# Vulnerabilities published in 2022


- [GHSA-8r69-3cvp-wxc3](https://insights.sbomify.com/GHSA-8r69-3cvp-wxc3/): Batched HTTP requests may set incorrect `cache-control` response header (not scored)
- [GHSA-8mj7-wxmc-f424](https://insights.sbomify.com/GHSA-8mj7-wxmc-f424/): Use after free in Neon external buffers (not scored)
- [GHSA-8mgq-6r2q-82w9](https://insights.sbomify.com/GHSA-8mgq-6r2q-82w9/): Captcha Bypass in strapi-plugin-ezforms (not scored)
- [GHSA-8jh9-wqpf-q52c](https://insights.sbomify.com/GHSA-8jh9-wqpf-q52c/): sweetalert2 v8.19.1 and above contains hidden functionality (not scored)
- [GHSA-8h83-chh2-fchp](https://insights.sbomify.com/GHSA-8h83-chh2-fchp/): eZ Platform users with the Company admin role can assign any role to any user (not scored)
- [GHSA-8gr3-2gjw-jj7g](https://insights.sbomify.com/GHSA-8gr3-2gjw-jj7g/): Hidden functionality in node-ipc (not scored)
- [GHSA-8gj8-hv75-gp94](https://insights.sbomify.com/GHSA-8gj8-hv75-gp94/): `SegQueue` creates zero value of any type (not scored)
- [GHSA-85q9-7467-r53q](https://insights.sbomify.com/GHSA-85q9-7467-r53q/): XSS Vulnerability in Markdown Editor (not scored)
- [GHSA-7v4j-8wvr-v55r](https://insights.sbomify.com/GHSA-7v4j-8wvr-v55r/): `array!` macro is unsound when its length is impure constant (not scored)
- [GHSA-7v3x-h7r2-34jv](https://insights.sbomify.com/GHSA-7v3x-h7r2-34jv/): Insufficient Session Expiration in Pterodactyl API (not scored)
- [GHSA-7v28-g2pq-ggg8](https://insights.sbomify.com/GHSA-7v28-g2pq-ggg8/): Ghost vulnerable to remote code execution in locale setting change (not scored)
- [GHSA-7rq4-qcpw-74gq](https://insights.sbomify.com/GHSA-7rq4-qcpw-74gq/): Formula Injection in Exported Data (not scored)
- [GHSA-7r9x-qrpr-3cxw](https://insights.sbomify.com/GHSA-7r9x-qrpr-3cxw/): mofh Vulnerable to Improper Restriction of XML External Entity Reference (not scored)
- [GHSA-7p7c-pvvx-2vx3](https://insights.sbomify.com/GHSA-7p7c-pvvx-2vx3/): hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack (not scored)
- [GHSA-7p79-6x2v-5h88](https://insights.sbomify.com/GHSA-7p79-6x2v-5h88/): Server crash if running Python 3.10 w/ Sanic 20.12 (not scored)
- [GHSA-7j52-6fjp-58gr](https://insights.sbomify.com/GHSA-7j52-6fjp-58gr/): Inconsistent storage layout for ERC2771ContextUpgradeable (not scored)
- [GHSA-7fw6-6mfj-g3q2](https://insights.sbomify.com/GHSA-7fw6-6mfj-g3q2/): ckb: Transaction header_deps validation issue (network forking) (not scored)
- [GHSA-7644-cxp8-h23r](https://insights.sbomify.com/GHSA-7644-cxp8-h23r/): ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname (not scored)
- [GHSA-74fp-r6jw-h4mp](https://insights.sbomify.com/GHSA-74fp-r6jw-h4mp/): Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing (not scored)
- [GHSA-6v6p-g8cg-2hgg](https://insights.sbomify.com/GHSA-6v6p-g8cg-2hgg/): Improper Certificate Validation in node-sass affects eZ Platform (not scored)
- [GHSA-6h2x-4gjf-jc5w](https://insights.sbomify.com/GHSA-6h2x-4gjf-jc5w/): autogluon.multimodal vulnerable to unsafe YAML deserialization (not scored)
- [GHSA-6f85-3f8q-qc94](https://insights.sbomify.com/GHSA-6f85-3f8q-qc94/): OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor (not scored)
- [GHSA-6888-wf7j-34jq](https://insights.sbomify.com/GHSA-6888-wf7j-34jq/): `SegQueue` creates zero value of any type (not scored)
- [GHSA-67r3-h899-9w95](https://insights.sbomify.com/GHSA-67r3-h899-9w95/): Embedded Malicious Code in ctx (not scored)
- [GHSA-64g7-mvw6-v9qj](https://insights.sbomify.com/GHSA-64g7-mvw6-v9qj/): Improper Privilege Management in shelljs (not scored)
- [GHSA-5wvv-q5fv-2388](https://insights.sbomify.com/GHSA-5wvv-q5fv-2388/): hyper-staticfile's location header incorporates user input, allowing open redirect (not scored)
- [GHSA-5w9c-rv96-fr7g](https://insights.sbomify.com/GHSA-5w9c-rv96-fr7g/): Removal of functional code in faker.js (not scored)
