# Vulnerabilities published in 2022


- [CVE-2022-0762](https://insights.sbomify.com/CVE-2022-0762/): Incorrect Authorization in microweber/microweber (medium 5.5)
- [CVE-2022-0760](https://insights.sbomify.com/CVE-2022-0760/): Simple Link Directory < 7.7.2 - Unauthenticated SQL injection (critical 9.8)
- [CVE-2022-0759](https://insights.sbomify.com/CVE-2022-0759/): Improper Certificate Validation in kubeclient (high 8.1)
- [CVE-2022-0758](https://insights.sbomify.com/CVE-2022-0758/): Rapid7 Nexpose Reflected XSS (low 3.3)
- [CVE-2022-0757](https://insights.sbomify.com/CVE-2022-0757/): Rapid7 Nexpose SQL Injection (medium 5.5)
- [CVE-2022-0756](https://insights.sbomify.com/CVE-2022-0756/): Missing Authorization in salesagility/suitecrm (medium 5.4)
- [CVE-2022-0755](https://insights.sbomify.com/CVE-2022-0755/): Missing Authorization in salesagility/suitecrm (high 7.1)
- [CVE-2022-0754](https://insights.sbomify.com/CVE-2022-0754/): SQL Injection in salesagility/suitecrm (high 7.1)
- [CVE-2022-0753](https://insights.sbomify.com/CVE-2022-0753/): Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp (low 3.5)
- [CVE-2022-0752](https://insights.sbomify.com/CVE-2022-0752/): Cross-site Scripting (XSS) - Generic in hestiacp/hestiacp (low 3.5)
- [CVE-2022-0751](https://insights.sbomify.com/CVE-2022-0751/): Other in GitLab (medium 6.5)
- [CVE-2022-0750](https://insights.sbomify.com/CVE-2022-0750/): Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting (medium 6.4)
- [CVE-2022-0749](https://insights.sbomify.com/CVE-2022-0749/): Deserialization of Untrusted Data (high 7.4)
- [CVE-2022-0748](https://insights.sbomify.com/CVE-2022-0748/): Arbitrary Code Execution (critical 9.8)
- [CVE-2022-0747](https://insights.sbomify.com/CVE-2022-0747/): Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-0746](https://insights.sbomify.com/CVE-2022-0746/): Business Logic Errors in dolibarr/dolibarr (medium 4.3)
- [CVE-2022-0745](https://insights.sbomify.com/CVE-2022-0745/): Like Button Rating < 2.6.45 - Arbitrary e-mail Sending (medium 6.5)
- [CVE-2022-0743](https://insights.sbomify.com/CVE-2022-0743/): Cross-site Scripting (XSS) - Stored in getgrav/grav (medium 4.6)
- [CVE-2022-0742](https://insights.sbomify.com/CVE-2022-0742/): Memory leak in ICMP6 in Linux Kernel (critical 9.1)
- [CVE-2022-0741](https://insights.sbomify.com/CVE-2022-0741/): Information disclosure in GitLab (medium 5.8)
- [CVE-2022-0740](https://insights.sbomify.com/CVE-2022-0740/): Missing authorization in GitLab (low 3.1)
- [CVE-2022-0739](https://insights.sbomify.com/CVE-2022-0739/): BookingPress < 1.0.11 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-0738](https://insights.sbomify.com/CVE-2022-0738/): Information disclosure in GitLab (medium 4.2)
- [CVE-2022-0737](https://insights.sbomify.com/CVE-2022-0737/): Text Hover < 4.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0736](https://insights.sbomify.com/CVE-2022-0736/): Insecure Temporary File in mlflow/mlflow (high 8.2)
- [CVE-2022-0735](https://insights.sbomify.com/CVE-2022-0735/): Information disclosure in GitLab (critical 10.0)
- [CVE-2022-0734](https://insights.sbomify.com/CVE-2022-0734/): Cross-site scripting in ATP series firmware (medium 5.8)
- [CVE-2022-0732](https://insights.sbomify.com/CVE-2022-0732/): Missing authorization in Copy9 (high 7.5)
- [CVE-2022-0731](https://insights.sbomify.com/CVE-2022-0731/): Improper Access Control (IDOR) in dolibarr/dolibarr (medium 5.4)
- [CVE-2022-0730](https://insights.sbomify.com/CVE-2022-0730/): Auth bypass in Cati (critical 9.8)
- [CVE-2022-0729](https://insights.sbomify.com/CVE-2022-0729/): Use of Out-of-range Pointer Offset in vim/vim (high 7.8)
- [CVE-2022-0728](https://insights.sbomify.com/CVE-2022-0728/): Easy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0727](https://insights.sbomify.com/CVE-2022-0727/): Improper Access Control in chocobozzz/peertube (medium 5.4)
- [CVE-2022-0726](https://insights.sbomify.com/CVE-2022-0726/): Missing Authorization in chocobozzz/peertube (medium 5.4)
- [CVE-2022-0725](https://insights.sbomify.com/CVE-2022-0725/): Information disclosure in keepass (high 7.5)
