-0980/): Use after free in Chrome (high 8.8)
- [CVE-2022-0979](https://insights.sbomify.com/CVE-2022-0979/): Use after free in Chrome (high 8.8)
- [CVE-2022-0978](https://insights.sbomify.com/CVE-2022-0978/): Use after free in Chrome (high 8.8)
- [CVE-2022-0977](https://insights.sbomify.com/CVE-2022-0977/): Use after free in Chrome (critical 9.6)
- [CVE-2022-0976](https://insights.sbomify.com/CVE-2022-0976/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0975](https://insights.sbomify.com/CVE-2022-0975/): Use after free in Chrome (high 8.8)
- [CVE-2022-0974](https://insights.sbomify.com/CVE-2022-0974/): Use after free in Chrome (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/424/