# Vulnerabilities published in 2022


- [CVE-2022-0657](https://insights.sbomify.com/CVE-2022-0657/): 5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0656](https://insights.sbomify.com/CVE-2022-0656/): uDraw < 3.3.3 - Unauthenticated Arbitrary File Access (high 7.5)
- [CVE-2022-0654](https://insights.sbomify.com/CVE-2022-0654/): Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retry (high 8.1)
- [CVE-2022-0653](https://insights.sbomify.com/CVE-2022-0653/): Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0652](https://insights.sbomify.com/CVE-2022-0652/): Information disclosure in Sophos UTM (low 3.3)
- [CVE-2022-0651](https://insights.sbomify.com/CVE-2022-0651/): WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type (critical 9.8)
- [CVE-2022-0650](https://insights.sbomify.com/CVE-2022-0650/): Memory corruption in TL-WR940N (medium 6.8)
- [CVE-2022-0649](https://insights.sbomify.com/CVE-2022-0649/): Adrotate < 5.8.23 - Admin+ XSS via Group Name (medium 4.8)
- [CVE-2022-0648](https://insights.sbomify.com/CVE-2022-0648/): Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0647](https://insights.sbomify.com/CVE-2022-0647/): Bulk Creator <= 1.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0646](https://insights.sbomify.com/CVE-2022-0646/): Use after free in Kernel (high 7.8)
- [CVE-2022-0645](https://insights.sbomify.com/CVE-2022-0645/): Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in posthog/posthog (medium 6.1)
- [CVE-2022-0643](https://insights.sbomify.com/CVE-2022-0643/): Bank Mellat <= 1.3.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0642](https://insights.sbomify.com/CVE-2022-0642/): JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF (medium 5.4)
- [CVE-2022-0641](https://insights.sbomify.com/CVE-2022-0641/): Popup Like box < 3.6.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0640](https://insights.sbomify.com/CVE-2022-0640/): AP Pricing Tables Lite < 1.1.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0639](https://insights.sbomify.com/CVE-2022-0639/): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (medium 6.5)
- [CVE-2022-0638](https://insights.sbomify.com/CVE-2022-0638/): Cross-Site Request Forgery (CSRF) in microweber/microweber (medium 4.3)
- [CVE-2022-0637](https://insights.sbomify.com/CVE-2022-0637/): open redirect in pollbot (medium 6.1)
- [CVE-2022-0636](https://insights.sbomify.com/CVE-2022-0636/): Memory corruption in Thin Installer (medium 5.0)
- [CVE-2022-0635](https://insights.sbomify.com/CVE-2022-0635/): Denial of service in BIND (high 7.5)
- [CVE-2022-0634](https://insights.sbomify.com/CVE-2022-0634/): ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF (medium 4.3)
- [CVE-2022-0633](https://insights.sbomify.com/CVE-2022-0633/): UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download (medium 6.5)
- [CVE-2022-0632](https://insights.sbomify.com/CVE-2022-0632/): NULL Pointer Dereference in mruby/mruby (medium 5.5)
- [CVE-2022-0631](https://insights.sbomify.com/CVE-2022-0631/): Heap-based Buffer Overflow in mruby/mruby (medium 5.9)
- [CVE-2022-0630](https://insights.sbomify.com/CVE-2022-0630/): Out-of-bounds Read in mruby/mruby (high 7.1)
- [CVE-2022-0629](https://insights.sbomify.com/CVE-2022-0629/): Stack-based Buffer Overflow in vim/vim (high 8.4)
- [CVE-2022-0628](https://insights.sbomify.com/CVE-2022-0628/): AP Mega Menu < 3.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0627](https://insights.sbomify.com/CVE-2022-0627/): Amelia < 1.0.46 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0626](https://insights.sbomify.com/CVE-2022-0626/): Advanced Admin Search < 1.1.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0625](https://insights.sbomify.com/CVE-2022-0625/): Admin Menu Editor <= 1.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0624](https://insights.sbomify.com/CVE-2022-0624/): Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path (medium 6.5)
- [CVE-2022-0623](https://insights.sbomify.com/CVE-2022-0623/): Out-of-bounds Read in mruby/mruby (medium 6.5)
