# Vulnerabilities published in 2022


- [CVE-2022-0553](https://insights.sbomify.com/CVE-2022-0553/): Possible to retrieve uncrypted firmware image (medium 6.5)
- [CVE-2022-0552](https://insights.sbomify.com/CVE-2022-0552/): Other in origin-aggregated-logging/elasticsearch (medium 5.9)
- [CVE-2022-0551](https://insights.sbomify.com/CVE-2022-0551/): Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 (high 8.6)
- [CVE-2022-0550](https://insights.sbomify.com/CVE-2022-0550/): Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 (high 8.6)
- [CVE-2022-0549](https://insights.sbomify.com/CVE-2022-0549/): Missing authorization in GitLab (medium 6.5)
- [CVE-2022-0547](https://insights.sbomify.com/CVE-2022-0547/): Auth bypass in OpenVPN (critical 9.8)
- [CVE-2022-0546](https://insights.sbomify.com/CVE-2022-0546/): Memory corruption in Blender (high 7.8)
- [CVE-2022-0545](https://insights.sbomify.com/CVE-2022-0545/): Integer overflow in Blender (high 7.8)
- [CVE-2022-0544](https://insights.sbomify.com/CVE-2022-0544/): Integer overflow in Blender (medium 5.5)
- [CVE-2022-0543](https://insights.sbomify.com/CVE-2022-0543/): Debian-specific Redis Server Lua Sandbox Escape (critical 10.0, exploited in the wild)
- [CVE-2022-0542](https://insights.sbomify.com/CVE-2022-0542/): Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot (high 8.8)
- [CVE-2022-0541](https://insights.sbomify.com/CVE-2022-0541/): Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover (critical 9.8)
- [CVE-2022-0540](https://insights.sbomify.com/CVE-2022-0540/): Auth bypass in Jira Core Server (critical 9.8)
- [CVE-2022-0539](https://insights.sbomify.com/CVE-2022-0539/): Cross-site Scripting (XSS) - Stored in ptrofimov/beanstalk_console (medium 6.3)
- [CVE-2022-0538](https://insights.sbomify.com/CVE-2022-0538/): DoS vulnerability in bundled XStream library in Jenkins Core (high 7.5)
- [CVE-2022-0537](https://insights.sbomify.com/CVE-2022-0537/): MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution (high 7.2)
- [CVE-2022-0536](https://insights.sbomify.com/CVE-2022-0536/): Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects (low 2.6)
- [CVE-2022-0535](https://insights.sbomify.com/CVE-2022-0535/): E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2022-0534](https://insights.sbomify.com/CVE-2022-0534/): Memory corruption in htmldoc (medium 5.5)
- [CVE-2022-0533](https://insights.sbomify.com/CVE-2022-0533/): Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-0532](https://insights.sbomify.com/CVE-2022-0532/): Incorrect Permission Assignment for Critical Resource in CRI-O (medium 4.2)
- [CVE-2022-0531](https://insights.sbomify.com/CVE-2022-0531/): WPvivid Backup and Migration Plugin < 0.9.70 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0530](https://insights.sbomify.com/CVE-2022-0530/): Memory corruption in unzip (medium 5.5)
- [CVE-2022-0529](https://insights.sbomify.com/CVE-2022-0529/): Memory corruption in unzip (medium 5.5)
- [CVE-2022-0528](https://insights.sbomify.com/CVE-2022-0528/): Server-Side Request Forgery (SSRF) in transloadit/uppy (medium 6.5)
- [CVE-2022-0527](https://insights.sbomify.com/CVE-2022-0527/): Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot (medium 6.1)
- [CVE-2022-0526](https://insights.sbomify.com/CVE-2022-0526/): Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot (high 7.3)
- [CVE-2022-0525](https://insights.sbomify.com/CVE-2022-0525/): Out-of-bounds Read in mruby/mruby (high 8.4)
- [CVE-2022-0524](https://insights.sbomify.com/CVE-2022-0524/): Business Logic Errors in publify/publify (medium 6.5)
- [CVE-2022-0523](https://insights.sbomify.com/CVE-2022-0523/): Use After Free in radareorg/radare2 (high 8.8)
- [CVE-2022-0522](https://insights.sbomify.com/CVE-2022-0522/): Access of Memory Location Before Start of Buffer in radareorg/radare2 (medium 6.3)
- [CVE-2022-0521](https://insights.sbomify.com/CVE-2022-0521/): Access of Memory Location After End of Buffer in radareorg/radare2 (medium 6.3)
