# Vulnerabilities published in 2022


- [CVE-2022-0973](https://insights.sbomify.com/CVE-2022-0973/): Use after free in Chrome (critical 9.6)
- [CVE-2022-0972](https://insights.sbomify.com/CVE-2022-0972/): Use after free in Chrome (high 8.8)
- [CVE-2022-0971](https://insights.sbomify.com/CVE-2022-0971/): Use after free in Chrome (high 8.8)
- [CVE-2022-0970](https://insights.sbomify.com/CVE-2022-0970/): Cross-site Scripting (XSS) - Stored in getgrav/grav (high 7.1)
- [CVE-2022-0969](https://insights.sbomify.com/CVE-2022-0969/): Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0968](https://insights.sbomify.com/CVE-2022-0968/): Integer Overflow in microweber (high 7.2)
- [CVE-2022-0967](https://insights.sbomify.com/CVE-2022-0967/): Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc (medium 6.9)
- [CVE-2022-0966](https://insights.sbomify.com/CVE-2022-0966/): Stored XSS via File Upload in star7th/showdoc in star7th/showdoc (medium 6.4)
- [CVE-2022-0965](https://insights.sbomify.com/CVE-2022-0965/): Stored XSS viva .ofd file upload in star7th/showdoc (critical 9.0)
- [CVE-2022-0964](https://insights.sbomify.com/CVE-2022-0964/): Stored XSS viva .webmv file upload in star7th/showdoc (high 8.0)
- [CVE-2022-0963](https://insights.sbomify.com/CVE-2022-0963/): Unrestricted XML Files Leads to Stored XSS in microweber/microweber (medium 5.7)
- [CVE-2022-0962](https://insights.sbomify.com/CVE-2022-0962/): Stored XSS viva .webma file upload in star7th/showdoc (critical 9.0)
- [CVE-2022-0961](https://insights.sbomify.com/CVE-2022-0961/): Denial of service in microweber (high 7.1)
- [CVE-2022-0960](https://insights.sbomify.com/CVE-2022-0960/): Stored XSS viva .properties file upload in star7th/showdoc (critical 9.0)
- [CVE-2022-0959](https://insights.sbomify.com/CVE-2022-0959/): pgAdmin 4 Path Traversal vulnerability (medium 6.5)
- [CVE-2022-0958](https://insights.sbomify.com/CVE-2022-0958/): Mark Posts < 2.0.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0957](https://insights.sbomify.com/CVE-2022-0957/): Stored XSS via File Upload in star7th/showdoc (high 7.6)
- [CVE-2022-0956](https://insights.sbomify.com/CVE-2022-0956/): Stored XSS via File Upload in star7th/showdoc (high 7.1)
- [CVE-2022-0955](https://insights.sbomify.com/CVE-2022-0955/): Cross-site Scripting (XSS) - Stored in pimcore/data-hub (medium 6.5)
- [CVE-2022-0954](https://insights.sbomify.com/CVE-2022-0954/): Stored Cross-site Scripting in Microweber (medium 6.8)
- [CVE-2022-0953](https://insights.sbomify.com/CVE-2022-0953/): Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0952](https://insights.sbomify.com/CVE-2022-0952/): Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update (high 8.8)
- [CVE-2022-0951](https://insights.sbomify.com/CVE-2022-0951/): File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc (high 8.2)
- [CVE-2022-0950](https://insights.sbomify.com/CVE-2022-0950/): Unrestricted Upload of File with Dangerous Type in star7th/showdoc (medium 6.5)
- [CVE-2022-0949](https://insights.sbomify.com/CVE-2022-0949/): WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0948](https://insights.sbomify.com/CVE-2022-0948/): Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0947](https://insights.sbomify.com/CVE-2022-0947/): Arctic Wireless Gateway Firewall vulnerability (critical 9.0)
- [CVE-2022-0946](https://insights.sbomify.com/CVE-2022-0946/): Stored XSS viva cshtm file upload in star7th/showdoc (critical 9.0)
- [CVE-2022-0945](https://insights.sbomify.com/CVE-2022-0945/): Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc (critical 9.0)
- [CVE-2022-0944](https://insights.sbomify.com/CVE-2022-0944/): Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad (critical 9.1)
- [CVE-2022-0943](https://insights.sbomify.com/CVE-2022-0943/): Heap-based Buffer Overflow occurs in vim in vim/vim (high 8.4)
- [CVE-2022-0942](https://insights.sbomify.com/CVE-2022-0942/): Stored XSS due to Unrestricted File Upload in star7th/showdoc (critical 9.4)
- [CVE-2022-0941](https://insights.sbomify.com/CVE-2022-0941/): Stored XSS due to Unrestricted File Upload in star7th/showdoc (high 7.3)
- [CVE-2022-0940](https://insights.sbomify.com/CVE-2022-0940/): Stored XSS due to Unrestricted File Upload in star7th/showdoc (medium 6.3)