- [CVE-2022-0724](https://insights.sbomify.com/CVE-2022-0724/): Insecure Storage of Sensitive Information in microweber/microweber (critical 9.1)
- [CVE-2022-0723](https://insights.sbomify.com/CVE-2022-0723/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (high 8.0)
- [CVE-2022-0722](https://insights.sbomify.com/CVE-2022-0722/): Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url (medium 4.8)
- [CVE-2022-0721](https://insights.sbomify.com/CVE-2022-0721/): Insertion of Sensitive Information Into Debugging Code in microweber/microweber (high 8.8)
- [CVE-2022-0720](https://insights.sbomify.com/CVE-2022-0720/): Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure (medium 5.4)
- [CVE-2022-0719](https://insights.sbomify.com/CVE-2022-0719/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (high 7.6)
- [CVE-2022-0718](https://insights.sbomify.com/CVE-2022-0718/): python-oslo-utils has improper password parsing (medium 4.9)
- [CVE-2022-0717](https://insights.sbomify.com/CVE-2022-0717/): Out-of-bounds Read in mruby/mruby (medium 6.8)
- [CVE-2022-0715](https://insights.sbomify.com/CVE-2022-0715/): Auth bypass in APC Smart-UPS (high 8.9)
- [CVE-2022-0714](https://insights.sbomify.com/CVE-2022-0714/): Heap-based Buffer Overflow in vim/vim (high 8.4)
- [CVE-2022-0713](https://insights.sbomify.com/CVE-2022-0713/): Heap-based Buffer Overflow in radareorg/radare2 (medium 5.3)
- [CVE-2022-0712](https://insights.sbomify.com/CVE-2022-0712/): NULL Pointer Dereference in radareorg/radare2 (medium 5.9)
- [CVE-2022-0711](https://insights.sbomify.com/CVE-2022-0711/): Denial of service in haproxy (high 7.5)
- [CVE-2022-0710](https://insights.sbomify.com/CVE-2022-0710/): Header Footer Code Manager <= 1.1.16 Reflected XSS (medium 6.1)
- [CVE-2022-0709](https://insights.sbomify.com/CVE-2022-0709/): Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure (high 7.5)
- [CVE-2022-0708](https://insights.sbomify.com/CVE-2022-0708/): Team Creator's Email Address is disclosed to Team Members via one of the APIs (medium 4.3)
- [CVE-2022-0707](https://insights.sbomify.com/CVE-2022-0707/): Easy Digital Downloads < 2.11.6 - Arbitrary Payment Note Insertion via CSRF (medium 4.3)
- [CVE-2022-0706](https://insights.sbomify.com/CVE-2022-0706/): Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0705](https://insights.sbomify.com/CVE-2022-0705/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.2)
- [CVE-2022-0704](https://insights.sbomify.com/CVE-2022-0704/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.0)
- [CVE-2022-0703](https://insights.sbomify.com/CVE-2022-0703/): GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0702](https://insights.sbomify.com/CVE-2022-0702/): Petfinder Listings <= 1.0.18 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0701](https://insights.sbomify.com/CVE-2022-0701/): SEO 301 Meta <= 1.9.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0700](https://insights.sbomify.com/CVE-2022-0700/): Simple Theme Options < 1.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0699](https://insights.sbomify.com/CVE-2022-0699/): Memory corruption in shapelib (critical 9.8)
- [CVE-2022-0698](https://insights.sbomify.com/CVE-2022-0698/): Microweber vulnerable to cross-site scripting (XSS) (medium 6.1)
- [CVE-2022-0697](https://insights.sbomify.com/CVE-2022-0697/): Open Redirect in archivy/archivy (low 3.4)
- [CVE-2022-0696](https://insights.sbomify.com/CVE-2022-0696/): NULL Pointer Dereference in vim/vim (medium 6.2)
- [CVE-2022-0695](https://insights.sbomify.com/CVE-2022-0695/): Denial of Service in radareorg/radare2 (medium 6.8)
- [CVE-2022-0694](https://insights.sbomify.com/CVE-2022-0694/): Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-0693](https://insights.sbomify.com/CVE-2022-0693/): Master Elements <= 8.0 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0692](https://insights.sbomify.com/CVE-2022-0692/): Open Redirect on Rudloff/alltube in rudloff/alltube (medium 4.7)
- [CVE-2022-0691](https://insights.sbomify.com/CVE-2022-0691/): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (medium 6.5)