- [CVE-2022-0520](https://insights.sbomify.com/CVE-2022-0520/): Use After Free in radareorg/radare2 (high 8.8)
- [CVE-2022-0519](https://insights.sbomify.com/CVE-2022-0519/): Buffer Access with Incorrect Length Value in radareorg/radare2 (medium 6.3)
- [CVE-2022-0518](https://insights.sbomify.com/CVE-2022-0518/): Heap-based Buffer Overflow in radareorg/radare2 (medium 6.3)
- [CVE-2022-0517](https://insights.sbomify.com/CVE-2022-0517/): Privilege escalation in Mozilla VPN (high 7.8)
- [CVE-2022-0516](https://insights.sbomify.com/CVE-2022-0516/): Information disclosure in kernel (high 7.8)
- [CVE-2022-0515](https://insights.sbomify.com/CVE-2022-0515/): Cross-Site Request Forgery (CSRF) in crater-invoice/crater (medium 4.3)
- [CVE-2022-0514](https://insights.sbomify.com/CVE-2022-0514/): Business Logic Errors in crater-invoice/crater (medium 6.5)
- [CVE-2022-0513](https://insights.sbomify.com/CVE-2022-0513/): WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason (critical 9.8)
- [CVE-2022-0512](https://insights.sbomify.com/CVE-2022-0512/): Authorization Bypass Through User-Controlled Key in unshiftio/url-parse (high 8.8)
- [CVE-2022-0511](https://insights.sbomify.com/CVE-2022-0511/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-0510](https://insights.sbomify.com/CVE-2022-0510/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 4.3)
- [CVE-2022-0509](https://insights.sbomify.com/CVE-2022-0509/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.6)
- [CVE-2022-0508](https://insights.sbomify.com/CVE-2022-0508/): Server-Side Request Forgery (SSRF) in chocobozzz/peertube (medium 6.5)
- [CVE-2022-0507](https://insights.sbomify.com/CVE-2022-0507/): Vulnerability: Authenticated SQL Injection in API (medium 5.8)
- [CVE-2022-0506](https://insights.sbomify.com/CVE-2022-0506/): Cross-site Scripting (XSS) - Stored in microweber/microweber (high 7.7)
- [CVE-2022-0505](https://insights.sbomify.com/CVE-2022-0505/): Cross-Site Request Forgery (CSRF) in microweber/microweber (medium 5.7)
- [CVE-2022-0504](https://insights.sbomify.com/CVE-2022-0504/): Generation of Error Message Containing Sensitive Information in microweber/microweber (medium 6.5)
- [CVE-2022-0503](https://insights.sbomify.com/CVE-2022-0503/): Multisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0502](https://insights.sbomify.com/CVE-2022-0502/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.5)
- [CVE-2022-0501](https://insights.sbomify.com/CVE-2022-0501/): Cross-site Scripting (XSS) - Reflected in ptrofimov/beanstalk_console (high 8.6)
- [CVE-2022-0500](https://insights.sbomify.com/CVE-2022-0500/): Memory corruption in kernel (high 7.8)
- [CVE-2022-0499](https://insights.sbomify.com/CVE-2022-0499/): Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF (high 8.8)
- [CVE-2022-0497](https://insights.sbomify.com/CVE-2022-0497/): Memory corruption in openscad (high 7.1)
- [CVE-2022-0496](https://insights.sbomify.com/CVE-2022-0496/): Memory corruption in openscad (medium 5.5)
- [CVE-2022-0495](https://insights.sbomify.com/CVE-2022-0495/): SQL Injection in KOHA (critical 9.4)
- [CVE-2022-0494](https://insights.sbomify.com/CVE-2022-0494/): Information disclosure in kernel (medium 4.4)
- [CVE-2022-0493](https://insights.sbomify.com/CVE-2022-0493/): String Locator < 2.5.0 - Admin+ Arbitrary File Read (medium 4.9)
- [CVE-2022-0492](https://insights.sbomify.com/CVE-2022-0492/): Linux Kernel Improper Authentication (high 7.8, exploited in the wild)
- [CVE-2022-0489](https://insights.sbomify.com/CVE-2022-0489/): Denial of service in GitLab (low 3.5)
- [CVE-2022-0488](https://insights.sbomify.com/CVE-2022-0488/): Denial of service in GitLab (low 3.5)
- [CVE-2022-0487](https://insights.sbomify.com/CVE-2022-0487/): Use after free in kernel (medium 5.5)
- [CVE-2022-0486](https://insights.sbomify.com/CVE-2022-0486/): Privileged Command Injection Vulnerability in Fidelis Network and Deception (medium 4.4)
