Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 209 of 437.
- CVE-2022-4626 PPWP – WordPress Password Protect Page < 1.8.6 - Contributor+ Stored XSS in Shortcode
- CVE-2022-46258 Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope
- CVE-2022-46257 Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names
- CVE-2022-46256 Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages
- CVE-2022-46255 Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE
- CVE-2022-4625 Login Logout Menu < 1.4.0 - Contributor+ Stored XSS in Shortcode
- CVE-2022-4624 GS Logo Slider < 3.3.8 - Contributor+ Stored XSS in Shortcode
- CVE-2022-4623 ND Shortcodes < 7.0 - Contributor+ Stored XSS via Shortcodes
- CVE-2022-4622 Login Logout Menu <= 1.3.3 - Contributor+ Stored XSS in Shortcode
- CVE-2022-4621 Panasonic Sanyo CCTV Network Camera
- CVE-2022-4619 Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2022-46181 Gotify server XSS vulnerability in the application image file upload
- CVE-2022-46180 Arbitrary HTML injection in discourse-mermaid-theme-component
- CVE-2022-46179 LiuOS vulnerable to Authorization Bypass through User-Controlled Key
- CVE-2022-46178 Path Traversal In MeterSpere allows file upload to any path
- CVE-2022-46177 Discourse password reset link can lead to in account takeover if user changes to a new email
- CVE-2022-46176 Cargo did not verify SSH host keys
- CVE-2022-46175 Prototype Pollution in JSON5 via Parse Method
- CVE-2022-46174 Race condition during concurrent TLS mounts in efs-utils
- CVE-2022-46173 Elrond go Processing: fallback search of SCRs when not found in the main cache
- CVE-2022-46172 authentik allows existing authenticated users to create arbitrary accounts
- CVE-2022-46171 Tauri vulnerable to path traversal
- CVE-2022-46170 CodeIgniter is vulnerable to improper authentication via Session Handlers
- CVE-2022-4617 Cross-site Scripting (XSS) - Reflected in microweber/microweber
- CVE-2022-46169 Cacti Command Injection
- CVE-2022-46168 Group SMTP user emails are exposed in CC email header
- CVE-2022-46167 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
- CVE-2022-46166 Spring Boot Admins integrated notifier support allows arbitrary code execution
- CVE-2022-46165 Cross-site Scripting (XSS) in Web GUI in syncthing
- CVE-2022-46164 Account takeover via prototype vulnerability
- CVE-2022-46163 travel-support-program vulnerable to data exfiltration via Ransack query injection
- CVE-2022-46162 Discourse BBCode plugin vulnerable to arbitrary CSS injection
- CVE-2022-46161 Code injection in pdfmake
- CVE-2022-46160 Tuleap dashboards vulnerable to Incorrect Authorization
- CVE-2022-4616 Command injection in 4G Router DX-3021
- CVE-2022-46159 Any authenticated Discourse user can create an unlisted topic
- CVE-2022-46158 Potential Information exposure in the upload directory in PrestaShop
- CVE-2022-46157 Remote php code execution in Akeneo PIM
- CVE-2022-46156 Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
- CVE-2022-46155 Airtable.js credentials exposed in browser builds
- CVE-2022-46154 Arbitrary file access in KodExplorer
- CVE-2022-46153 Routes exposed with an empty TLSOption in traefik
- CVE-2022-46152 OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function
- CVE-2022-46151 Reflected XSS
- CVE-2022-46150 Discourse may allow exposure of hidden tags in the subject of notification emails
- CVE-2022-4615 Cross-site Scripting (XSS) - Reflected in openemr/openemr
- CVE-2022-46149 Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.
- CVE-2022-46148 Discourse allows self-XSS through malicious composer message
- CVE-2022-46147 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
- CVE-2022-46146 Prometheus Exporter Toolkit vulnerable to basic authentication bypass
- CVE-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover
- CVE-2022-46144 Denial of service in SCALANCE SC622-2C
- CVE-2022-46143 Information disclosure in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2022-46142 Weak cryptography in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2022-46141 Information disclosure in SIMATIC STEP 7 (TIA Portal)
- CVE-2022-46140 Weak cryptography in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2022-4614 Cross-site Scripting (XSS) - Stored in alagrede/znote-app
- CVE-2022-46139 Denial of service in tp-link:tl-wr940n v4 firmware
- CVE-2022-46137 Path traversal in aerocms project:aerocms
- CVE-2022-46135 File upload in aerocms project:aerocms
- CVE-2022-4613 Click Studios Passwordstate Browser Extension Provisioning improper authorization
- CVE-2022-46128 Cross-site scripting in phpgurukul:doctor appointment management system
- CVE-2022-46127 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46126 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46125 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46124 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46123 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46122 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46121 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46120 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-4612 Click Studios Passwordstate insufficiently protected credentials
- CVE-2022-46119 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46118 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46117 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-4611 Click Studios Passwordstate hard-coded credentials
- CVE-2022-46109 Memory corruption in tenda:ac10 firmware
- CVE-2022-46102 File upload in ayacms project:ayacms
- CVE-2022-46101 Code injection in ayacms project:ayacms
- CVE-2022-4610 Click Studios Passwordstate risky encryption
- CVE-2022-46096 Cross-site scripting in covid-19 directory on vaccination system project:covid-19 directory on vaccination system
- CVE-2022-46095 Cross-site scripting in covid-19 directory on vaccination system project:covid-19 directory on vaccination system
- CVE-2022-46093 SQL injection in hospital management system project:hospital management system
- CVE-2022-46091 Cross-site scripting in oretnom23:online flight booking management system
- CVE-2022-4609 Cross-site Scripting (XSS) - Stored in usememos/memos
- CVE-2022-46089 Cross-site scripting in oretnom23:online flight booking management system
- CVE-2022-46088 Cross-site scripting in oretnom23:online flight booking management system
- CVE-2022-46087 Cross-site scripting in cloudschool project:cloudschool
- CVE-2022-46081 Information disclosure in garmin:connect
- CVE-2022-46080 Auth bypass in nexxtsolutions:nebula1200-ac firmware
- CVE-2022-4608 Memory corruption in RTU500 series
- CVE-2022-46076 Auth bypass in dlink:dir-869 firmware
- CVE-2022-46074 Cross-site request forgery in helmet store showroom project:helmet store showroom
- CVE-2022-46073 Cross-site scripting in helmet store showroom project:helmet store showroom
- CVE-2022-46072 SQL injection in helmet store showroom project:helmet store showroom
- CVE-2022-46071 SQL injection in helmet store showroom site project:helmet store showroom site
- CVE-2022-46070 Path traversal in geovision:gv-asmanager
- CVE-2022-4607 3D City Database OGC Web Feature Service xml external entity reference
- CVE-2022-46062 Cross-site request forgery in gym management system project:gym management system
- CVE-2022-46061 Other in aerocms project:aerocms
- CVE-2022-4606 PHP Remote File Inclusion in flatpressblog/flatpress