# Vulnerabilities published in 2022


- [CVE-2022-0449](https://insights.sbomify.com/CVE-2022-0449/): Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0448](https://insights.sbomify.com/CVE-2022-0448/): CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0447](https://insights.sbomify.com/CVE-2022-0447/): Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types (medium 6.4)
- [CVE-2022-0446](https://insights.sbomify.com/CVE-2022-0446/): Simple Banner < 2.12.0 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2022-0445](https://insights.sbomify.com/CVE-2022-0445/): WordPress Real Cookie Banner < 2.14.2 - Settings Reset via CSRF (medium 6.5)
- [CVE-2022-0444](https://insights.sbomify.com/CVE-2022-0444/): XCloner < 4.3.6 - Plugin Settings Reset (medium 4.3)
- [CVE-2022-0443](https://insights.sbomify.com/CVE-2022-0443/): Use After Free in vim/vim (high 8.4)
- [CVE-2022-0442](https://insights.sbomify.com/CVE-2022-0442/): UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override (medium 4.3)
- [CVE-2022-0441](https://insights.sbomify.com/CVE-2022-0441/): MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation (critical 9.8)
- [CVE-2022-0440](https://insights.sbomify.com/CVE-2022-0440/): Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution (high 7.2)
- [CVE-2022-0439](https://insights.sbomify.com/CVE-2022-0439/): Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection (high 8.8)
- [CVE-2022-0437](https://insights.sbomify.com/CVE-2022-0437/): Cross-site Scripting (XSS) - DOM in karma-runner/karma (medium 5.4)
- [CVE-2022-0436](https://insights.sbomify.com/CVE-2022-0436/): Path Traversal in gruntjs/grunt (high 7.1)
- [CVE-2022-0435](https://insights.sbomify.com/CVE-2022-0435/): Memory corruption in kernel (high 8.8)
- [CVE-2022-0434](https://insights.sbomify.com/CVE-2022-0434/): Page Views Count < 2.4.15 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-0433](https://insights.sbomify.com/CVE-2022-0433/): Null dereference in kernel (medium 5.5)
- [CVE-2022-0432](https://insights.sbomify.com/CVE-2022-0432/): Prototype Pollution in mastodon/mastodon (high 7.4)
- [CVE-2022-0431](https://insights.sbomify.com/CVE-2022-0431/): Google Pagespeed Insights < 4.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0430](https://insights.sbomify.com/CVE-2022-0430/): Exposure of Sensitive Information to an Unauthorized Actor in httpie/httpie (low 2.4)
- [CVE-2022-0429](https://insights.sbomify.com/CVE-2022-0429/): WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2022-0428](https://insights.sbomify.com/CVE-2022-0428/): Content Egg < 5.3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0427](https://insights.sbomify.com/CVE-2022-0427/): Cross-site request forgery in GitLab (high 7.7)
- [CVE-2022-0426](https://insights.sbomify.com/CVE-2022-0426/): Product Feed PRO for WooCommerce < 11.2.3 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2022-0425](https://insights.sbomify.com/CVE-2022-0425/): Server-side request forgery in GitLab (medium 5.4)
- [CVE-2022-0424](https://insights.sbomify.com/CVE-2022-0424/): Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure (medium 5.3)
- [CVE-2022-0423](https://insights.sbomify.com/CVE-2022-0423/): 3D FlipBook < 1.12.1 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-0422](https://insights.sbomify.com/CVE-2022-0422/): White Label MS < 2.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0421](https://insights.sbomify.com/CVE-2022-0421/): Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS (medium 6.1)
- [CVE-2022-0420](https://insights.sbomify.com/CVE-2022-0420/): RegistrationMagic < 5.0.2.2 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-0419](https://insights.sbomify.com/CVE-2022-0419/): NULL Pointer Dereference in radareorg/radare2 (medium 5.9)
- [CVE-2022-0418](https://insights.sbomify.com/CVE-2022-0418/): Event List < 0.8.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0417](https://insights.sbomify.com/CVE-2022-0417/): Heap-based Buffer Overflow in vim/vim (high 8.4)
- [CVE-2022-0415](https://insights.sbomify.com/CVE-2022-0415/): Remote Command Execution in uploading repository file in gogs/gogs (critical 9.9)
