# Vulnerabilities published in 2022


- [CVE-2022-0866](https://insights.sbomify.com/CVE-2022-0866/): Race condition in Wildfly (medium 5.3)
- [CVE-2022-0865](https://insights.sbomify.com/CVE-2022-0865/): Denial of service in libtiff (medium 5.5)
- [CVE-2022-0864](https://insights.sbomify.com/CVE-2022-0864/): UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0863](https://insights.sbomify.com/CVE-2022-0863/): WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE) (high 7.2)
- [CVE-2022-0862](https://insights.sbomify.com/CVE-2022-0862/): ePO password change vulnerability (low 3.1)
- [CVE-2022-0861](https://insights.sbomify.com/CVE-2022-0861/): ePO XML extended entity vulnerability (low 3.5)
- [CVE-2022-0860](https://insights.sbomify.com/CVE-2022-0860/): Improper Authorization in cobbler/cobbler (high 8.2)
- [CVE-2022-0859](https://insights.sbomify.com/CVE-2022-0859/): ePO database restoration vulnerability (medium 6.5)
- [CVE-2022-0858](https://insights.sbomify.com/CVE-2022-0858/): Cross-site scripting vulnerability in ePO (medium 4.3)
- [CVE-2022-0857](https://insights.sbomify.com/CVE-2022-0857/): ePO Reflected Cross-site scripting vulnerability (medium 5.4)
- [CVE-2022-0856](https://insights.sbomify.com/CVE-2022-0856/): Denial of service in libcaca (medium 6.5)
- [CVE-2022-0855](https://insights.sbomify.com/CVE-2022-0855/): Improper Resolution of Path Equivalence in microweber-dev/whmcs_plugin (high 7.4)
- [CVE-2022-0854](https://insights.sbomify.com/CVE-2022-0854/): Information disclosure in Kernel (medium 5.5)
- [CVE-2022-0853](https://insights.sbomify.com/CVE-2022-0853/): Denial of service in jboss-client (high 7.5)
- [CVE-2022-0852](https://insights.sbomify.com/CVE-2022-0852/): Information disclosure in convert2rhel (medium 5.5)
- [CVE-2022-0851](https://insights.sbomify.com/CVE-2022-0851/): Information disclosure in convert2rhel (medium 5.5)
- [CVE-2022-0850](https://insights.sbomify.com/CVE-2022-0850/): Information disclosure in kernel (high 7.1)
- [CVE-2022-0849](https://insights.sbomify.com/CVE-2022-0849/): Use After Free in r_reg_get_name_idx in radareorg/radare2 (high 7.3)
- [CVE-2022-0848](https://insights.sbomify.com/CVE-2022-0848/): OS Command Injection in part-db/part-db (critical 10.0)
- [CVE-2022-0847](https://insights.sbomify.com/CVE-2022-0847/): Linux Kernel Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2022-0846](https://insights.sbomify.com/CVE-2022-0846/): SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0845](https://insights.sbomify.com/CVE-2022-0845/): Code Injection in pytorchlightning/pytorch-lightning (high 7.3)
- [CVE-2022-0843](https://insights.sbomify.com/CVE-2022-0843/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-0842](https://insights.sbomify.com/CVE-2022-0842/): ePO blind SQL Injection vulnerability (medium 5.4)
- [CVE-2022-0841](https://insights.sbomify.com/CVE-2022-0841/): OS Command Injection in ljharb/npm-lockfile (low 3.8)
- [CVE-2022-0840](https://insights.sbomify.com/CVE-2022-0840/): Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon (medium 4.8)
- [CVE-2022-0839](https://insights.sbomify.com/CVE-2022-0839/): Improper Restriction of XML External Entity Reference in liquibase/liquibase (high 7.3)
- [CVE-2022-0838](https://insights.sbomify.com/CVE-2022-0838/): Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp (medium 6.6)
- [CVE-2022-0837](https://insights.sbomify.com/CVE-2022-0837/): Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure (medium 5.4)
- [CVE-2022-0836](https://insights.sbomify.com/CVE-2022-0836/): SEMA API < 4.02 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0835](https://insights.sbomify.com/CVE-2022-0835/): AVEVA System Platform Cleartext Storage of Sensitive Information in Memory (high 8.1)
- [CVE-2022-0834](https://insights.sbomify.com/CVE-2022-0834/): Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName (high 7.2)
- [CVE-2022-0833](https://insights.sbomify.com/CVE-2022-0833/): Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure (medium 4.3)
