Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 169 of 437.
- DRUPAL-CONTRIB-2022-023 This module enables you to manage and delete files.
- DRUPAL-CONTRIB-2022-021 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-019 This module provides a stream wrapper for files located in the vendor directory.
- DRUPAL-CONTRIB-2022-018 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-017 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-016 **Update** Maintainers stepped forward, fixed the security issue, and Vocabulary Permissions Per Role is supported again.
- DRUPAL-CONTRIB-2022-015 This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in taxonomy structures.
- DRUPAL-CONTRIB-2022-014 This module enables users to create 'private' vocabularies.
- DRUPAL-CONTRIB-2022-013 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-012 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-009 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-008 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-006 Update 2022-03-01. New maintainers have volunteered for the project and created a new release which includes fixes for the 3 security issues
- DRUPAL-CONTRIB-2022-005 The security team is marking this project unsupported.
- DRUPAL-CONTRIB-2022-004 jQuery UI is a third-party library used by Drupal.
- DRUPAL-CONTRIB-2022-002 This module enables you to implement OAuth 2.0 authentication for Drupal.
- DRUPAL-CONTRIB-2022-001 This module enables you to login with an email address.
- CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
- CVE-2022-51025 Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer
- CVE-2022-51024 Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
- CVE-2022-51023 PHPOK < 5.4.081 SQL Injection via api.php sort Parameter
- CVE-2022-51022 YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
- CVE-2022-51021 NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint
- CVE-2022-51020 Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
- CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias
- CVE-2022-51018 PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages
- CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
- CVE-2022-51016 PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay
- CVE-2022-51015 PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
- CVE-2022-51014 PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
- CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
- CVE-2022-51012 PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
- CVE-2022-51011 PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
- CVE-2022-51010 PocketMine-MP before 4.4.2 Server Crash via Item ID
- CVE-2022-51009 PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
- CVE-2022-51008 PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
- CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
- CVE-2022-50994 DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgi
- CVE-2022-50993 Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet
- CVE-2022-50992 Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
- CVE-2022-50981 Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements
- CVE-2022-50980 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN
- CVE-2022-50979 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (RS485)
- CVE-2022-50978 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP)
- CVE-2022-50977 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP
- CVE-2022-50976 Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB
- CVE-2022-50975 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration
- CVE-2022-50973 Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet
- CVE-2022-50972 WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php
- CVE-2022-50971 Malwarebytes 4.5 Unquoted Service Path Privilege Escalation
- CVE-2022-50970 WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter
- CVE-2022-50969 uBidAuction 2.0.1 mailingLog manage Reflected XSS
- CVE-2022-50968 uBidAuction 2.0.1 auctions manage Reflected XSS
- CVE-2022-50967 uBidAuction 2.0.1 tickets manage Reflected XSS
- CVE-2022-50966 uBidAuction 2.0.1 news manage Reflected XSS
- CVE-2022-50965 uBidAuction 2.0.1 posts manage Reflected XSS
- CVE-2022-50964 uBidAuction 2.0.1 myAuctions loose Reflected XSS
- CVE-2022-50963 uBidAuction 2.0.1 myAuctions active Reflected XSS
- CVE-2022-50962 uBidAuction 2.0.1 myOrders Reflected XSS
- CVE-2022-50961 WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS
- CVE-2022-50960 WordPress International Sms Contact Form 7 Integration 1.2 XSS
- CVE-2022-50959 WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php
- CVE-2022-50958 WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php
- CVE-2022-50957 Drupal avatar_uploader 7.x-1.0-beta8 Reflected XSS
- CVE-2022-50956 WordPress Plugin amministrazione-aperta 3.7.3 Local File Read
- CVE-2022-50955 WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery
- CVE-2022-50954 WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion
- CVE-2022-50953 WordPress Plugin admin-word-count-column 2.2 Local File Read
- CVE-2022-50952 Banco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name Input
- CVE-2022-50951 WiFi File Transfer 1.0.8 Persistent XSS via Web Server Input Validation
- CVE-2022-50950 Webile 1.0.1 Directory Traversal Vulnerability via Web Application
- CVE-2022-50949 WordPress Plugin Videos sync PDF 1.7.4 Stored XSS
- CVE-2022-50948 Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting
- CVE-2022-50947 WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS
- CVE-2022-50946 WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSS
- CVE-2022-50945 WordPress 3dady Real-Time Web Stats 1.0 Stored XSS
- CVE-2022-50944 Aero CMS 0.0.1 PHP Code Injection via posts.php
- CVE-2022-50943 Moodle LMS 4.0 Cross-Site Scripting via course search.php
- CVE-2022-50942 Incinga Web 2.8.2 Client-Side Cross-Site Scripting via EventListener
- CVE-2022-50941 BootCommerce 3.2.1 Persistent Cross-Site Scripting via Order Checkout
- CVE-2022-50940 Knap Advanced PHP Login 3.1.3 Persistent Cross-Site Scripting via Name Parameter
- CVE-2022-50939 e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
- CVE-2022-50938 CONTPAQi® AdminPAQ 14.0.0 - Unquoted Service Path
- CVE-2022-50937 Ametys CMS v4.4.1 - Cross Site Scripting (XSS)
- CVE-2022-50936 WBCE CMS 1.5.2 - Remote Code Execution (RCE) (Authenticated)
- CVE-2022-50935 FLAME II MODEM USB - Unquoted Service Path
- CVE-2022-50933 Cain & Abel 4.9.56 - Unquoted Service Path
- CVE-2022-50932 Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)
- CVE-2022-50931 TeamSpeak 3.5.6 - Insecure File Permissions
- CVE-2022-50930 Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
- CVE-2022-50929 Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path
- CVE-2022-50928 Bluetooth Application 5.4.277 - 'BlueSoleilCS' Unquoted Service Path
- CVE-2022-50927 Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation
- CVE-2022-50926 WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation
- CVE-2022-50925 Prowise Reflect v1.0.9 - Remote Keystroke Injection
- CVE-2022-50924 Private Internet Access 3.3 - 'pia-service' Unquoted Service Path
- CVE-2022-50923 Cobian Backup 0.9 - Unquoted Service Path
- CVE-2022-50922 Audio Conversion Wizard v2.01 - Buffer Overflow
- CVE-2022-50921 WOW21 5.0.1.9 - 'Service WOW21_Service' Unquoted Service Path
- CVE-2022-50920 Sandboxie-Plus 5.50.2 - 'Service SbieSvc' Unquoted Service Path