Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 167 of 437.
- GHSA-v6gp-9mmm-c6p5 Out-of-bounds Write in zlib affects Nokogiri
- GHSA-v57x-gxfj-484q Security Advisory for "Log4Shell"
- GHSA-v3wr-67px-44xg Execution with Unnecessary Privileges in arc-electron
- GHSA-v3mr-gp7j-pw5w Possible SQL injection in tablelookupwizard Contao Extension
- GHSA-rxhx-9fj6-6h2m enum_map macro can cause UB when `Enum` trait is incorrectly implemented
- GHSA-rwf4-gx62-rqfw `MsQueue` `push`/`pop` use the wrong orderings
- GHSA-rv3r-vqjj-8c76 Cross-site scripting from content entered in the tags and multiselect fields
- GHSA-rrgw-3hg3-9x8c XSS vulnerability in translations
- GHSA-rm89-9g65-4ffr Insufficient HTML Sanitization
- GHSA-rcrv-228c-gprj Invalid URL generation in bitlyshortener
- GHSA-rc23-xxgq-x27g wee_alloc is Unmaintained
- GHSA-r7vq-6425-j94w Python-TUF vulnerable to incorrect threshold signature computation for new root metadata
- GHSA-qrqq-9c63-xfrg tower-http's improper validation of Windows paths could lead to directory traversal attack
- GHSA-qq97-vm5h-rrhg OCI Manifest Type Confusion Issue
- GHSA-qq6h-5g6j-q3cm sweetalert2 v11.4.9 and above contains hidden functionality
- GHSA-qcqv-38jg-2r43 Pageflow vulnerable to insecure direct object reference in membership update endpoint
- GHSA-q7qq-9gx2-ggxv phpxmlrpc vulnerable to argument injection
- GHSA-q37h-jhf3-85cj Bypass of CMS Safe Mode Security Feature
- GHSA-q347-cg56-pcq4 SSRF in repository migration
- GHSA-q2fj-6h62-59m2 Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue
- GHSA-pj96-4jhv-v792 Cross site scripting via cookies in gogs
- GHSA-pg98-6v7f-2xfv sweetalert2 v9.17.4 and above contains hidden functionality
- GHSA-pfhr-pccp-hwmh Impact If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies
- GHSA-pcpm-vc4v-cmvx eZ Platform users with the Company admin role can assign any role to any user
- GHSA-pcjh-6r5h-r92r django-sendfile2 before 0.7.0 contains reflected file download vulnerability
- GHSA-p2g9-94wh-65c2 Space bug in `clean_text`
- GHSA-mwm4-5qwr-g9pf Keycloak is vulnerable to IDN homograph attack
- GHSA-mw6j-hh29-h379 `CHECK` failure in depthwise ops via overflows
- GHSA-mpg5-fvwp-42m2 Unsoundness in `dashmap` references
- GHSA-mhfv-8rc9-w38c Arbitrary shell execution
- GHSA-mgvv-5mxp-xq67 SQLite3 addresses vulnerability in packaged version of libsqlite
- GHSA-mfjm-vh54-3f96 Scrapy cookie-setting is not restricted based on the public suffix list
- GHSA-mcq2-w56r-5w2w Daemon panics when processing certain blocks
- GHSA-mcmr-49x3-4jqm ckb type_id script resume may randomly fail
- GHSA-m98g-63qj-fp8j Reflected XSS on clients-registrations endpoint
- GHSA-m7vp-hqwv-7m5x Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints
- GHSA-m6w8-fq7v-ph4m GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
- GHSA-m58q-qq5h-mgqq Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
- GHSA-jr8j-2jhp-m67v nftables binding to an already bound chain
- GHSA-jp3w-3q88-34cf Miscomputation when performing AES encryption in rust-crypto
- GHSA-jjmg-x456-w976 Incorrect default cookie name and recommendation
- GHSA-jfxf-4frr-9j3q XSS in various backend modules due to (un)escaping in JS notification module
- GHSA-j92c-mmf7-j5x5 Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd
- GHSA-j35p-q24r-5367 Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
- GHSA-j34v-3552-5r7j Multiple security issues in Pomerium's embedded envoy
- GHSA-hv53-vf5m-8q94 personnummer/go vulnerable to Improper Input Validation
- GHSA-hrjv-pf36-jpmr Post-Quantum Key Encapsulation Mechanism SIKE broken
- GHSA-h8g9-6gvh-5mrc etcd vulnerable to TOCTOU of gateway endpoint authentication
- GHSA-h87q-g2wp-47pj Signatures are mistakenly recognized to be valid in jsrsasign
- GHSA-h864-m8vm-3xvj oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken
- GHSA-h6gw-r52c-724r NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
- GHSA-gx8x-g87m-h5q6 Denial of Service (DoS) in Nokogiri on JRuby
- GHSA-gwj5-wp6r-5q9f Cronos vulnerable to DoS through unintended Contract Selfdestruct
- GHSA-gvj8-4cj4-h776 Object state limitation has no effect
- GHSA-gv9j-4w24-q7vx Improper random number generation in github.com/coredns/coredns
- GHSA-gqqf-g5r7-84vf TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
- GHSA-gpv5-rp6w-58r8 Remote code execution vulnerability in dependency System.Drawing.Common
- GHSA-gp6j-vx54-5pmf Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme
- GHSA-gmhj-xjfh-cf6m Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library
- GHSA-ghmj-crg5-xw2j Improper Input Validation in yargs-parser
- GHSA-ggrh-grj3-vfvw Package discontinued because Bitly lowered the free quota
- GHSA-gfgm-chr3-x6px prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior
- GHSA-gf8q-jrpm-jvxq URL parsing in node-forge could lead to undesired behavior.