- [CVE-2022-0622](https://insights.sbomify.com/CVE-2022-0622/): Generation of Error Message Containing Sensitive Information in snipe/snipe-it (medium 5.3)
- [CVE-2022-0621](https://insights.sbomify.com/CVE-2022-0621/): dTabs <= 1.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0620](https://insights.sbomify.com/CVE-2022-0620/): Delete Old Orders <= 0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0619](https://insights.sbomify.com/CVE-2022-0619/): Database Peek <= 1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0618](https://insights.sbomify.com/CVE-2022-0618/): Denial of service via HTTP/2 HEADERS frames padding (high 7.5)
- [CVE-2022-0617](https://insights.sbomify.com/CVE-2022-0617/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-0616](https://insights.sbomify.com/CVE-2022-0616/): Amelia < 1.0.46 - Arbitrary Customer Deletion via CSRF (medium 4.3)
- [CVE-2022-0615](https://insights.sbomify.com/CVE-2022-0615/): Use-after-free vulnerability in ESET products for Linux (medium 5.9)
- [CVE-2022-0614](https://insights.sbomify.com/CVE-2022-0614/): Use of Out-of-range Pointer Offset in mruby/mruby (high 8.4)
- [CVE-2022-0613](https://insights.sbomify.com/CVE-2022-0613/): Authorization Bypass Through User-Controlled Key in medialize/uri.js (medium 5.3)
- [CVE-2022-0612](https://insights.sbomify.com/CVE-2022-0612/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.7)
- [CVE-2022-0611](https://insights.sbomify.com/CVE-2022-0611/): Missing Authorization in snipe/snipe-it (medium 6.3)
- [CVE-2022-0610](https://insights.sbomify.com/CVE-2022-0610/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0609](https://insights.sbomify.com/CVE-2022-0609/): Google Chromium Animation Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2022-0608](https://insights.sbomify.com/CVE-2022-0608/): Integer overflow in Chrome (high 8.8)
- [CVE-2022-0607](https://insights.sbomify.com/CVE-2022-0607/): Use after free in Chrome (high 8.8)
- [CVE-2022-0606](https://insights.sbomify.com/CVE-2022-0606/): Use after free in Chrome (high 8.8)
- [CVE-2022-0605](https://insights.sbomify.com/CVE-2022-0605/): Use after free in Chrome (high 8.8)
- [CVE-2022-0604](https://insights.sbomify.com/CVE-2022-0604/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0603](https://insights.sbomify.com/CVE-2022-0603/): Use after free in Chrome (high 8.8)
- [CVE-2022-0602](https://insights.sbomify.com/CVE-2022-0602/): Cross-site Scripting (XSS) - DOM in tastyigniter/tastyigniter (high 7.4)
- [CVE-2022-0601](https://insights.sbomify.com/CVE-2022-0601/): Countdown & Clock < 2.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0600](https://insights.sbomify.com/CVE-2022-0600/): Conference Scheduler < 2.4.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0599](https://insights.sbomify.com/CVE-2022-0599/): Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0598](https://insights.sbomify.com/CVE-2022-0598/): Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS (medium 4.8)
- [CVE-2022-0597](https://insights.sbomify.com/CVE-2022-0597/): Open Redirect in microweber/microweber (medium 4.3)
- [CVE-2022-0596](https://insights.sbomify.com/CVE-2022-0596/): Improper Validation of Specified Quantity in Input in microweber/microweber (medium 5.4)
- [CVE-2022-0595](https://insights.sbomify.com/CVE-2022-0595/): Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS (medium 5.4)
- [CVE-2022-0594](https://insights.sbomify.com/CVE-2022-0594/): Shareaholic < 9.7.6 - Information Disclosure (medium 5.3)
- [CVE-2022-0593](https://insights.sbomify.com/CVE-2022-0593/): Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion (medium 6.5)
- [CVE-2022-0592](https://insights.sbomify.com/CVE-2022-0592/): MapSVG < 6.2.20 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-0591](https://insights.sbomify.com/CVE-2022-0591/): Formcraft3 < 3.8.28 - Unauthenticated SSRF (critical 9.1)
- [CVE-2022-0590](https://insights.sbomify.com/CVE-2022-0590/): BulletProof Security < 5.8 - Admin+ Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2022-0589](https://insights.sbomify.com/CVE-2022-0589/): Cross-site Scripting (XSS) - Stored in librenms/librenms (medium 5.4)
