# Vulnerabilities published in 2022


- [CVE-2022-0236](https://insights.sbomify.com/CVE-2022-0236/): WP Import Export (Lite) <= 3.9.15 Unauthenticated Sensitive Data Disclosure (high 7.5)
- [CVE-2022-0235](https://insights.sbomify.com/CVE-2022-0235/): Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch (high 8.8)
- [CVE-2022-0234](https://insights.sbomify.com/CVE-2022-0234/): WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0233](https://insights.sbomify.com/CVE-2022-0233/): ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site Scripting (medium 6.4)
- [CVE-2022-0232](https://insights.sbomify.com/CVE-2022-0232/): User Registration, Login & Landing Pages – LeadMagic <= 1.2.7 Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0231](https://insights.sbomify.com/CVE-2022-0231/): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (medium 5.7)
- [CVE-2022-0230](https://insights.sbomify.com/CVE-2022-0230/): Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2022-0229](https://insights.sbomify.com/CVE-2022-0229/): miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion (high 8.1)
- [CVE-2022-0228](https://insights.sbomify.com/CVE-2022-0228/): Popup Builder < 4.0.7 - Admin+ SQL Injection (high 7.2)
- [CVE-2022-0226](https://insights.sbomify.com/CVE-2022-0226/): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (medium 4.3)
- [CVE-2022-0225](https://insights.sbomify.com/CVE-2022-0225/): Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown (medium 5.4)
- [CVE-2022-0224](https://insights.sbomify.com/CVE-2022-0224/): SQL Injection in dolibarr/dolibarr (high 8.3)
- [CVE-2022-0223](https://insights.sbomify.com/CVE-2022-0223/): Path traversal in EcoStruxure Power Commission (medium 6.5)
- [CVE-2022-0222](https://insights.sbomify.com/CVE-2022-0222/): Denial of service in Modicon M340 CPUs (high 7.5)
- [CVE-2022-0221](https://insights.sbomify.com/CVE-2022-0221/): XML external entity in SCADAPack Workbench (medium 5.5)
- [CVE-2022-0220](https://insights.sbomify.com/CVE-2022-0220/): WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0219](https://insights.sbomify.com/CVE-2022-0219/): Improper Restriction of XML External Entity Reference in skylot/jadx (medium 5.5)
- [CVE-2022-0218](https://insights.sbomify.com/CVE-2022-0218/): WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route (high 8.3)
- [CVE-2022-0217](https://insights.sbomify.com/CVE-2022-0217/): XML external entity in prosody (high 7.5)
- [CVE-2022-0216](https://insights.sbomify.com/CVE-2022-0216/): Use after free in QEMU (medium 4.4)
- [CVE-2022-0215](https://insights.sbomify.com/CVE-2022-0215/): XootiX Plugins <= Various Versions Cross-Site Request Forgery to Arbitrary Options Update (high 8.8)
- [CVE-2022-0214](https://insights.sbomify.com/CVE-2022-0214/): Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service (high 7.5)
- [CVE-2022-0213](https://insights.sbomify.com/CVE-2022-0213/): Heap-based Buffer Overflow in vim/vim (medium 6.8)
- [CVE-2022-0212](https://insights.sbomify.com/CVE-2022-0212/): SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0211](https://insights.sbomify.com/CVE-2022-0211/): Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0210](https://insights.sbomify.com/CVE-2022-0210/): Random Banner <= 4.1.4 Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0209](https://insights.sbomify.com/CVE-2022-0209/): Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-0208](https://insights.sbomify.com/CVE-2022-0208/): MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting (medium 6.1)
- [CVE-2022-0207](https://insights.sbomify.com/CVE-2022-0207/): Race condition in vdsm (medium 4.7)
- [CVE-2022-0206](https://insights.sbomify.com/CVE-2022-0206/): NewStatPress < 1.3.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0205](https://insights.sbomify.com/CVE-2022-0205/): YOP Poll < 6.3.5 - Author+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-0204](https://insights.sbomify.com/CVE-2022-0204/): Memory corruption in bluez (high 8.8)
- [CVE-2022-0203](https://insights.sbomify.com/CVE-2022-0203/): Improper Access Control in crater-invoice/crater (high 7.5)