- [CVE-2022-0939](https://insights.sbomify.com/CVE-2022-0939/): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (critical 9.0)
- [CVE-2022-0938](https://insights.sbomify.com/CVE-2022-0938/): Stored XSS via file upload in star7th/showdoc (high 7.1)
- [CVE-2022-0937](https://insights.sbomify.com/CVE-2022-0937/): Stored xss in showdoc through file upload in star7th/showdoc (medium 6.3)
- [CVE-2022-0936](https://insights.sbomify.com/CVE-2022-0936/): Cross-site Scripting (XSS) - Stored in autolab/autolab (high 7.6)
- [CVE-2022-0935](https://insights.sbomify.com/CVE-2022-0935/): Host Header injection in password Reset in livehelperchat/livehelperchat (high 8.8)
- [CVE-2022-0934](https://insights.sbomify.com/CVE-2022-0934/): Use after free in dnsmasq (high 7.5)
- [CVE-2022-0932](https://insights.sbomify.com/CVE-2022-0932/): Missing Authorization in saleor/saleor (medium 6.5)
- [CVE-2022-0930](https://insights.sbomify.com/CVE-2022-0930/): File upload filter bypass leading to stored XSS in microweber/microweber (high 8.0)
- [CVE-2022-0929](https://insights.sbomify.com/CVE-2022-0929/): XSS on dynamic_text module in microweber/microweber (medium 6.8)
- [CVE-2022-0928](https://insights.sbomify.com/CVE-2022-0928/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 6.8)
- [CVE-2022-0926](https://insights.sbomify.com/CVE-2022-0926/): File upload filter bypass leading to stored XSS in microweber/microweber (high 7.1)
- [CVE-2022-0924](https://insights.sbomify.com/CVE-2022-0924/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-0923](https://insights.sbomify.com/CVE-2022-0923/): Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashx (critical 9.8)
- [CVE-2022-0922](https://insights.sbomify.com/CVE-2022-0922/): ICSMA-22-088-01 Philips e-Alert (medium 6.5)
- [CVE-2022-0921](https://insights.sbomify.com/CVE-2022-0921/): Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber (high 7.2)
- [CVE-2022-0920](https://insights.sbomify.com/CVE-2022-0920/): Salon booking system < 7.6.3 - Customer+ Bookings/Customers Data Disclosure (high 7.5)
- [CVE-2022-0919](https://insights.sbomify.com/CVE-2022-0919/): Salon booking system < 7.6.3 - Unauthenticated Sensitive Data Disclosure (medium 5.3)
- [CVE-2022-0918](https://insights.sbomify.com/CVE-2022-0918/): Denial of service in 389-ds-base (high 7.5)
- [CVE-2022-0916](https://insights.sbomify.com/CVE-2022-0916/): Broken authentication on Logitech Options due to misvalidation of Oauth state parameter (high 8.4)
- [CVE-2022-0915](https://insights.sbomify.com/CVE-2022-0915/): Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation (medium 6.0)
- [CVE-2022-0914](https://insights.sbomify.com/CVE-2022-0914/): Export All URLs < 4.3 - Private/Draft Post/Page Title Disclosure via CSRF (medium 6.5)
- [CVE-2022-0913](https://insights.sbomify.com/CVE-2022-0913/): Integer Overflow or Wraparound in microweber/microweber (critical 9.1)
- [CVE-2022-0912](https://insights.sbomify.com/CVE-2022-0912/): Unrestricted Upload of File with Dangerous Type in microweber/microweber (medium 4.8)
- [CVE-2022-0911](https://insights.sbomify.com/CVE-2022-0911/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.8)
- [CVE-2022-0910](https://insights.sbomify.com/CVE-2022-0910/): Auth bypass in ATP series firmware (medium 6.5)
- [CVE-2022-0909](https://insights.sbomify.com/CVE-2022-0909/): Denial of service in libtiff (medium 5.5)
- [CVE-2022-0908](https://insights.sbomify.com/CVE-2022-0908/): Null dereference in libtiff (high 7.7)
- [CVE-2022-0907](https://insights.sbomify.com/CVE-2022-0907/): Null dereference in libtiff (medium 5.5)
- [CVE-2022-0906](https://insights.sbomify.com/CVE-2022-0906/): Unrestricted file upload leads to stored XSS in microweber/microweber (medium 4.3)
- [CVE-2022-0905](https://insights.sbomify.com/CVE-2022-0905/): Missing Authorization in go-gitea/gitea (medium 6.5)
- [CVE-2022-0904](https://insights.sbomify.com/CVE-2022-0904/): Stack overflow in document extractor in Mattermost (medium 4.3)
- [CVE-2022-0903](https://insights.sbomify.com/CVE-2022-0903/): Stack overflow in SAML login in Mattermost (medium 5.3)
