# Vulnerabilities published in 2022


- [GHSA-v6gp-9mmm-c6p5](https://insights.sbomify.com/GHSA-v6gp-9mmm-c6p5/): Out-of-bounds Write in zlib affects Nokogiri (not scored)
- [GHSA-v57x-gxfj-484q](https://insights.sbomify.com/GHSA-v57x-gxfj-484q/): Security Advisory for "Log4Shell" (not scored)
- [GHSA-v3wr-67px-44xg](https://insights.sbomify.com/GHSA-v3wr-67px-44xg/): Execution with Unnecessary Privileges in arc-electron (not scored)
- [GHSA-v3mr-gp7j-pw5w](https://insights.sbomify.com/GHSA-v3mr-gp7j-pw5w/): Possible SQL injection in tablelookupwizard Contao Extension (not scored)
- [GHSA-rxhx-9fj6-6h2m](https://insights.sbomify.com/GHSA-rxhx-9fj6-6h2m/): enum_map macro can cause UB when `Enum` trait is incorrectly implemented (not scored)
- [GHSA-rwf4-gx62-rqfw](https://insights.sbomify.com/GHSA-rwf4-gx62-rqfw/): `MsQueue` `push`/`pop` use the wrong orderings (not scored)
- [GHSA-rv3r-vqjj-8c76](https://insights.sbomify.com/GHSA-rv3r-vqjj-8c76/): Cross-site scripting from content entered in the tags and multiselect fields (not scored)
- [GHSA-rrgw-3hg3-9x8c](https://insights.sbomify.com/GHSA-rrgw-3hg3-9x8c/): XSS vulnerability in translations (not scored)
- [GHSA-rm89-9g65-4ffr](https://insights.sbomify.com/GHSA-rm89-9g65-4ffr/): Insufficient HTML Sanitization (not scored)
- [GHSA-rcrv-228c-gprj](https://insights.sbomify.com/GHSA-rcrv-228c-gprj/): Invalid URL generation in bitlyshortener (not scored)
- [GHSA-rc23-xxgq-x27g](https://insights.sbomify.com/GHSA-rc23-xxgq-x27g/): wee_alloc is Unmaintained (not scored)
- [GHSA-r7vq-6425-j94w](https://insights.sbomify.com/GHSA-r7vq-6425-j94w/): Python-TUF vulnerable to incorrect threshold signature computation for new root metadata (not scored)
- [GHSA-qrqq-9c63-xfrg](https://insights.sbomify.com/GHSA-qrqq-9c63-xfrg/): tower-http's improper validation of Windows paths could lead to directory traversal attack (not scored)
- [GHSA-qq97-vm5h-rrhg](https://insights.sbomify.com/GHSA-qq97-vm5h-rrhg/): OCI Manifest Type Confusion Issue (not scored)
- [GHSA-qq6h-5g6j-q3cm](https://insights.sbomify.com/GHSA-qq6h-5g6j-q3cm/): sweetalert2 v11.4.9 and above contains hidden functionality (not scored)
- [GHSA-qcqv-38jg-2r43](https://insights.sbomify.com/GHSA-qcqv-38jg-2r43/): Pageflow vulnerable to insecure direct object reference in membership update endpoint (not scored)
- [GHSA-q7qq-9gx2-ggxv](https://insights.sbomify.com/GHSA-q7qq-9gx2-ggxv/): phpxmlrpc vulnerable to argument injection (not scored)
- [GHSA-q37h-jhf3-85cj](https://insights.sbomify.com/GHSA-q37h-jhf3-85cj/): Bypass of CMS Safe Mode Security Feature (not scored)
- [GHSA-q347-cg56-pcq4](https://insights.sbomify.com/GHSA-q347-cg56-pcq4/): SSRF in repository migration (not scored)
- [GHSA-q2fj-6h62-59m2](https://insights.sbomify.com/GHSA-q2fj-6h62-59m2/): Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue (not scored)
- [GHSA-pj96-4jhv-v792](https://insights.sbomify.com/GHSA-pj96-4jhv-v792/): Cross site scripting via cookies in gogs (not scored)
- [GHSA-pg98-6v7f-2xfv](https://insights.sbomify.com/GHSA-pg98-6v7f-2xfv/): sweetalert2 v9.17.4 and above contains hidden functionality (not scored)
- [GHSA-pfhr-pccp-hwmh](https://insights.sbomify.com/GHSA-pfhr-pccp-hwmh/): Impact If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies (not scored)
- [GHSA-pcpm-vc4v-cmvx](https://insights.sbomify.com/GHSA-pcpm-vc4v-cmvx/): eZ Platform users with the Company admin role can assign any role to any user (not scored)
- [GHSA-pcjh-6r5h-r92r](https://insights.sbomify.com/GHSA-pcjh-6r5h-r92r/): django-sendfile2 before 0.7.0 contains reflected file download vulnerability (not scored)