- [CVE-2022-0201](https://insights.sbomify.com/CVE-2022-0201/): Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0200](https://insights.sbomify.com/CVE-2022-0200/): Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2022-0199](https://insights.sbomify.com/CVE-2022-0199/): Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF (medium 4.3)
- [CVE-2022-0198](https://insights.sbomify.com/CVE-2022-0198/): Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (medium 6.1)
- [CVE-2022-0197](https://insights.sbomify.com/CVE-2022-0197/): Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite (medium 6.5)
- [CVE-2022-0196](https://insights.sbomify.com/CVE-2022-0196/): Cross-Site Request Forgery (CSRF) in phoronix-test-suite/phoronix-test-suite (medium 5.4)
- [CVE-2022-0194](https://insights.sbomify.com/CVE-2022-0194/): Memory corruption in Netatalk (critical 9.8)
- [CVE-2022-0193](https://insights.sbomify.com/CVE-2022-0193/): Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0192](https://insights.sbomify.com/CVE-2022-0192/): Privilege escalation in PCManager (high 7.3)
- [CVE-2022-0191](https://insights.sbomify.com/CVE-2022-0191/): Ad Invalid Click Protector (AICP) < 1.2.7 - Arbitrary Ban Deletion via CSRF (medium 6.5)
- [CVE-2022-0190](https://insights.sbomify.com/CVE-2022-0190/): Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL Injection (high 8.8)
- [CVE-2022-0189](https://insights.sbomify.com/CVE-2022-0189/): WP RSS Aggregator < 4.20 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-0188](https://insights.sbomify.com/CVE-2022-0188/): Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update (medium 5.3)
- [CVE-2022-0186](https://insights.sbomify.com/CVE-2022-0186/): Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2022-0184](https://insights.sbomify.com/CVE-2022-0184/): Information disclosure in TEPRA PRO (medium 4.3)
- [CVE-2022-0183](https://insights.sbomify.com/CVE-2022-0183/): Information disclosure in MIRUPASS (medium 4.6)
- [CVE-2022-0182](https://insights.sbomify.com/CVE-2022-0182/): Cross-site scripting in Quiz And Survey Master (medium 5.4)
- [CVE-2022-0181](https://insights.sbomify.com/CVE-2022-0181/): Cross-site scripting in Quiz And Survey Master (medium 6.1)
- [CVE-2022-0180](https://insights.sbomify.com/CVE-2022-0180/): Cross-site request forgery in Quiz And Survey Master (high 8.8)
- [CVE-2022-0179](https://insights.sbomify.com/CVE-2022-0179/): Missing Authorization in snipe/snipe-it (medium 6.3)
- [CVE-2022-0178](https://insights.sbomify.com/CVE-2022-0178/): Missing Authorization in snipe/snipe-it (medium 6.3)
- [CVE-2022-0176](https://insights.sbomify.com/CVE-2022-0176/): PowerPack Lite for Beaver Builder < 1.2.9.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0175](https://insights.sbomify.com/CVE-2022-0175/): Information disclosure in virglrenderer (medium 5.5)
- [CVE-2022-0174](https://insights.sbomify.com/CVE-2022-0174/): Improper Validation of Specified Quantity in Input in dolibarr/dolibarr (medium 4.3)
- [CVE-2022-0173](https://insights.sbomify.com/CVE-2022-0173/): Out-of-bounds Read in radareorg/radare2 (critical 9.6)
- [CVE-2022-0172](https://insights.sbomify.com/CVE-2022-0172/): Security feature bypass in GitLab (medium 5.3)
- [CVE-2022-0171](https://insights.sbomify.com/CVE-2022-0171/): Denial of service in kernel (medium 5.5)
- [CVE-2022-0170](https://insights.sbomify.com/CVE-2022-0170/): Improper Access Control in chocobozzz/peertube (medium 5.3)
- [CVE-2022-0169](https://insights.sbomify.com/CVE-2022-0169/): Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2022-0168](https://insights.sbomify.com/CVE-2022-0168/): Null dereference in kernel (medium 4.4)
- [CVE-2022-0167](https://insights.sbomify.com/CVE-2022-0167/): Information disclosure in GitLab (low 3.1)
- [CVE-2022-0166](https://insights.sbomify.com/CVE-2022-0166/): Privilege escalation vulnerability in McAfee Agent (high 7.8)
- [CVE-2022-0165](https://insights.sbomify.com/CVE-2022-0165/): Page Builder KingComposer <= 2.9.6 - Open Redirect (medium 6.1)