- [CVE-2022-0414](https://insights.sbomify.com/CVE-2022-0414/): Improper Validation of Specified Quantity in Input in dolibarr/dolibarr (medium 4.1)
- [CVE-2022-0413](https://insights.sbomify.com/CVE-2022-0413/): Use After Free in vim/vim (high 8.4)
- [CVE-2022-0412](https://insights.sbomify.com/CVE-2022-0412/): TI WooCommerce Wishlist < 1.40.1 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2022-0411](https://insights.sbomify.com/CVE-2022-0411/): Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection (high 8.8)
- [CVE-2022-0410](https://insights.sbomify.com/CVE-2022-0410/): WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2022-0409](https://insights.sbomify.com/CVE-2022-0409/): Unrestricted Upload of File with Dangerous Type in star7th/showdoc (high 7.2)
- [CVE-2022-0408](https://insights.sbomify.com/CVE-2022-0408/): Stack-based Buffer Overflow in vim/vim (high 8.4)
- [CVE-2022-0407](https://insights.sbomify.com/CVE-2022-0407/): Heap-based Buffer Overflow in vim/vim (medium 5.7)
- [CVE-2022-0406](https://insights.sbomify.com/CVE-2022-0406/): Improper Authorization in janeczku/calibre-web (medium 4.3)
- [CVE-2022-0405](https://insights.sbomify.com/CVE-2022-0405/): Improper Access Control in janeczku/calibre-web (medium 4.3)
- [CVE-2022-0404](https://insights.sbomify.com/CVE-2022-0404/): Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS (medium 6.5)
- [CVE-2022-0403](https://insights.sbomify.com/CVE-2022-0403/): Library File Manager < 5.2.3 - Subscriber+ Arbitrary File Creation/Upload/Deletion (high 8.1)
- [CVE-2022-0402](https://insights.sbomify.com/CVE-2022-0402/): Superforms < 6.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0401](https://insights.sbomify.com/CVE-2022-0401/): Path Traversal in yuda-lyu/w-zip (critical 9.4)
- [CVE-2022-0400](https://insights.sbomify.com/CVE-2022-0400/): Memory corruption in kernel (high 7.5)
- [CVE-2022-0399](https://insights.sbomify.com/CVE-2022-0399/): Advanced Product Labels for WooCommerce < 1.2.3.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0398](https://insights.sbomify.com/CVE-2022-0398/): ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation (medium 5.4)
- [CVE-2022-0397](https://insights.sbomify.com/CVE-2022-0397/): WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2022-0396](https://insights.sbomify.com/CVE-2022-0396/): DoS from specifically crafted TCP packets (medium 5.3)
- [CVE-2022-0395](https://insights.sbomify.com/CVE-2022-0395/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.5)
- [CVE-2022-0394](https://insights.sbomify.com/CVE-2022-0394/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 5.3)
- [CVE-2022-0393](https://insights.sbomify.com/CVE-2022-0393/): Out-of-bounds Read in vim/vim (high 8.4)
- [CVE-2022-0392](https://insights.sbomify.com/CVE-2022-0392/): Heap-based Buffer Overflow in vim/vim (medium 6.1)
- [CVE-2022-0391](https://insights.sbomify.com/CVE-2022-0391/): Code injection in python (high 7.5)
- [CVE-2022-0390](https://insights.sbomify.com/CVE-2022-0390/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-0389](https://insights.sbomify.com/CVE-2022-0389/): WP Time Slots Booking Form < 1.1.63 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0388](https://insights.sbomify.com/CVE-2022-0388/): Interactive Medical Drawing of Human Body < 2.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-0387](https://insights.sbomify.com/CVE-2022-0387/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.3)
- [CVE-2022-0386](https://insights.sbomify.com/CVE-2022-0386/): SQL injection in Sophos UTM (high 8.8)
- [CVE-2022-0385](https://insights.sbomify.com/CVE-2022-0385/): Crazy Bone <= 0.6.0 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2022-0384](https://insights.sbomify.com/CVE-2022-0384/): Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure (medium 4.3)
- [CVE-2022-0383](https://insights.sbomify.com/CVE-2022-0383/): WP Review Slider < 11.0 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-0382](https://insights.sbomify.com/CVE-2022-0382/): Information disclosure in kernel (medium 5.5)