- [GHSA-p2g9-94wh-65c2](https://insights.sbomify.com/GHSA-p2g9-94wh-65c2/): Space bug in `clean_text` (not scored)
- [GHSA-mwm4-5qwr-g9pf](https://insights.sbomify.com/GHSA-mwm4-5qwr-g9pf/): Keycloak is vulnerable to IDN homograph attack (not scored)
- [GHSA-mw6j-hh29-h379](https://insights.sbomify.com/GHSA-mw6j-hh29-h379/): `CHECK` failure in depthwise ops via overflows (not scored)
- [GHSA-mpg5-fvwp-42m2](https://insights.sbomify.com/GHSA-mpg5-fvwp-42m2/): Unsoundness in `dashmap` references (not scored)
- [GHSA-mhfv-8rc9-w38c](https://insights.sbomify.com/GHSA-mhfv-8rc9-w38c/): Arbitrary shell execution (not scored)
- [GHSA-mgvv-5mxp-xq67](https://insights.sbomify.com/GHSA-mgvv-5mxp-xq67/): SQLite3 addresses vulnerability in packaged version of libsqlite (not scored)
- [GHSA-mfjm-vh54-3f96](https://insights.sbomify.com/GHSA-mfjm-vh54-3f96/): Scrapy cookie-setting is not restricted based on the public suffix list (not scored)
- [GHSA-mcq2-w56r-5w2w](https://insights.sbomify.com/GHSA-mcq2-w56r-5w2w/): Daemon panics when processing certain blocks (not scored)
- [GHSA-mcmr-49x3-4jqm](https://insights.sbomify.com/GHSA-mcmr-49x3-4jqm/): ckb type_id script resume may randomly fail (not scored)
- [GHSA-m98g-63qj-fp8j](https://insights.sbomify.com/GHSA-m98g-63qj-fp8j/): Reflected XSS on clients-registrations endpoint (not scored)
- [GHSA-m7vp-hqwv-7m5x](https://insights.sbomify.com/GHSA-m7vp-hqwv-7m5x/): Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints (not scored)
- [GHSA-m6w8-fq7v-ph4m](https://insights.sbomify.com/GHSA-m6w8-fq7v-ph4m/): GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior (not scored)
- [GHSA-m58q-qq5h-mgqq](https://insights.sbomify.com/GHSA-m58q-qq5h-mgqq/): Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository (not scored)
- [GHSA-jr8j-2jhp-m67v](https://insights.sbomify.com/GHSA-jr8j-2jhp-m67v/): nftables binding to an already bound chain (not scored)
- [GHSA-jp3w-3q88-34cf](https://insights.sbomify.com/GHSA-jp3w-3q88-34cf/): Miscomputation when performing AES encryption in rust-crypto (not scored)
- [GHSA-jjmg-x456-w976](https://insights.sbomify.com/GHSA-jjmg-x456-w976/): Incorrect default cookie name and recommendation (not scored)
- [GHSA-jfxf-4frr-9j3q](https://insights.sbomify.com/GHSA-jfxf-4frr-9j3q/): XSS in various backend modules due to (un)escaping in JS notification module (not scored)
- [GHSA-j92c-mmf7-j5x5](https://insights.sbomify.com/GHSA-j92c-mmf7-j5x5/): Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd (not scored)
- [GHSA-j35p-q24r-5367](https://insights.sbomify.com/GHSA-j35p-q24r-5367/): Dep Group Remote Memory Exhaustion (Denial of Service) in ckb (not scored)
- [GHSA-j34v-3552-5r7j](https://insights.sbomify.com/GHSA-j34v-3552-5r7j/): Multiple security issues in Pomerium's embedded envoy (not scored)
- [GHSA-hv53-vf5m-8q94](https://insights.sbomify.com/GHSA-hv53-vf5m-8q94/): personnummer/go vulnerable to Improper Input Validation (not scored)
- [GHSA-hrjv-pf36-jpmr](https://insights.sbomify.com/GHSA-hrjv-pf36-jpmr/): Post-Quantum Key Encapsulation Mechanism SIKE broken (not scored)
- [GHSA-h8g9-6gvh-5mrc](https://insights.sbomify.com/GHSA-h8g9-6gvh-5mrc/): etcd vulnerable to TOCTOU of gateway endpoint authentication (not scored)
- [GHSA-h87q-g2wp-47pj](https://insights.sbomify.com/GHSA-h87q-g2wp-47pj/): Signatures are mistakenly recognized to be valid in jsrsasign (not scored)
- [GHSA-h864-m8vm-3xvj](https://insights.sbomify.com/GHSA-h864-m8vm-3xvj/): oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken (not scored)
- [GHSA-h6gw-r52c-724r](https://insights.sbomify.com/GHSA-h6gw-r52c-724r/): NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow (not scored)