- [CVE-2022-0485](https://insights.sbomify.com/CVE-2022-0485/): Other in libnbd (medium 4.8)
- [CVE-2022-0484](https://insights.sbomify.com/CVE-2022-0484/): Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs (high 8.8)
- [CVE-2022-0483](https://insights.sbomify.com/CVE-2022-0483/): Local privilege escalation due to insecure folder permissions (high 7.8)
- [CVE-2022-0482](https://insights.sbomify.com/CVE-2022-0482/): Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments (critical 9.1)
- [CVE-2022-0481](https://insights.sbomify.com/CVE-2022-0481/): NULL Pointer Dereference in mruby/mruby (medium 5.5)
- [CVE-2022-0480](https://insights.sbomify.com/CVE-2022-0480/): Denial of service in kernel (medium 5.5)
- [CVE-2022-0479](https://insights.sbomify.com/CVE-2022-0479/): Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting (critical 9.8)
- [CVE-2022-0478](https://insights.sbomify.com/CVE-2022-0478/): Event Manager for WooCommerce < 3.5.8 - Contributor+ SQL Injection (high 8.8)
- [CVE-2022-0477](https://insights.sbomify.com/CVE-2022-0477/): Denial of service in GitLab (medium 4.9)
- [CVE-2022-0476](https://insights.sbomify.com/CVE-2022-0476/): Denial of Service in radareorg/radare2 (high 7.3)
- [CVE-2022-0475](https://insights.sbomify.com/CVE-2022-0475/): Possible XSS attack via translation (low 3.5)
- [CVE-2022-0474](https://insights.sbomify.com/CVE-2022-0474/): Disclosure of mail addresses (low 2.4)
- [CVE-2022-0473](https://insights.sbomify.com/CVE-2022-0473/): Dynamic field error message is vulnerable to XSS (low 3.8)
- [CVE-2022-0472](https://insights.sbomify.com/CVE-2022-0472/): Unrestricted Upload of File with Dangerous Type in jsdecena/laracom (high 8.1)
- [CVE-2022-0471](https://insights.sbomify.com/CVE-2022-0471/): Favicon by RealFaviconGenerator < 1.3.23 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0470](https://insights.sbomify.com/CVE-2022-0470/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0469](https://insights.sbomify.com/CVE-2022-0469/): Use after free in Chrome (high 8.8)
- [CVE-2022-0468](https://insights.sbomify.com/CVE-2022-0468/): Use after free in Chrome (high 8.8)
- [CVE-2022-0467](https://insights.sbomify.com/CVE-2022-0467/): Security feature bypass in Chrome (high 8.8)
- [CVE-2022-0466](https://insights.sbomify.com/CVE-2022-0466/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2022-0465](https://insights.sbomify.com/CVE-2022-0465/): Use after free in Chrome (high 8.8)
- [CVE-2022-0464](https://insights.sbomify.com/CVE-2022-0464/): Use after free in Chrome (high 8.8)
- [CVE-2022-0463](https://insights.sbomify.com/CVE-2022-0463/): Use after free in Chrome (high 8.8)
- [CVE-2022-0462](https://insights.sbomify.com/CVE-2022-0462/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-0461](https://insights.sbomify.com/CVE-2022-0461/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0460](https://insights.sbomify.com/CVE-2022-0460/): Use after free in Chrome (high 8.8)
- [CVE-2022-0459](https://insights.sbomify.com/CVE-2022-0459/): Use after free in Chrome (high 8.8)
- [CVE-2022-0458](https://insights.sbomify.com/CVE-2022-0458/): Use after free in Chrome (high 8.8)
- [CVE-2022-0457](https://insights.sbomify.com/CVE-2022-0457/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0456](https://insights.sbomify.com/CVE-2022-0456/): Use after free in Chrome (high 8.8)
- [CVE-2022-0455](https://insights.sbomify.com/CVE-2022-0455/): Other in Chrome (medium 6.5)
- [CVE-2022-0454](https://insights.sbomify.com/CVE-2022-0454/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0453](https://insights.sbomify.com/CVE-2022-0453/): Use after free in Chrome (high 8.8)
- [CVE-2022-0452](https://insights.sbomify.com/CVE-2022-0452/): Use after free in Chrome (critical 9.6)
- [CVE-2022-0451](https://insights.sbomify.com/CVE-2022-0451/): Auth bypass in Dark SDK (medium 6.5)
- [CVE-2022-0450](https://insights.sbomify.com/CVE-2022-0450/): Menu Image, Icons made easy < 3.0.8 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/429/