- [CVE-2022-0381](https://insights.sbomify.com/CVE-2022-0381/): Embed Swagger <= 1.0.0 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0380](https://insights.sbomify.com/CVE-2022-0380/): Fotobook <= 3.2.3 Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0379](https://insights.sbomify.com/CVE-2022-0379/): Cross-site Scripting (XSS) - Stored in microweber/microweber (high 8.1)
- [CVE-2022-0378](https://insights.sbomify.com/CVE-2022-0378/): Cross-site Scripting (XSS) - Reflected in microweber/microweber (high 7.1)
- [CVE-2022-0377](https://insights.sbomify.com/CVE-2022-0377/): LearnPress < 4.1.5 - Arbitrary Image Renaming (medium 4.3)
- [CVE-2022-0376](https://insights.sbomify.com/CVE-2022-0376/): User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0375](https://insights.sbomify.com/CVE-2022-0375/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.5)
- [CVE-2022-0374](https://insights.sbomify.com/CVE-2022-0374/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (medium 6.5)
- [CVE-2022-0373](https://insights.sbomify.com/CVE-2022-0373/): Missing authorization in GitLab (medium 4.3)
- [CVE-2022-0372](https://insights.sbomify.com/CVE-2022-0372/): Cross-site Scripting (XSS) - Stored in crater-invoice/crater (high 7.6)
- [CVE-2022-0371](https://insights.sbomify.com/CVE-2022-0371/): Information disclosure in GitLab (medium 4.3)
- [CVE-2022-0370](https://insights.sbomify.com/CVE-2022-0370/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (high 7.1)
- [CVE-2022-0369](https://insights.sbomify.com/CVE-2022-0369/): Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2022-0368](https://insights.sbomify.com/CVE-2022-0368/): Out-of-bounds Read in vim/vim (medium 5.5)
- [CVE-2022-0367](https://insights.sbomify.com/CVE-2022-0367/): Memory corruption in libmodbus (high 7.8)
- [CVE-2022-0366](https://insights.sbomify.com/CVE-2022-0366/): SQL injection in capsule8:capsule8 (high 8.8)
- [CVE-2022-0365](https://insights.sbomify.com/CVE-2022-0365/): Ricon Mobile, Inc. (critical 9.1)
- [CVE-2022-0364](https://insights.sbomify.com/CVE-2022-0364/): Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting (medium 5.4)
- [CVE-2022-0363](https://insights.sbomify.com/CVE-2022-0363/): myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation (medium 4.3)
- [CVE-2022-0362](https://insights.sbomify.com/CVE-2022-0362/): SQL Injection in star7th/showdoc (medium 6.7)
- [CVE-2022-0361](https://insights.sbomify.com/CVE-2022-0361/): Heap-based Buffer Overflow in vim/vim (high 8.4)
- [CVE-2022-0360](https://insights.sbomify.com/CVE-2022-0360/): WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0359](https://insights.sbomify.com/CVE-2022-0359/): Heap-based Buffer Overflow in vim/vim (medium 6.1)
- [CVE-2022-0358](https://insights.sbomify.com/CVE-2022-0358/): Privilege escalation in QEMU/virtiofsd (high 7.8)
- [CVE-2022-0357](https://insights.sbomify.com/CVE-2022-0357/): Improper Quoting Path Issue in Bitdefender Total Security (medium 6.7)
- [CVE-2022-0355](https://insights.sbomify.com/CVE-2022-0355/): Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-get (high 8.8)
- [CVE-2022-0354](https://insights.sbomify.com/CVE-2022-0354/): Privilege escalation in System Update (high 7.3)
- [CVE-2022-0353](https://insights.sbomify.com/CVE-2022-0353/): Denial of service in Diagnostics (medium 4.4)
- [CVE-2022-0352](https://insights.sbomify.com/CVE-2022-0352/): Cross-site Scripting (XSS) - Reflected in janeczku/calibre-web (high 8.5)
- [CVE-2022-0351](https://insights.sbomify.com/CVE-2022-0351/): Access of Memory Location Before Start of Buffer in vim/vim (high 8.4)
- [CVE-2022-0350](https://insights.sbomify.com/CVE-2022-0350/): Cross-site Scripting (XSS) - Stored in vanessa219/vditor (medium 6.1)
- [CVE-2022-0349](https://insights.sbomify.com/CVE-2022-0349/): NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2022-0348](https://insights.sbomify.com/CVE-2022-0348/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 4.3)
- [CVE-2022-0347](https://insights.sbomify.com/CVE-2022-0347/): LoginPress < 1.5.12 - Reflected Cross-Site Scripting (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/430/