- [GHSA-gx8x-g87m-h5q6](https://insights.sbomify.com/GHSA-gx8x-g87m-h5q6/): Denial of Service (DoS) in Nokogiri on JRuby (not scored)
- [GHSA-gwj5-wp6r-5q9f](https://insights.sbomify.com/GHSA-gwj5-wp6r-5q9f/): Cronos vulnerable to DoS through unintended Contract Selfdestruct (not scored)
- [GHSA-gvj8-4cj4-h776](https://insights.sbomify.com/GHSA-gvj8-4cj4-h776/): Object state limitation has no effect (not scored)
- [GHSA-gv9j-4w24-q7vx](https://insights.sbomify.com/GHSA-gv9j-4w24-q7vx/): Improper random number generation in github.com/coredns/coredns (not scored)
- [GHSA-gqqf-g5r7-84vf](https://insights.sbomify.com/GHSA-gqqf-g5r7-84vf/): TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection (not scored)
- [GHSA-gpv5-rp6w-58r8](https://insights.sbomify.com/GHSA-gpv5-rp6w-58r8/): Remote code execution vulnerability in dependency System.Drawing.Common (not scored)
- [GHSA-gp6j-vx54-5pmf](https://insights.sbomify.com/GHSA-gp6j-vx54-5pmf/): Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme (not scored)
- [GHSA-gmhj-xjfh-cf6m](https://insights.sbomify.com/GHSA-gmhj-xjfh-cf6m/): Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library (not scored)
- [GHSA-ghmj-crg5-xw2j](https://insights.sbomify.com/GHSA-ghmj-crg5-xw2j/): Improper Input Validation in yargs-parser (not scored)
- [GHSA-ggrh-grj3-vfvw](https://insights.sbomify.com/GHSA-ggrh-grj3-vfvw/): Package discontinued because Bitly lowered the free quota (not scored)
- [GHSA-gfgm-chr3-x6px](https://insights.sbomify.com/GHSA-gfgm-chr3-x6px/): prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior (not scored)
- [GHSA-gf8q-jrpm-jvxq](https://insights.sbomify.com/GHSA-gf8q-jrpm-jvxq/): URL parsing in node-forge could lead to undesired behavior. (not scored)
- [GHSA-g86j-hwg9-77q5](https://insights.sbomify.com/GHSA-g86j-hwg9-77q5/): SentinelOne impersonated via PyPI packages (not scored)
- [GHSA-g6pw-999w-j75m](https://insights.sbomify.com/GHSA-g6pw-999w-j75m/): ELF header parsing library doesn't check for valid offset (not scored)
- [GHSA-g6jc-xrc3-4wwq](https://insights.sbomify.com/GHSA-g6jc-xrc3-4wwq/): Ibexa DXP users with the Company admin role can assign any role to any user (not scored)
- [GHSA-g23h-7vf9-xc25](https://insights.sbomify.com/GHSA-g23h-7vf9-xc25/): Mimalloc Can Allocate Memory with Bad Alignment (not scored)
- [GHSA-fx5p-f64h-93xc](https://insights.sbomify.com/GHSA-fx5p-f64h-93xc/): Opened exploitable ports in default docker-compose.yaml in go-ipfs (not scored)
- [GHSA-fqfh-778m-2v32](https://insights.sbomify.com/GHSA-fqfh-778m-2v32/): GitHub CLI can execute a git binary from the current directory (not scored)
- [GHSA-fjh6-p566-wr6q](https://insights.sbomify.com/GHSA-fjh6-p566-wr6q/): skylot jadx affected by Incorrect Behavior Order in vulnerable dependency (not scored)
- [GHSA-fc4h-xcf3-qj5f](https://insights.sbomify.com/GHSA-fc4h-xcf3-qj5f/): matrix-sdk 0.6.0 logs access tokens (not scored)
- [GHSA-f85w-wvc7-crwc](https://insights.sbomify.com/GHSA-f85w-wvc7-crwc/): bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()` (not scored)
- [GHSA-f7qw-5fgj-247x](https://insights.sbomify.com/GHSA-f7qw-5fgj-247x/): Cross-site Scripting and Open Redirect in plone.app.contenttypes (not scored)
- [GHSA-f6p5-76fp-m248](https://insights.sbomify.com/GHSA-f6p5-76fp-m248/): URL Rewrite vulnerability in multiple zendframework components (not scored)
- [GHSA-f67m-9j94-qv9j](https://insights.sbomify.com/GHSA-f67m-9j94-qv9j/): Parser creates invalid uninitialized value (not scored)
- [GHSA-f36p-42jv-8rh2](https://insights.sbomify.com/GHSA-f36p-42jv-8rh2/): Lithium vulnerable to Cross Site Scripting in provided Swagger-UI (not scored)