- [CVE-2022-0902](https://insights.sbomify.com/CVE-2022-0902/): ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access (high 8.1)
- [CVE-2022-0901](https://insights.sbomify.com/CVE-2022-0901/): Ad Inserter < 2.7.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0900](https://insights.sbomify.com/CVE-2022-0900/): Cross-Site Scripting Vulnerability in DivvyDrive (medium 5.4)
- [CVE-2022-0899](https://insights.sbomify.com/CVE-2022-0899/): Header Footer Code Manager < 1.1.24 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0898](https://insights.sbomify.com/CVE-2022-0898/): IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-0897](https://insights.sbomify.com/CVE-2022-0897/): Race condition in libvirt (medium 4.3)
- [CVE-2022-0896](https://insights.sbomify.com/CVE-2022-0896/): Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber (high 7.1)
- [CVE-2022-0895](https://insights.sbomify.com/CVE-2022-0895/): Static Code Injection in microweber/microweber (high 7.7)
- [CVE-2022-0894](https://insights.sbomify.com/CVE-2022-0894/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (high 8.2)
- [CVE-2022-0893](https://insights.sbomify.com/CVE-2022-0893/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.8)
- [CVE-2022-0892](https://insights.sbomify.com/CVE-2022-0892/): Export All URLs < 4.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0891](https://insights.sbomify.com/CVE-2022-0891/): Memory corruption in libtiff (medium 6.1)
- [CVE-2022-0890](https://insights.sbomify.com/CVE-2022-0890/): NULL Pointer Dereference in mruby/mruby (medium 5.5)
- [CVE-2022-0889](https://insights.sbomify.com/CVE-2022-0889/): Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting (high 7.2)
- [CVE-2022-0888](https://insights.sbomify.com/CVE-2022-0888/): Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload (critical 9.8)
- [CVE-2022-0887](https://insights.sbomify.com/CVE-2022-0887/): Easy Social Icons < 3.1.4 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-0885](https://insights.sbomify.com/CVE-2022-0885/): Member Hero <= 1.0.9 - Unauthenticated RCE (critical 9.8)
- [CVE-2022-0884](https://insights.sbomify.com/CVE-2022-0884/): Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0883](https://insights.sbomify.com/CVE-2022-0883/): Windows Unquoted/Trusted Service Paths (high 7.3)
- [CVE-2022-0882](https://insights.sbomify.com/CVE-2022-0882/): Illegal access to Kernel log in Fuchsia (medium 5.3)
- [CVE-2022-0881](https://insights.sbomify.com/CVE-2022-0881/): Insecure Storage of Sensitive Information in chocobozzz/peertube (high 7.6)
- [CVE-2022-0880](https://insights.sbomify.com/CVE-2022-0880/): Cross-site Scripting (XSS) - Stored in star7th/showdoc (high 7.6)
- [CVE-2022-0879](https://insights.sbomify.com/CVE-2022-0879/): Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0878](https://insights.sbomify.com/CVE-2022-0878/): Novel attack against the Combined Charging System (CCS) in electric vehicles to remotely cause a denial of service (medium 4.6)
- [CVE-2022-0877](https://insights.sbomify.com/CVE-2022-0877/): Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack (high 7.6)
- [CVE-2022-0876](https://insights.sbomify.com/CVE-2022-0876/): Social comments by WpDevArt < 2.5.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0875](https://insights.sbomify.com/CVE-2022-0875/): miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting (medium 4.3)
- [CVE-2022-0874](https://insights.sbomify.com/CVE-2022-0874/): WP Social Buttons <= 2.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0873](https://insights.sbomify.com/CVE-2022-0873/): Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0871](https://insights.sbomify.com/CVE-2022-0871/): Missing Authorization in gogs/gogs (high 8.2)
- [CVE-2022-0870](https://insights.sbomify.com/CVE-2022-0870/): Server-Side Request Forgery (SSRF) in gogs/gogs (medium 5.0)
- [CVE-2022-0869](https://insights.sbomify.com/CVE-2022-0869/): Multiple Open Redirect in nitely/spirit (medium 4.3)
- [CVE-2022-0868](https://insights.sbomify.com/CVE-2022-0868/): Open Redirect in medialize/uri.js (high 8.0)
- [CVE-2022-0867](https://insights.sbomify.com/CVE-2022-0867/): ARPrice Lite < 3.6.1 - Unauthenticated SQLi (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/425/