- [CVE-2022-0690](https://insights.sbomify.com/CVE-2022-0690/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (high 8.8)
- [CVE-2022-0689](https://insights.sbomify.com/CVE-2022-0689/): Use multiple time the one-time coupon in microweber/microweber (medium 5.3)
- [CVE-2022-0688](https://insights.sbomify.com/CVE-2022-0688/): Business Logic Errors in microweber/microweber (critical 9.4)
- [CVE-2022-0687](https://insights.sbomify.com/CVE-2022-0687/): Amelia < 1.0.46 - Manager+ RCE (high 8.8)
- [CVE-2022-0686](https://insights.sbomify.com/CVE-2022-0686/): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (medium 6.5)
- [CVE-2022-0685](https://insights.sbomify.com/CVE-2022-0685/): Use of Out-of-range Pointer Offset in vim/vim (high 8.4)
- [CVE-2022-0684](https://insights.sbomify.com/CVE-2022-0684/): WP Home Page Menu < 3.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0683](https://insights.sbomify.com/CVE-2022-0683/): Essential Addons for Elementor Lite <= 5.0.8 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0681](https://insights.sbomify.com/CVE-2022-0681/): Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF (medium 6.5)
- [CVE-2022-0680](https://insights.sbomify.com/CVE-2022-0680/): Plezi < 1.0.3 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2022-0679](https://insights.sbomify.com/CVE-2022-0679/): Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE (critical 9.8)
- [CVE-2022-0678](https://insights.sbomify.com/CVE-2022-0678/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (medium 6.5)
- [CVE-2022-0677](https://insights.sbomify.com/CVE-2022-0677/): Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) (high 7.5)
- [CVE-2022-0676](https://insights.sbomify.com/CVE-2022-0676/): Heap-based Buffer Overflow in radareorg/radare2 (high 7.8)
- [CVE-2022-0675](https://insights.sbomify.com/CVE-2022-0675/): Puppet Firewall Module May Leave Unmanaged Rules (medium 5.6)
- [CVE-2022-0674](https://insights.sbomify.com/CVE-2022-0674/): Kunze Law < 2.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0673](https://insights.sbomify.com/CVE-2022-0673/): Path Traversal in LemMinX (medium 6.5)
- [CVE-2022-0672](https://insights.sbomify.com/CVE-2022-0672/): Exposure of Sensitive Information to an Unauthorized Actor in LemMinX (medium 5.5)
- [CVE-2022-0671](https://insights.sbomify.com/CVE-2022-0671/): Server-Side Request Forgery and Uncontrolled Resource Consumption in LemMinX (critical 9.1)
- [CVE-2022-0670](https://insights.sbomify.com/CVE-2022-0670/): Missing authorization in Ceph (critical 9.1)
- [CVE-2022-0669](https://insights.sbomify.com/CVE-2022-0669/): Denial of service in DPDK (medium 6.5)
- [CVE-2022-0668](https://insights.sbomify.com/CVE-2022-0668/): Auth bypass in JFrog Artifactory (medium 5.3)
- [CVE-2022-0667](https://insights.sbomify.com/CVE-2022-0667/): Assertion failure on delayed DS lookup (high 7.5)
- [CVE-2022-0666](https://insights.sbomify.com/CVE-2022-0666/): CRLF Injection in microweber (high 7.6)
- [CVE-2022-0665](https://insights.sbomify.com/CVE-2022-0665/): Path Traversal in pimcore/pimcore (medium 4.9)
- [CVE-2022-0664](https://insights.sbomify.com/CVE-2022-0664/): Use of Hard-coded Cryptographic Key in gravitl/netmaker (high 8.8)
- [CVE-2022-0663](https://insights.sbomify.com/CVE-2022-0663/): Print, PDF, Email by PrintFriendly < 5.2.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0662](https://insights.sbomify.com/CVE-2022-0662/): Adrotate < 5.8.23 - Admin+ XSS via Advert Name (medium 4.8)
- [CVE-2022-0661](https://insights.sbomify.com/CVE-2022-0661/): Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE (high 7.2)
- [CVE-2022-0660](https://insights.sbomify.com/CVE-2022-0660/): Generation of Error Message Containing Sensitive Information in microweber/microweber (critical 9.4)
- [CVE-2022-0659](https://insights.sbomify.com/CVE-2022-0659/): Sync iCloud COS < 2.0.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0658](https://insights.sbomify.com/CVE-2022-0658/): CommonsBooking < 2.6.8 - Unauthenticated SQL Injection (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/427/