- [GHSA-f2gr-7299-487h](https://insights.sbomify.com/GHSA-f2gr-7299-487h/): DOS and excessive memory usage when passing untrusted user input to to dag import (not scored)
- [GHSA-cqvq-fvhr-v6hc](https://insights.sbomify.com/GHSA-cqvq-fvhr-v6hc/): `CHECK` failure in `SobolSample` via missing validation (not scored)
- [GHSA-cf4q-4cqr-7g7w](https://insights.sbomify.com/GHSA-cf4q-4cqr-7g7w/): SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc (not scored)
- [GHSA-c8rp-cgf4-937w](https://insights.sbomify.com/GHSA-c8rp-cgf4-937w/): mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack (not scored)
- [GHSA-c8f7-x2g7-7fxj](https://insights.sbomify.com/GHSA-c8f7-x2g7-7fxj/): Phoenix-ws source code and data in extensions folder is publicly available (not scored)
- [GHSA-c58j-88f5-h53f](https://insights.sbomify.com/GHSA-c58j-88f5-h53f/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares (not scored)
- [GHSA-c439-chv8-8g2j](https://insights.sbomify.com/GHSA-c439-chv8-8g2j/): `os_socketaddr` invalidly assumes the memory layout of std::net::SocketAddr (not scored)
- [GHSA-9x8m-2xpf-crp3](https://insights.sbomify.com/GHSA-9x8m-2xpf-crp3/): Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another (not scored)
- [GHSA-9x4h-8wgm-8xfg](https://insights.sbomify.com/GHSA-9x4h-8wgm-8xfg/): Malformed CAR panics and excessive memory usage (not scored)
- [GHSA-9v25-r5q2-2p6w](https://insights.sbomify.com/GHSA-9v25-r5q2-2p6w/): Candy Machine Set Collection During Mint Missing Check (not scored)
- [GHSA-9qxh-258v-666c](https://insights.sbomify.com/GHSA-9qxh-258v-666c/): Multiple soundness issues in `owning_ref` (not scored)
- [GHSA-9mfc-chwf-7whf](https://insights.sbomify.com/GHSA-9mfc-chwf-7whf/): ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low. (not scored)
- [GHSA-9hpw-r23r-xgm5](https://insights.sbomify.com/GHSA-9hpw-r23r-xgm5/): Data race in `Iter` and `IterMut` (not scored)
- [GHSA-9h6h-9g78-86f7](https://insights.sbomify.com/GHSA-9h6h-9g78-86f7/): Yapscan's report receiver server vulnerable to path traversal and log injection (not scored)
- [GHSA-9gp7-6833-wv89](https://insights.sbomify.com/GHSA-9gp7-6833-wv89/): etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery (not scored)
- [GHSA-9g55-pg62-m8hh](https://insights.sbomify.com/GHSA-9g55-pg62-m8hh/): Channel creates zero value of any type (not scored)
- [GHSA-9c9f-7x9p-4wqp](https://insights.sbomify.com/GHSA-9c9f-7x9p-4wqp/): A malicious coder can get unsound access to TCell or TLCell memory (not scored)
- [GHSA-99r3-xmmq-7q7g](https://insights.sbomify.com/GHSA-99r3-xmmq-7q7g/): eZ Platform users with the Company admin role can assign any role to any user (not scored)
- [GHSA-98pf-gfh3-x3mp](https://insights.sbomify.com/GHSA-98pf-gfh3-x3mp/): Read the Docs vulnerable to Cross-Site Scripting (XSS) (not scored)
- [GHSA-969w-q74q-9j8v](https://insights.sbomify.com/GHSA-969w-q74q-9j8v/): Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code (not scored)
- [GHSA-8w54-22w9-3g8f](https://insights.sbomify.com/GHSA-8w54-22w9-3g8f/): Cross-site Scripting and Open Redirect in Products.CMFPlone (not scored)
- [GHSA-8v4j-7jgf-5rg9](https://insights.sbomify.com/GHSA-8v4j-7jgf-5rg9/): Warp vulnerable to Path Traversal via Improper validation of Windows paths (not scored)
- [GHSA-8r99-h8j2-rw64](https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/): Twisted vulnerable to HTTP Request Smuggling Attacks (not scored)
- [GHSA-8r76-fr72-j32w](https://insights.sbomify.com/GHSA-8r76-fr72-j32w/): Creator Verification Error when Bubblegum Activate (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/167/