- [CVE-2022-0164](https://insights.sbomify.com/CVE-2022-0164/): Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users (medium 4.3)
- [CVE-2022-0163](https://insights.sbomify.com/CVE-2022-0163/): Smart Forms < 2.6.71 - Subscriber+ Form Data Download (medium 6.5)
- [CVE-2022-0162](https://insights.sbomify.com/CVE-2022-0162/): Vulnerability in TP-LinK TL-WR841N wireless router (high 8.4)
- [CVE-2022-0161](https://insights.sbomify.com/CVE-2022-0161/): ARI Fancy Lightbox < 1.3.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0159](https://insights.sbomify.com/CVE-2022-0159/): Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore (high 7.4)
- [CVE-2022-0158](https://insights.sbomify.com/CVE-2022-0158/): Heap-based Buffer Overflow in vim/vim (medium 6.8)
- [CVE-2022-0157](https://insights.sbomify.com/CVE-2022-0157/): Cross-site Scripting (XSS) - Stored in phoronix-test-suite/phoronix-test-suite (medium 5.2)
- [CVE-2022-0156](https://insights.sbomify.com/CVE-2022-0156/): Use After Free in vim/vim (medium 6.8)
- [CVE-2022-0155](https://insights.sbomify.com/CVE-2022-0155/): Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects (high 8.0)
- [CVE-2022-0154](https://insights.sbomify.com/CVE-2022-0154/): Cross-site request forgery in GitLab (high 7.5)
- [CVE-2022-0153](https://insights.sbomify.com/CVE-2022-0153/): SQL Injection in forkcms/forkcms (critical 9.6)
- [CVE-2022-0152](https://insights.sbomify.com/CVE-2022-0152/): Missing authorization in GitLab (medium 6.5)
- [CVE-2022-0151](https://insights.sbomify.com/CVE-2022-0151/): Denial of service in GitLab (medium 6.5)
- [CVE-2022-0150](https://insights.sbomify.com/CVE-2022-0150/): WP Accessibility Helper (WAH) < 0.6.0.7 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-0149](https://insights.sbomify.com/CVE-2022-0149/): WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2022-0148](https://insights.sbomify.com/CVE-2022-0148/): All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2022-0147](https://insights.sbomify.com/CVE-2022-0147/): Cookie Information < 2.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-0145](https://insights.sbomify.com/CVE-2022-0145/): Cross-site Scripting (XSS) - Stored in forkcms/forkcms (medium 6.8)
- [CVE-2022-0144](https://insights.sbomify.com/CVE-2022-0144/): Improper Privilege Management in shelljs/shelljs (high 7.1)
- [CVE-2022-0143](https://insights.sbomify.com/CVE-2022-0143/): LDAP Connector: When startTLS is used then LDAP connector ignores the wrong password (critical 9.3)
- [CVE-2022-0142](https://insights.sbomify.com/CVE-2022-0142/): Visual Form Builder < 3.0.6 - CSV Injection (critical 9.8)
- [CVE-2022-0141](https://insights.sbomify.com/CVE-2022-0141/): Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRF (high 8.1)
- [CVE-2022-0140](https://insights.sbomify.com/CVE-2022-0140/): Visual Form Builder < 3.0.6 - Unauthenticated Information Disclosure (medium 5.3)
- [CVE-2022-0139](https://insights.sbomify.com/CVE-2022-0139/): Use After Free in radareorg/radare2 (high 7.1)
- [CVE-2022-0138](https://insights.sbomify.com/CVE-2022-0138/): Airspan Networks Mimosa Deserialization of Untrusted Data (high 7.5)
- [CVE-2022-0137](https://insights.sbomify.com/CVE-2022-0137/): Memory corruption in htmldoc (high 7.5)
- [CVE-2022-0136](https://insights.sbomify.com/CVE-2022-0136/): Server-side request forgery in GitLab (medium 5.4)
- [CVE-2022-0135](https://insights.sbomify.com/CVE-2022-0135/): Memory corruption in virglrenderer (high 7.8)
- [CVE-2022-0134](https://insights.sbomify.com/CVE-2022-0134/): AnyComment < 0.2.18 - Arbitrary HyperComments Import/Revert via CSRF (high 8.8)
- [CVE-2022-0133](https://insights.sbomify.com/CVE-2022-0133/): Improper Access Control in chocobozzz/peertube (medium 5.3)
- [CVE-2022-0132](https://insights.sbomify.com/CVE-2022-0132/): Server-Side Request Forgery (SSRF) in chocobozzz/peertube (medium 4.8)
- [CVE-2022-0131](https://insights.sbomify.com/CVE-2022-0131/): Hardcoded credentials in Jimoty App for Android (low 3.3)
- [CVE-2022-0130](https://insights.sbomify.com/CVE-2022-0130/): Code injection in Tenable.sc (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/432/