Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 168 of 437.
- GHSA-8r69-3cvp-wxc3 Batched HTTP requests may set incorrect `cache-control` response header
- GHSA-8mj7-wxmc-f424 Use after free in Neon external buffers
- GHSA-8mgq-6r2q-82w9 Captcha Bypass in strapi-plugin-ezforms
- GHSA-8jh9-wqpf-q52c sweetalert2 v8.19.1 and above contains hidden functionality
- GHSA-8h83-chh2-fchp eZ Platform users with the Company admin role can assign any role to any user
- GHSA-8gr3-2gjw-jj7g Hidden functionality in node-ipc
- GHSA-8gj8-hv75-gp94 `SegQueue` creates zero value of any type
- GHSA-85q9-7467-r53q XSS Vulnerability in Markdown Editor
- GHSA-7v4j-8wvr-v55r `array!` macro is unsound when its length is impure constant
- GHSA-7v3x-h7r2-34jv Insufficient Session Expiration in Pterodactyl API
- GHSA-7v28-g2pq-ggg8 Ghost vulnerable to remote code execution in locale setting change
- GHSA-7rq4-qcpw-74gq Formula Injection in Exported Data
- GHSA-7r9x-qrpr-3cxw mofh Vulnerable to Improper Restriction of XML External Entity Reference
- GHSA-7p7c-pvvx-2vx3 hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
- GHSA-7p79-6x2v-5h88 Server crash if running Python 3.10 w/ Sanic 20.12
- GHSA-7j52-6fjp-58gr Inconsistent storage layout for ERC2771ContextUpgradeable
- GHSA-7fw6-6mfj-g3q2 ckb: Transaction header_deps validation issue (network forking)
- GHSA-7644-cxp8-h23r ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname
- GHSA-74fp-r6jw-h4mp Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing
- GHSA-6v6p-g8cg-2hgg Improper Certificate Validation in node-sass affects eZ Platform
- GHSA-6h2x-4gjf-jc5w autogluon.multimodal vulnerable to unsafe YAML deserialization
- GHSA-6f85-3f8q-qc94 OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor
- GHSA-6888-wf7j-34jq `SegQueue` creates zero value of any type
- GHSA-67r3-h899-9w95 Embedded Malicious Code in ctx
- GHSA-64g7-mvw6-v9qj Improper Privilege Management in shelljs
- GHSA-5wvv-q5fv-2388 hyper-staticfile's location header incorporates user input, allowing open redirect
- GHSA-5w9c-rv96-fr7g Removal of functional code in faker.js
- GHSA-5rrq-pxf6-6jx5 Prototype Pollution in node-forge debug API.
- GHSA-5rqg-jm4f-cqx7 Infinite loop causing Denial of Service in colors
- GHSA-5m39-wx2q-mxg3 Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`
- GHSA-5jfw-35xp-5m42 Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
- GHSA-5j8w-r7g8-5472 Arrow2 allows double free in `safe` code
- GHSA-58h5-h554-429q ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS)
- GHSA-57q7-rxqq-7vgp On Windows, `git-sizer` might run a `git` executable within the repository being analyzed
- GHSA-56x4-j7p9-fcf9 Command Injection in moment-timezone
- GHSA-52rh-5rpj-c3w6 Improper handling of multiline messages in node-irc
- GHSA-528j-9r78-wffx etcd user credentials are stored in WAL logs in plaintext
- GHSA-4v48-4q5m-8vx4 Prometheus vulnerable to basic authentication bypass
- GHSA-4qw4-jpp4-8gvp Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service
- GHSA-4jqc-jvh2-pxg9 Path traversal for local publishers in TechDocs backend
- GHSA-4g82-3jcr-q52w Malware in ctx
- GHSA-4fx9-vc88-q2xc Infinite loop in Pillow
- GHSA-47xh-qxqv-mgvg kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)
- GHSA-45w3-v3g4-54pm Chrono has potential segfault issue in SPIFFE authenticator
- GHSA-457r-cqc8-9vj9 sweetalert2 v10.16.10 and above contains hidden functionality
- GHSA-44m4-9cjp-j587 IBX-1392: Image filenames sanitization
- GHSA-446q-xxg5-3vhh eZ Platform users with the Company admin role can assign any role to any user
- GHSA-43q8-3fv7-pr5x Improper Validation of Integrity Check Value in TensorFlow
- GHSA-3qpm-h9ch-px3c Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
- GHSA-3qmc-2r76-4rqp Redwood is vulnerable to account takeover via dbAuth "forgot-password"
- GHSA-3p7g-wrgg-wq45 GraphQL queries can expose password hashes
- GHSA-3mpp-xfvh-qh37 node-ipc behavior change
- GHSA-3jhm-87m6-x959 Path traversal mitigation bypass in OctoRPKI
- GHSA-3fvf-2gp4-89wq Possibility for Denial of Service by overwriting PHP files with language exports
- GHSA-3fgr-xjr6-xqm8 code injection in phpxmlrpc/phpxmlrpc