- [CVE-2022-0588](https://insights.sbomify.com/CVE-2022-0588/): Missing Authorization in librenms/librenms (high 7.1)
- [CVE-2022-0587](https://insights.sbomify.com/CVE-2022-0587/): Improper Authorization in librenms/librenms (high 7.1)
- [CVE-2022-0586](https://insights.sbomify.com/CVE-2022-0586/): Denial of service in Wireshark (medium 6.3)
- [CVE-2022-0585](https://insights.sbomify.com/CVE-2022-0585/): Denial of service in Wireshark (medium 4.3)
- [CVE-2022-0583](https://insights.sbomify.com/CVE-2022-0583/): Memory corruption in Wireshark (medium 6.3)
- [CVE-2022-0582](https://insights.sbomify.com/CVE-2022-0582/): Null dereference in Wireshark (medium 6.3)
- [CVE-2022-0581](https://insights.sbomify.com/CVE-2022-0581/): Use after free in Wireshark (medium 6.3)
- [CVE-2022-0580](https://insights.sbomify.com/CVE-2022-0580/): Incorrect Authorization in librenms/librenms (high 7.1)
- [CVE-2022-0579](https://insights.sbomify.com/CVE-2022-0579/): Missing Authorization in snipe/snipe-it (medium 6.5)
- [CVE-2022-0578](https://insights.sbomify.com/CVE-2022-0578/): Code Injection in publify/publify (medium 5.3)
- [CVE-2022-0577](https://insights.sbomify.com/CVE-2022-0577/): Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy (high 8.8)
- [CVE-2022-0576](https://insights.sbomify.com/CVE-2022-0576/): Cross-site Scripting (XSS) - Generic in librenms/librenms (medium 5.4)
- [CVE-2022-0575](https://insights.sbomify.com/CVE-2022-0575/): Cross-site Scripting (XSS) - Stored in librenms/librenms (medium 5.4)
- [CVE-2022-0574](https://insights.sbomify.com/CVE-2022-0574/): Improper Access Control in publify/publify (medium 5.3)
- [CVE-2022-0573](https://insights.sbomify.com/CVE-2022-0573/): Deserialization in JFrog Artifactory (high 8.8)
- [CVE-2022-0572](https://insights.sbomify.com/CVE-2022-0572/): Heap-based Buffer Overflow in vim/vim (high 8.4)
- [CVE-2022-0571](https://insights.sbomify.com/CVE-2022-0571/): Cross-site Scripting (XSS) - Reflected in phoronix-test-suite/phoronix-test-suite (medium 6.8)
- [CVE-2022-0570](https://insights.sbomify.com/CVE-2022-0570/): Heap-based Buffer Overflow in mruby/mruby (high 8.4)
- [CVE-2022-0569](https://insights.sbomify.com/CVE-2022-0569/): Observable Discrepancy in snipe/snipe-it (medium 5.3)
- [CVE-2022-0567](https://insights.sbomify.com/CVE-2022-0567/): Security feature bypass in ovn-kubernetes (critical 9.1)
- [CVE-2022-0566](https://insights.sbomify.com/CVE-2022-0566/): Memory corruption in Thunderbird (high 8.8)
- [CVE-2022-0565](https://insights.sbomify.com/CVE-2022-0565/): Cross-site Scripting in pimcore/pimcore (high 7.6)
- [CVE-2022-0564](https://insights.sbomify.com/CVE-2022-0564/): Qlik Sense Enterprise Domain User enumeration (medium 5.3)
- [CVE-2022-0563](https://insights.sbomify.com/CVE-2022-0563/): Information disclosure in util-linux (medium 5.5)
- [CVE-2022-0562](https://insights.sbomify.com/CVE-2022-0562/): Null dereference in libtiff (medium 5.5)
- [CVE-2022-0561](https://insights.sbomify.com/CVE-2022-0561/): Null dereference in libtiff (medium 5.5)
- [CVE-2022-0560](https://insights.sbomify.com/CVE-2022-0560/): Open Redirect in microweber/microweber (medium 4.3)
- [CVE-2022-0559](https://insights.sbomify.com/CVE-2022-0559/): Use After Free in radareorg/radare2 (high 8.4)
- [CVE-2022-0558](https://insights.sbomify.com/CVE-2022-0558/): Cross-site Scripting (XSS) - Stored in microweber/microweber (critical 9.8)
- [CVE-2022-0557](https://insights.sbomify.com/CVE-2022-0557/): OS Command Injection in microweber/microweber (high 8.1)
- [CVE-2022-0556](https://insights.sbomify.com/CVE-2022-0556/): Privilege escalation in Zyxel AP Configurator (ZAC) (high 7.3)
- [CVE-2022-0555](https://insights.sbomify.com/CVE-2022-0555/): Information disclosure in subiquity (high 8.4)
- [CVE-2022-0554](https://insights.sbomify.com/CVE-2022-0554/): Use of Out-of-range Pointer Offset in vim/vim (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/428/