- [GHSA-5rrq-pxf6-6jx5](https://insights.sbomify.com/GHSA-5rrq-pxf6-6jx5/): Prototype Pollution in node-forge debug API. (not scored)
- [GHSA-5rqg-jm4f-cqx7](https://insights.sbomify.com/GHSA-5rqg-jm4f-cqx7/): Infinite loop causing Denial of Service in colors (not scored)
- [GHSA-5m39-wx2q-mxg3](https://insights.sbomify.com/GHSA-5m39-wx2q-mxg3/): Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value` (not scored)
- [GHSA-5jfw-35xp-5m42](https://insights.sbomify.com/GHSA-5jfw-35xp-5m42/): Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown (not scored)
- [GHSA-5j8w-r7g8-5472](https://insights.sbomify.com/GHSA-5j8w-r7g8-5472/): Arrow2 allows double free in `safe` code (not scored)
- [GHSA-58h5-h554-429q](https://insights.sbomify.com/GHSA-58h5-h554-429q/): ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS) (not scored)
- [GHSA-57q7-rxqq-7vgp](https://insights.sbomify.com/GHSA-57q7-rxqq-7vgp/): On Windows, `git-sizer` might run a `git` executable within the repository being analyzed (not scored)
- [GHSA-56x4-j7p9-fcf9](https://insights.sbomify.com/GHSA-56x4-j7p9-fcf9/): Command Injection in moment-timezone (not scored)
- [GHSA-52rh-5rpj-c3w6](https://insights.sbomify.com/GHSA-52rh-5rpj-c3w6/): Improper handling of multiline messages in node-irc (not scored)
- [GHSA-528j-9r78-wffx](https://insights.sbomify.com/GHSA-528j-9r78-wffx/): etcd user credentials are stored in WAL logs in plaintext (not scored)
- [GHSA-4v48-4q5m-8vx4](https://insights.sbomify.com/GHSA-4v48-4q5m-8vx4/): Prometheus vulnerable to basic authentication bypass (not scored)
- [GHSA-4qw4-jpp4-8gvp](https://insights.sbomify.com/GHSA-4qw4-jpp4-8gvp/): Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service (not scored)
- [GHSA-4jqc-jvh2-pxg9](https://insights.sbomify.com/GHSA-4jqc-jvh2-pxg9/): Path traversal for local publishers in TechDocs backend (not scored)
- [GHSA-4g82-3jcr-q52w](https://insights.sbomify.com/GHSA-4g82-3jcr-q52w/): Malware in ctx (not scored)
- [GHSA-4fx9-vc88-q2xc](https://insights.sbomify.com/GHSA-4fx9-vc88-q2xc/): Infinite loop in Pillow (not scored)
- [GHSA-47xh-qxqv-mgvg](https://insights.sbomify.com/GHSA-47xh-qxqv-mgvg/): kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF) (not scored)
- [GHSA-45w3-v3g4-54pm](https://insights.sbomify.com/GHSA-45w3-v3g4-54pm/): Chrono has potential segfault issue in SPIFFE authenticator (not scored)
- [GHSA-457r-cqc8-9vj9](https://insights.sbomify.com/GHSA-457r-cqc8-9vj9/): sweetalert2 v10.16.10 and above contains hidden functionality (not scored)
- [GHSA-44m4-9cjp-j587](https://insights.sbomify.com/GHSA-44m4-9cjp-j587/): IBX-1392: Image filenames sanitization (not scored)
- [GHSA-446q-xxg5-3vhh](https://insights.sbomify.com/GHSA-446q-xxg5-3vhh/): eZ Platform users with the Company admin role can assign any role to any user (not scored)
- [GHSA-43q8-3fv7-pr5x](https://insights.sbomify.com/GHSA-43q8-3fv7-pr5x/): Improper Validation of Integrity Check Value in TensorFlow (not scored)
- [GHSA-3qpm-h9ch-px3c](https://insights.sbomify.com/GHSA-3qpm-h9ch-px3c/): Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library (not scored)
- [GHSA-3qmc-2r76-4rqp](https://insights.sbomify.com/GHSA-3qmc-2r76-4rqp/): Redwood is vulnerable to account takeover via dbAuth "forgot-password" (not scored)
- [GHSA-3p7g-wrgg-wq45](https://insights.sbomify.com/GHSA-3p7g-wrgg-wq45/): GraphQL queries can expose password hashes (not scored)
- [GHSA-3mpp-xfvh-qh37](https://insights.sbomify.com/GHSA-3mpp-xfvh-qh37/): node-ipc behavior change (not scored)
- [GHSA-3jhm-87m6-x959](https://insights.sbomify.com/GHSA-3jhm-87m6-x959/): Path traversal mitigation bypass in OctoRPKI (not scored)
- [GHSA-3fvf-2gp4-89wq](https://insights.sbomify.com/GHSA-3fvf-2gp4-89wq/): Possibility for Denial of Service by overwriting PHP files with language exports (not scored)