- [CVE-2022-0832](https://insights.sbomify.com/CVE-2022-0832/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.6)
- [CVE-2022-0831](https://insights.sbomify.com/CVE-2022-0831/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.6)
- [CVE-2022-0830](https://insights.sbomify.com/CVE-2022-0830/): FormBuilder <= 1.08 - Stored Cross-Site Scripting via CSRF (medium 6.5)
- [CVE-2022-0829](https://insights.sbomify.com/CVE-2022-0829/): Improper Authorization in webmin/webmin (medium 5.4)
- [CVE-2022-0828](https://insights.sbomify.com/CVE-2022-0828/): Download Manager < 3.2.39 - Unauthenticated brute force of files master key (high 7.5)
- [CVE-2022-0827](https://insights.sbomify.com/CVE-2022-0827/): Bestbooks <= 2.6.3 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0826](https://insights.sbomify.com/CVE-2022-0826/): WP Video Gallery <= 1.7.1 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0825](https://insights.sbomify.com/CVE-2022-0825/): Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update (medium 5.4)
- [CVE-2022-0824](https://insights.sbomify.com/CVE-2022-0824/): Improper Access Control to Remote Code Execution in webmin/webmin (high 8.3)
- [CVE-2022-0823](https://insights.sbomify.com/CVE-2022-0823/): Information disclosure in Zyxel GS1200 series firmware (medium 6.2)
- [CVE-2022-0822](https://insights.sbomify.com/CVE-2022-0822/): Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcore (medium 5.4)
- [CVE-2022-0821](https://insights.sbomify.com/CVE-2022-0821/): Improper Authorization in orchardcms/orchardcore (high 7.1)
- [CVE-2022-0820](https://insights.sbomify.com/CVE-2022-0820/): Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore (medium 4.7)
- [CVE-2022-0819](https://insights.sbomify.com/CVE-2022-0819/): Code Injection in dolibarr/dolibarr (high 7.2)
- [CVE-2022-0818](https://insights.sbomify.com/CVE-2022-0818/): Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2022-0817](https://insights.sbomify.com/CVE-2022-0817/): BadgeOS <= 3.7.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0815](https://insights.sbomify.com/CVE-2022-0815/): McAfee WebAdvisor - Extension Fingerprinting vulnerability (medium 6.5)
- [CVE-2022-0814](https://insights.sbomify.com/CVE-2022-0814/): Ubigeo de Peru < 3.6.4 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0813](https://insights.sbomify.com/CVE-2022-0813/): PhpMyAdmin exposure of sensitive information (medium 5.3)
- [CVE-2022-0812](https://insights.sbomify.com/CVE-2022-0812/): Information disclosure in Kernel (medium 4.3)
- [CVE-2022-0811](https://insights.sbomify.com/CVE-2022-0811/): Code Injection in CRI-O (high 8.8)
- [CVE-2022-0809](https://insights.sbomify.com/CVE-2022-0809/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0808](https://insights.sbomify.com/CVE-2022-0808/): Use after free in Chrome (high 8.8)
- [CVE-2022-0807](https://insights.sbomify.com/CVE-2022-0807/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0806](https://insights.sbomify.com/CVE-2022-0806/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-0805](https://insights.sbomify.com/CVE-2022-0805/): Use after free in Chrome (high 8.8)
- [CVE-2022-0804](https://insights.sbomify.com/CVE-2022-0804/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0803](https://insights.sbomify.com/CVE-2022-0803/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0802](https://insights.sbomify.com/CVE-2022-0802/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0801](https://insights.sbomify.com/CVE-2022-0801/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2022-0800](https://insights.sbomify.com/CVE-2022-0800/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0799](https://insights.sbomify.com/CVE-2022-0799/): Privilege escalation in Chrome (high 8.8)
- [CVE-2022-0798](https://insights.sbomify.com/CVE-2022-0798/): Use after free in Chrome (high 8.8)
- [CVE-2022-0797](https://insights.sbomify.com/CVE-2022-0797/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0796](https://insights.sbomify.com/CVE-2022-0796/): Use after free in Chrome (high 8.8)