- GHSA-g86j-hwg9-77q5 SentinelOne impersonated via PyPI packages
- GHSA-g6pw-999w-j75m ELF header parsing library doesn't check for valid offset
- GHSA-g6jc-xrc3-4wwq Ibexa DXP users with the Company admin role can assign any role to any user
- GHSA-g23h-7vf9-xc25 Mimalloc Can Allocate Memory with Bad Alignment
- GHSA-fx5p-f64h-93xc Opened exploitable ports in default docker-compose.yaml in go-ipfs
- GHSA-fqfh-778m-2v32 GitHub CLI can execute a git binary from the current directory
- GHSA-fjh6-p566-wr6q skylot jadx affected by Incorrect Behavior Order in vulnerable dependency
- GHSA-fc4h-xcf3-qj5f matrix-sdk 0.6.0 logs access tokens
- GHSA-f85w-wvc7-crwc bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`
- GHSA-f7qw-5fgj-247x Cross-site Scripting and Open Redirect in plone.app.contenttypes
- GHSA-f6p5-76fp-m248 URL Rewrite vulnerability in multiple zendframework components
- GHSA-f67m-9j94-qv9j Parser creates invalid uninitialized value
- GHSA-f36p-42jv-8rh2 Lithium vulnerable to Cross Site Scripting in provided Swagger-UI
- GHSA-f2gr-7299-487h DOS and excessive memory usage when passing untrusted user input to to dag import
- GHSA-cqvq-fvhr-v6hc `CHECK` failure in `SobolSample` via missing validation
- GHSA-cf4q-4cqr-7g7w SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
- GHSA-c8rp-cgf4-937w mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
- GHSA-c8f7-x2g7-7fxj Phoenix-ws source code and data in extensions folder is publicly available
- GHSA-c58j-88f5-h53f Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares
- GHSA-c439-chv8-8g2j `os_socketaddr` invalidly assumes the memory layout of std::net::SocketAddr
- GHSA-9x8m-2xpf-crp3 Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another
- GHSA-9x4h-8wgm-8xfg Malformed CAR panics and excessive memory usage
- GHSA-9v25-r5q2-2p6w Candy Machine Set Collection During Mint Missing Check
- GHSA-9qxh-258v-666c Multiple soundness issues in `owning_ref`
- GHSA-9mfc-chwf-7whf ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
- GHSA-9hpw-r23r-xgm5 Data race in `Iter` and `IterMut`
- GHSA-9h6h-9g78-86f7 Yapscan's report receiver server vulnerable to path traversal and log injection
- GHSA-9gp7-6833-wv89 etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery
- GHSA-9g55-pg62-m8hh Channel creates zero value of any type
- GHSA-9c9f-7x9p-4wqp A malicious coder can get unsound access to TCell or TLCell memory
- GHSA-99r3-xmmq-7q7g eZ Platform users with the Company admin role can assign any role to any user
- GHSA-98pf-gfh3-x3mp Read the Docs vulnerable to Cross-Site Scripting (XSS)
- GHSA-969w-q74q-9j8v Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code
- GHSA-8w54-22w9-3g8f Cross-site Scripting and Open Redirect in Products.CMFPlone
- GHSA-8v4j-7jgf-5rg9 Warp vulnerable to Path Traversal via Improper validation of Windows paths
- GHSA-8r99-h8j2-rw64 Twisted vulnerable to HTTP Request Smuggling Attacks
- GHSA-8r76-fr72-j32w Creator Verification Error when Bubblegum Activate