- GHSA-3fg9-hcq5-vxrc iana-time-zone vulnerable to use after free in MacOS / iOS implementation
- GHSA-39hc-v87j-747x Vulnerable OpenSSL included in cryptography wheels
- GHSA-3988-h75v-hwf6 Arbitrary shell execution
- GHSA-394j-x37r-2q27 Ibexa DXP users with the Company admin role can assign any role to any user
- GHSA-36jr-mh4h-2g58 d3-color vulnerable to ReDoS
- GHSA-3633-5h82-39pq Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata
- GHSA-34vw-m4rh-r36p Talos vulnerable dependency due to race condition in Linux kernel's IP framework XFRM
- GHSA-342c-vcff-2ff2 Login timing attack in ezsystems/ezplatform-kernel
- GHSA-32gv-6cf3-wcmq HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
- GHSA-3227-r97m-8j95 Relative Path Traversal in afire serve_static
- GHSA-2x4v-g8cx-jxrq Login timing attack in ibexa/core
- GHSA-2w8g-m5j8-7m87 Zalgo-like output that crashes the server
- GHSA-2p3c-p3qw-69r4 The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations
- GHSA-2fvv-qxrq-7jq6 apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page
- GHSA-28q9-9c3g-v3f9 lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
- GHSA-255r-3prx-mf99 `rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8
- GHSA-2226-4v3c-cff8 Stack overflow in rustc_serialize when parsing deeply nested JSON
- DRUPAL-CORE-2022-001 jQuery UI is a third-party library used by Drupal.
- DRUPAL-CONTRIB-2022-060 The Social Base theme is designed as a base theme for Open Social.
- DRUPAL-CONTRIB-2022-059 This module enables you to build searches using a wide range of features, data sources and backends.
- DRUPAL-CONTRIB-2022-058 This module enables themers to get partial data from field render arrays.
- DRUPAL-CONTRIB-2022-056 This module enables you to set content permissions based on taxonomy terms.
- DRUPAL-CONTRIB-2022-055 This module enables you to restrict content via taxonomy terms and related permissions.
- DRUPAL-CONTRIB-2022-054 The Next.js module provides an inline preview for content.
- DRUPAL-CONTRIB-2022-053 This module enables you to accept payments from the Elavon payment provider.
- DRUPAL-CONTRIB-2022-052 jQuery UI is a third-party library used by Drupal.
- DRUPAL-CONTRIB-2022-051 This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance.
- DRUPAL-CONTRIB-2022-050 This module enables you to generate PDF versions of content.
- DRUPAL-CONTRIB-2022-048 This module enables you to generate print versions of content.
- DRUPAL-CONTRIB-2022-047 This module enables you to create and manage a version of taxonomy based on configuration entities instead of content.
- DRUPAL-CONTRIB-2022-046 The Lottiefiles Field module enables you to integrate the lottiefiles features into your page.
- DRUPAL-CONTRIB-2022-045 The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal.
- DRUPAL-CONTRIB-2022-044 Entity Browser Block provides a Block Plugin for every Entity Browser on your site.
- DRUPAL-CONTRIB-2022-042 The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields.
- DRUPAL-CONTRIB-2022-040 The Wingsuit module enables site builders to build UI Patterns (and|or) Twig Components with Storybook and use them without any mapping code in Drupal.
- DRUPAL-CONTRIB-2022-038 The module adds a "Clone" tab to a node.
- DRUPAL-CONTRIB-2022-036 Image Field Caption (`image_field_caption`) adds an extra text area for captions on image fields.
- DRUPAL-CONTRIB-2022-035 Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers.
- DRUPAL-CONTRIB-2022-032 This module provides integration with the CleanTalk spam protection service.
- DRUPAL-CONTRIB-2022-029 This module is used as part of the Opigno LMS distribution and implements learning paths for the LMS.
- DRUPAL-CONTRIB-2022-028 SVG Formatter module provides support for using SVG images on your website.
- DRUPAL-CONTRIB-2022-027 The GOV.UK Theme (`govuk_theme`) is a Drupal theme for the GOV.UK Design System.
- DRUPAL-CONTRIB-2022-026 This module provides an entity relationship hierarchy tree widget for an entity reference field.
- DRUPAL-CONTRIB-2022-025 This advisory addresses a similar issue to [Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004](https://www.drupa
- DRUPAL-CONTRIB-2022-024 The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail.