# Vulnerabilities published in 2022


- [CVE-2022-0346](https://insights.sbomify.com/CVE-2022-0346/): Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0345](https://insights.sbomify.com/CVE-2022-0345/): Better Notifications for WP < 1.8.7 - Email Address Disclosure (medium 4.3)
- [CVE-2022-0344](https://insights.sbomify.com/CVE-2022-0344/): Information disclosure in GitLab (low 3.1)
- [CVE-2022-0343](https://insights.sbomify.com/CVE-2022-0343/): Local Priviledge escalation in Perfetto Dev scripts (low 3.3)
- [CVE-2022-0342](https://insights.sbomify.com/CVE-2022-0342/): Auth bypass in ATP series firmware (critical 9.8)
- [CVE-2022-0341](https://insights.sbomify.com/CVE-2022-0341/): Cross-site Scripting (XSS) - Stored in vanessa219/vditor (medium 6.6)
- [CVE-2022-0339](https://insights.sbomify.com/CVE-2022-0339/): Server-Side Request Forgery (SSRF) in janeczku/calibre-web (medium 6.5)
- [CVE-2022-0338](https://insights.sbomify.com/CVE-2022-0338/): Insertion of Sensitive Information into Log File in delgan/loguru (medium 4.3)
- [CVE-2022-0337](https://insights.sbomify.com/CVE-2022-0337/): Information disclosure in Chrome (medium 6.5)
- [CVE-2022-0336](https://insights.sbomify.com/CVE-2022-0336/): Security feature bypass in Samba (high 8.8)
- [CVE-2022-0335](https://insights.sbomify.com/CVE-2022-0335/): Cross Site Request Forgery in Moodle (high 8.8)
- [CVE-2022-0334](https://insights.sbomify.com/CVE-2022-0334/): Insufficient user authorization in Moodle (medium 4.3)
- [CVE-2022-0333](https://insights.sbomify.com/CVE-2022-0333/): Insufficient user authorization in Moodle (low 3.8)
- [CVE-2022-0332](https://insights.sbomify.com/CVE-2022-0332/): SQL injection in Moodle (critical 9.8)
- [CVE-2022-0331](https://insights.sbomify.com/CVE-2022-0331/): Information disclosure in Sophos Firewall (medium 5.3)
- [CVE-2022-0330](https://insights.sbomify.com/CVE-2022-0330/): Memory corruption in kernel (high 7.8)
- [CVE-2022-0328](https://insights.sbomify.com/CVE-2022-0328/): Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF (medium 4.7)
- [CVE-2022-0327](https://insights.sbomify.com/CVE-2022-0327/): Master Addons for Elementor < 1.8.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0326](https://insights.sbomify.com/CVE-2022-0326/): NULL Pointer Dereference in mruby/mruby (medium 5.5)
- [CVE-2022-0324](https://insights.sbomify.com/CVE-2022-0324/): Buffer Overflow in Dhcp6relay in Software for Open Networking in the Cloud (SONiC) (high 8.1)
- [CVE-2022-0323](https://insights.sbomify.com/CVE-2022-0323/): Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php (medium 5.3)
- [CVE-2022-0322](https://insights.sbomify.com/CVE-2022-0322/): Denial of service in kernel (medium 5.5)
- [CVE-2022-0321](https://insights.sbomify.com/CVE-2022-0321/): WP Voting Contest < 3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0320](https://insights.sbomify.com/CVE-2022-0320/): Essential Addons for Elementor < 5.0.5 - Unauthenticated LFI (critical 9.8)
- [CVE-2022-0319](https://insights.sbomify.com/CVE-2022-0319/): Out-of-bounds Read in vim/vim (medium 5.5)
- [CVE-2022-0318](https://insights.sbomify.com/CVE-2022-0318/): Heap-based Buffer Overflow in vim/vim (medium 6.6)
- [CVE-2022-0317](https://insights.sbomify.com/CVE-2022-0317/): Improper Input Validation in AKPublic.Verify in go-attestation (medium 4.0)
- [CVE-2022-0316](https://insights.sbomify.com/CVE-2022-0316/): Multiple themes - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2022-0315](https://insights.sbomify.com/CVE-2022-0315/): Insecure Temporary File in horovod/horovod (high 8.2)
- [CVE-2022-0314](https://insights.sbomify.com/CVE-2022-0314/): Nimble Page Builder < 3.2.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0313](https://insights.sbomify.com/CVE-2022-0313/): Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF (medium 4.3)
- [CVE-2022-0311](https://insights.sbomify.com/CVE-2022-0311/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0310](https://insights.sbomify.com/CVE-2022-0310/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0309](https://insights.sbomify.com/CVE-2022-0309/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0308](https://insights.sbomify.com/CVE-2022-0308/): Use after free in Chrome (high 8.8)
- [CVE-2022-0307](https://insights.sbomify.com/CVE-2022-0307/): Use after free in Chrome (high 8.8)
- [CVE-2022-0306](https://insights.sbomify.com/CVE-2022-0306/): Memory corruption in Chrome (high 8.8)
- [CVE-2022-0305](https://insights.sbomify.com/CVE-2022-0305/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0304](https://insights.sbomify.com/CVE-2022-0304/): Use after free in Chrome (high 8.8)
- [CVE-2022-0302](https://insights.sbomify.com/CVE-2022-0302/): Use after free in Chrome (high 8.8)
- [CVE-2022-0301](https://insights.sbomify.com/CVE-2022-0301/): Use after free in Chrome (high 7.8)
- [CVE-2022-0300](https://insights.sbomify.com/CVE-2022-0300/): Use after free in Chrome (high 8.8)
- [CVE-2022-0298](https://insights.sbomify.com/CVE-2022-0298/): Use after free in Chrome (high 8.8)
- [CVE-2022-0297](https://insights.sbomify.com/CVE-2022-0297/): Use after free in Chrome (high 8.8)
- [CVE-2022-0296](https://insights.sbomify.com/CVE-2022-0296/): Use after free in Chrome (high 8.8)
- [CVE-2022-0295](https://insights.sbomify.com/CVE-2022-0295/): Use after free in Chrome (high 8.8)
- [CVE-2022-0294](https://insights.sbomify.com/CVE-2022-0294/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0293](https://insights.sbomify.com/CVE-2022-0293/): Use after free in Chrome (high 8.8)
- [CVE-2022-0292](https://insights.sbomify.com/CVE-2022-0292/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0291](https://insights.sbomify.com/CVE-2022-0291/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-0290](https://insights.sbomify.com/CVE-2022-0290/): Use after free in Chrome (critical 9.6)
- [CVE-2022-0289](https://insights.sbomify.com/CVE-2022-0289/): Use after free in Chrome (high 8.8)
- [CVE-2022-0288](https://insights.sbomify.com/CVE-2022-0288/): Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0287](https://insights.sbomify.com/CVE-2022-0287/): Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure (medium 4.3)
- [CVE-2022-0286](https://insights.sbomify.com/CVE-2022-0286/): Null dereference in linux:linux kernel (medium 5.5)
- [CVE-2022-0285](https://insights.sbomify.com/CVE-2022-0285/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.6)
- [CVE-2022-0284](https://insights.sbomify.com/CVE-2022-0284/): Memory corruption in ImageMagick (high 7.1)
- [CVE-2022-0283](https://insights.sbomify.com/CVE-2022-0283/): Open redirect in GitLab (medium 4.7)
- [CVE-2022-0282](https://insights.sbomify.com/CVE-2022-0282/): Cross-site Scripting in microweber/microweber (medium 4.3)
- [CVE-2022-0281](https://insights.sbomify.com/CVE-2022-0281/): Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber (high 7.5)
- [CVE-2022-0280](https://insights.sbomify.com/CVE-2022-0280/): McAfee Total Protection (MTP) - File Deletion vulnerability (high 7.5)
- [CVE-2022-0279](https://insights.sbomify.com/CVE-2022-0279/): AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition (low 3.1)
- [CVE-2022-0278](https://insights.sbomify.com/CVE-2022-0278/): Cross-site Scripting (XSS) - Stored in microweber/microweber (high 7.2)
- [CVE-2022-0277](https://insights.sbomify.com/CVE-2022-0277/): Incorrect Permission Assignment for Critical Resource in microweber/microweber (medium 6.5)
- [CVE-2022-0274](https://insights.sbomify.com/CVE-2022-0274/): Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore (medium 6.8)
- [CVE-2022-0273](https://insights.sbomify.com/CVE-2022-0273/): Improper Access Control in janeczku/calibre-web (medium 4.3)
- [CVE-2022-0272](https://insights.sbomify.com/CVE-2022-0272/): Improper Restriction of XML External Entity Reference in detekt/detekt (high 7.3)
- [CVE-2022-0271](https://insights.sbomify.com/CVE-2022-0271/): LearnPress < 4.1.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0270](https://insights.sbomify.com/CVE-2022-0270/): Improper header sanitization in bored-agent causes escalation of privilege (high 8.8)
- [CVE-2022-0269](https://insights.sbomify.com/CVE-2022-0269/): Cross-Site Request Forgery (CSRF) in yetiforcecompany/yetiforcecrm (high 8.0)
- [CVE-2022-0268](https://insights.sbomify.com/CVE-2022-0268/): Cross-site Scripting (XSS) - Stored in getgrav/grav (medium 5.7)
- [CVE-2022-0267](https://insights.sbomify.com/CVE-2022-0267/): AdRotate < 5.8.22 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-0266](https://insights.sbomify.com/CVE-2022-0266/): Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat (medium 6.5)
- [CVE-2022-0265](https://insights.sbomify.com/CVE-2022-0265/): Improper Restriction of XML External Entity Reference in hazelcast/hazelcast (high 7.3)
- [CVE-2022-0264](https://insights.sbomify.com/CVE-2022-0264/): Information disclosure in kernel (medium 5.5)
- [CVE-2022-0263](https://insights.sbomify.com/CVE-2022-0263/): Unrestricted Upload of File with Dangerous Type in pimcore/pimcore (medium 6.6)
- [CVE-2022-0262](https://insights.sbomify.com/CVE-2022-0262/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.6)
- [CVE-2022-0261](https://insights.sbomify.com/CVE-2022-0261/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-0260](https://insights.sbomify.com/CVE-2022-0260/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.5)
- [CVE-2022-0258](https://insights.sbomify.com/CVE-2022-0258/): SQL Injection in pimcore/pimcore (high 8.3)
- [CVE-2022-0257](https://insights.sbomify.com/CVE-2022-0257/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 6.1)
- [CVE-2022-0256](https://insights.sbomify.com/CVE-2022-0256/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (medium 5.3)
- [CVE-2022-0255](https://insights.sbomify.com/CVE-2022-0255/): Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-0254](https://insights.sbomify.com/CVE-2022-0254/): Zero Spam < 5.2.11 - Admin+ SQL Injection (critical 9.8)
- [CVE-2022-0253](https://insights.sbomify.com/CVE-2022-0253/): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (high 7.1)
- [CVE-2022-0252](https://insights.sbomify.com/CVE-2022-0252/): Give < 2.17.3 - Reflected Cross-Site Scripting via Import Tool (medium 6.1)
- [CVE-2022-0251](https://insights.sbomify.com/CVE-2022-0251/): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (high 8.1)
- [CVE-2022-0250](https://insights.sbomify.com/CVE-2022-0250/): Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0249](https://insights.sbomify.com/CVE-2022-0249/): Server-side request forgery in GitLab (low 3.1)
- [CVE-2022-0248](https://insights.sbomify.com/CVE-2022-0248/): Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2022-0247](https://insights.sbomify.com/CVE-2022-0247/): Write access to VMO data through copy-on-write in Fuchsia (high 7.5)
- [CVE-2022-0246](https://insights.sbomify.com/CVE-2022-0246/): iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip (medium 4.9)
- [CVE-2022-0245](https://insights.sbomify.com/CVE-2022-0245/): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (medium 5.7)
- [CVE-2022-0244](https://insights.sbomify.com/CVE-2022-0244/): Path traversal in GitLab (high 8.6)
- [CVE-2022-0243](https://insights.sbomify.com/CVE-2022-0243/): Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore (high 7.4)
- [CVE-2022-0242](https://insights.sbomify.com/CVE-2022-0242/): Unrestricted Upload of File with Dangerous Type in crater-invoice/crater (high 7.2)
- [CVE-2022-0240](https://insights.sbomify.com/CVE-2022-0240/): NULL Pointer Dereference in mruby/mruby (medium 6.2)
- [CVE-2022-0239](https://insights.sbomify.com/CVE-2022-0239/): Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (medium 4.7)
- [CVE-2022-0238](https://insights.sbomify.com/CVE-2022-0238/): Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite (medium 4.5)
- [CVE-2022-0237](https://insights.sbomify.com/CVE-2022-0237/): Rapid7 Insight Agent Privilege Escalation (medium 4.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/431/