- [GHSA-3fgr-xjr6-xqm8](https://insights.sbomify.com/GHSA-3fgr-xjr6-xqm8/): code injection in phpxmlrpc/phpxmlrpc (not scored)
- [GHSA-3fg9-hcq5-vxrc](https://insights.sbomify.com/GHSA-3fg9-hcq5-vxrc/): iana-time-zone vulnerable to use after free in MacOS / iOS implementation (not scored)
- [GHSA-39hc-v87j-747x](https://insights.sbomify.com/GHSA-39hc-v87j-747x/): Vulnerable OpenSSL included in cryptography wheels (not scored)
- [GHSA-3988-h75v-hwf6](https://insights.sbomify.com/GHSA-3988-h75v-hwf6/): Arbitrary shell execution (not scored)
- [GHSA-394j-x37r-2q27](https://insights.sbomify.com/GHSA-394j-x37r-2q27/): Ibexa DXP users with the Company admin role can assign any role to any user (not scored)
- [GHSA-36jr-mh4h-2g58](https://insights.sbomify.com/GHSA-36jr-mh4h-2g58/): d3-color vulnerable to ReDoS (not scored)
- [GHSA-3633-5h82-39pq](https://insights.sbomify.com/GHSA-3633-5h82-39pq/): Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata (not scored)
- [GHSA-34vw-m4rh-r36p](https://insights.sbomify.com/GHSA-34vw-m4rh-r36p/): Talos vulnerable dependency due to race condition in Linux kernel's IP framework XFRM (not scored)
- [GHSA-342c-vcff-2ff2](https://insights.sbomify.com/GHSA-342c-vcff-2ff2/): Login timing attack in ezsystems/ezplatform-kernel (not scored)
- [GHSA-32gv-6cf3-wcmq](https://insights.sbomify.com/GHSA-32gv-6cf3-wcmq/): HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods (not scored)
- [GHSA-3227-r97m-8j95](https://insights.sbomify.com/GHSA-3227-r97m-8j95/): Relative Path Traversal in afire serve_static (not scored)
- [GHSA-2x4v-g8cx-jxrq](https://insights.sbomify.com/GHSA-2x4v-g8cx-jxrq/): Login timing attack in ibexa/core (not scored)
- [GHSA-2w8g-m5j8-7m87](https://insights.sbomify.com/GHSA-2w8g-m5j8-7m87/): Zalgo-like output that crashes the server (not scored)
- [GHSA-2p3c-p3qw-69r4](https://insights.sbomify.com/GHSA-2p3c-p3qw-69r4/): The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations (not scored)
- [GHSA-2fvv-qxrq-7jq6](https://insights.sbomify.com/GHSA-2fvv-qxrq-7jq6/): apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page (not scored)
- [GHSA-28q9-9c3g-v3f9](https://insights.sbomify.com/GHSA-28q9-9c3g-v3f9/): lakeFS vulnerable to authenticated users deleting files they are not authorized to delete (not scored)
- [GHSA-255r-3prx-mf99](https://insights.sbomify.com/GHSA-255r-3prx-mf99/): `rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8 (not scored)
- [GHSA-2226-4v3c-cff8](https://insights.sbomify.com/GHSA-2226-4v3c-cff8/): Stack overflow in rustc_serialize when parsing deeply nested JSON (not scored)
- [DRUPAL-CORE-2022-001](https://insights.sbomify.com/DRUPAL-CORE-2022-001/): jQuery UI is a third-party library used by Drupal. (not scored)
- [DRUPAL-CONTRIB-2022-060](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-060/): The Social Base theme is designed as a base theme for Open Social. (not scored)
- [DRUPAL-CONTRIB-2022-059](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-059/): This module enables you to build searches using a wide range of features, data sources and backends. (not scored)
- [DRUPAL-CONTRIB-2022-058](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-058/): This module enables themers to get partial data from field render arrays. (not scored)
- [DRUPAL-CONTRIB-2022-056](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-056/): This module enables you to set content permissions based on taxonomy terms. (not scored)
- [DRUPAL-CONTRIB-2022-055](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-055/): This module enables you to restrict content via taxonomy terms and related permissions. (not scored)
- [DRUPAL-CONTRIB-2022-054](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-054/): The Next.js module provides an inline preview for content. (not scored)