- [CVE-2022-0795](https://insights.sbomify.com/CVE-2022-0795/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0794](https://insights.sbomify.com/CVE-2022-0794/): Use after free in Chrome (high 8.8)
- [CVE-2022-0793](https://insights.sbomify.com/CVE-2022-0793/): Use after free in Chrome (high 8.8)
- [CVE-2022-0792](https://insights.sbomify.com/CVE-2022-0792/): Memory corruption in Chrome (medium 6.5)
- [CVE-2022-0791](https://insights.sbomify.com/CVE-2022-0791/): Use after free in Chrome (high 8.8)
- [CVE-2022-0790](https://insights.sbomify.com/CVE-2022-0790/): Use after free in Chrome (critical 9.6)
- [CVE-2022-0789](https://insights.sbomify.com/CVE-2022-0789/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0788](https://insights.sbomify.com/CVE-2022-0788/): WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0787](https://insights.sbomify.com/CVE-2022-0787/): Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0786](https://insights.sbomify.com/CVE-2022-0786/): KiviCare < 2.3.9 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0785](https://insights.sbomify.com/CVE-2022-0785/): Daily Prayer Time < 2022.03.01 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0784](https://insights.sbomify.com/CVE-2022-0784/): Title Experiments Free < 9.0.1 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0783](https://insights.sbomify.com/CVE-2022-0783/): Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0782](https://insights.sbomify.com/CVE-2022-0782/): Donations <= 1.8 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0781](https://insights.sbomify.com/CVE-2022-0781/): Nirweb support < 2.8.2 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0780](https://insights.sbomify.com/CVE-2022-0780/): SearchIQ < 3.9 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2022-0779](https://insights.sbomify.com/CVE-2022-0779/): User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal (medium 6.5)
- [CVE-2022-0778](https://insights.sbomify.com/CVE-2022-0778/): Infinite loop in BN_mod_sqrt() reachable when parsing certificates (high 7.5)
- [CVE-2022-0777](https://insights.sbomify.com/CVE-2022-0777/): Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber (high 7.3)
- [CVE-2022-0776](https://insights.sbomify.com/CVE-2022-0776/): Cross-site Scripting (XSS) - DOM in hakimel/reveal.js (medium 5.3)
- [CVE-2022-0775](https://insights.sbomify.com/CVE-2022-0775/): WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion (medium 4.3)
- [CVE-2022-0773](https://insights.sbomify.com/CVE-2022-0773/): Documentor <= 1.5.3 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0772](https://insights.sbomify.com/CVE-2022-0772/): Cross-site Scripting (XSS) - Stored in librenms/librenms (medium 4.7)
- [CVE-2022-0771](https://insights.sbomify.com/CVE-2022-0771/): SiteSuperCharger < 5.2.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0770](https://insights.sbomify.com/CVE-2022-0770/): Translate WordPress with GTranslate < 2.9.9 - CSRF to Account Takeover (high 8.8)
- [CVE-2022-0769](https://insights.sbomify.com/CVE-2022-0769/): Users Ultra <= 3.1.0 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-0768](https://insights.sbomify.com/CVE-2022-0768/): Server-Side Request Forgery (SSRF) in rudloff/alltube (high 8.6)
- [CVE-2022-0767](https://insights.sbomify.com/CVE-2022-0767/): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (critical 9.1)
- [CVE-2022-0766](https://insights.sbomify.com/CVE-2022-0766/): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (medium 6.5)
- [CVE-2022-0765](https://insights.sbomify.com/CVE-2022-0765/): Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-0764](https://insights.sbomify.com/CVE-2022-0764/): Arbitrary Command Injection in strapi/strapi (medium 6.1)
- [CVE-2022-0763](https://insights.sbomify.com/CVE-2022-0763/): Cross-site Scripting (XSS) - Stored in microweber/microweber (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/426/