- [DRUPAL-CONTRIB-2022-053](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-053/): This module enables you to accept payments from the Elavon payment provider. (not scored)
- [DRUPAL-CONTRIB-2022-052](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-052/): jQuery UI is a third-party library used by Drupal. (not scored)
- [DRUPAL-CONTRIB-2022-051](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-051/): This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance. (not scored)
- [DRUPAL-CONTRIB-2022-050](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-050/): This module enables you to generate PDF versions of content. (not scored)
- [DRUPAL-CONTRIB-2022-048](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-048/): This module enables you to generate print versions of content. (not scored)
- [DRUPAL-CONTRIB-2022-047](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-047/): This module enables you to create and manage a version of taxonomy based on configuration entities instead of content. (not scored)
- [DRUPAL-CONTRIB-2022-046](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-046/): The Lottiefiles Field module enables you to integrate the lottiefiles features into your page. (not scored)
- [DRUPAL-CONTRIB-2022-045](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-045/): The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. (not scored)
- [DRUPAL-CONTRIB-2022-044](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-044/): Entity Browser Block provides a Block Plugin for every Entity Browser on your site. (not scored)
- [DRUPAL-CONTRIB-2022-042](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-042/): The Drupal Embed module provides a filter to allow embedding various embeddable items like entities in content fields. (not scored)
- [DRUPAL-CONTRIB-2022-040](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-040/): The Wingsuit module enables site builders to build UI Patterns (and|or) Twig Components with Storybook and use them without any mapping code in Drupal. (not scored)
- [DRUPAL-CONTRIB-2022-038](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-038/): The module adds a "Clone" tab to a node. (not scored)
- [DRUPAL-CONTRIB-2022-036](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-036/): Image Field Caption (`image_field_caption`) adds an extra text area for captions on image fields. (not scored)
- [DRUPAL-CONTRIB-2022-035](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-035/): Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers. (not scored)
- [DRUPAL-CONTRIB-2022-032](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-032/): This module provides integration with the CleanTalk spam protection service. (not scored)
- [DRUPAL-CONTRIB-2022-029](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-029/): This module is used as part of the Opigno LMS distribution and implements learning paths for the LMS. (not scored)
- [DRUPAL-CONTRIB-2022-028](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-028/): SVG Formatter module provides support for using SVG images on your website. (not scored)
- [DRUPAL-CONTRIB-2022-027](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-027/): The GOV.UK Theme (`govuk_theme`) is a Drupal theme for the GOV.UK Design System. (not scored)
- [DRUPAL-CONTRIB-2022-026](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-026/): This module provides an entity relationship hierarchy tree widget for an entity reference field. (not scored)
- [DRUPAL-CONTRIB-2022-025](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-025/): This advisory addresses a similar issue to [Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004](https://www.drupa (not scored)
- [DRUPAL-CONTRIB-2022-024](https://insights.sbomify.com/DRUPAL-CONTRIB-2022-024/): The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/168/