Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 256 of 437.
- CVE-2022-39372 Stored Cross-Site Scripting (XSS) in user information in GLPI
- CVE-2022-39371 Stored Cross-Site Scripting (XSS) through asset inventory in GLPI
- CVE-2022-39370 Improper access to debug panel in GLPI
- CVE-2022-3937 Easy Video Player < 1.2.2.3 - Contributor+ Stored XSS
- CVE-2022-39369 Service Hostname Discovery Exploitation in phpCAS
- CVE-2022-39368 Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records
- CVE-2022-39367 Vulnerability in handling of uploaded QTI ZIP files
- CVE-2022-39366 DataHub missing JWT signature check
- CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
- CVE-2022-39364 Exception logging in Sharepoint app reveals clear-text connection details
- CVE-2022-39362 Metabase vulnerable to arbitrary SQL execution from queryhash
- CVE-2022-39361 Metabase vulnerable to Remote Code Execution via H2
- CVE-2022-39360 Metabase SSO users able to circumvent IdP login by doing password reset
- CVE-2022-3936 Team Members < 5.2.1 - Editor+ Stored XSS
- CVE-2022-39359 Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs
- CVE-2022-39358 Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
- CVE-2022-39357 Winter vulnerable to Prototype Pollution in Snowboard framework
- CVE-2022-39356 Discourse user account takeover via email and invite link
- CVE-2022-39355 Discourse Patreon vulnerable to improper validation of email during Patreon authentication
- CVE-2022-39354 evm has incorrect is_static parameter for custom stateful precompiles
- CVE-2022-39353 xmldom allows multiple root nodes in a DOM
- CVE-2022-39352 OpenFGA Authorization Bypass
- CVE-2022-39351 Information disclosure in dependency-track
- CVE-2022-39350 @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
- CVE-2022-3935 Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting
- CVE-2022-39349 Tasks.org vulnerable to data exfiltration by malicous app or adb
- CVE-2022-39348 Twisted vulnerable to NameVirtualHost Host header injection
- CVE-2022-39347 Missing path sanitation with `drive` channel in FreeRDP
- CVE-2022-39346 Missing length validation of user displayname in nextcloud server
- CVE-2022-39345 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal
- CVE-2022-39344 Azure RTOS USBX vulnerable to buffer overflow
- CVE-2022-39343 Azure RTOS FileX vulnerable to Buffer Offerflow
- CVE-2022-39342 OpenFGA Authorization Bypass
- CVE-2022-39341 OpenFGA Authorization Bypass
- CVE-2022-39340 OpenFGA Information Disclosure
- CVE-2022-3934 Flat PM < 3.0.13 - Reflected Cross-Site Scripting
- CVE-2022-39339 Cleartext Transmission of Sensitive Information in user_oidc
- CVE-2022-39338 Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc
- CVE-2022-39337 Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
- CVE-2022-39335 Synapse does not apply enough checks to servers requesting auth events of events in a room
- CVE-2022-39334 nextcloudcmd incorrectly trusts bad TLS certificates
- CVE-2022-39333 Cross-site scripting (XSS) in Nextcloud Desktop Client
- CVE-2022-39332 Cross-site scripting (XSS) in Nextcloud Desktop Client
- CVE-2022-39331 Cross-site Scripting (XSS) in Nexcloud Desktop Client
- CVE-2022-39330 Database resource exhaustion for logged-in users via sharee recommendations with circles
- CVE-2022-3933 Essential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting
- CVE-2022-39329 Profile of disabled user stays accessible
- CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation
- CVE-2022-39327 Improper Control of Generation of Code ('Code Injection') in Azure CLI
- CVE-2022-39326 kartverket/github-workflows's run-terraform allows for RCE via terraform plan
- CVE-2022-39325 Cross-site scripting vulnerability in BaserCMS
- CVE-2022-39324 Grafana vulnerable to spoofing originalUrl of snapshots
- CVE-2022-39323 SQL Injection on REST API in GLPI
- CVE-2022-39322 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field
- CVE-2022-39321 GitHub Actions Runner vulnerable to Docker Command Escaping
- CVE-2022-39320 Heap buffer overflow in urbdrc channel
- CVE-2022-39319 Missing length validation in urbdrc channel in FreeRDP
- CVE-2022-39318 Division by zero in urbdrc channel in FreeRDP
- CVE-2022-39317 Out of bounds read in zgfx decoder in FreeRDP
- CVE-2022-39316 Out of bound read in FreeRDP
- CVE-2022-39315 Kirby CMS vulnerable to user enumeration in the brute force protection
- CVE-2022-39314 User enumeration in the code-based login and password reset forms
- CVE-2022-39313 Parse Server crashes when receiving file download request with invalid byte range
- CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
- CVE-2022-39311 Compromised agents may be able to execute remote code on GoCD Server
- CVE-2022-39310 Malicious agent may be able to impersonate another agent in GoCD
- CVE-2022-39309 GoCD server secret encryption/decryption key leaked to agents during material serialization
- CVE-2022-39308 GoCD API authentication of user access tokens subject to timing attack during comparison
- CVE-2022-39307 Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password
- CVE-2022-39306 Grafana contains Improper Input Validation
- CVE-2022-39305 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2022-39304 ghinstallation returns app JWT in error responses
- CVE-2022-39303 Ree6 vulnerable to SQL Injection
- CVE-2022-39302 Ree6 may bypass webhook protection
- CVE-2022-39301 sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload
- CVE-2022-39300 Signature bypass via multiple root elements in node-SAML
- CVE-2022-3930 Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
- CVE-2022-39299 Signature bypass via multiple root elements in Passport-SAML
- CVE-2022-39298 Deserialization of untrusted data in MelisFront
- CVE-2022-39297 Deserialization of untrusted data in MelisCms
- CVE-2022-39296 Path traversal in MelisAssetManager
- CVE-2022-39295 Improper Neutralization of Alternate XSS Syntax in Knowage-Server
- CVE-2022-39294 (DoS) Denial of Service from unchecked request length in conduit-hyper
- CVE-2022-39293 Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflow
- CVE-2022-39292 Exposure of sensitive Slack webhook URLs in debug logs and traces
- CVE-2022-39291 Denial of service through logs in zoneminder
- CVE-2022-39290 CSRF key bypass using HTTP methods in zoneminder
- CVE-2022-3929 Communication between the client and server partially using CORBA over TCP/IP
- CVE-2022-39289 Database log access in ZoneMinder
- CVE-2022-39288 Denial of service in Fastify via Content-Type header
- CVE-2022-39287 Plaintext transmission of CSRF tokens in tiny-csrf
- CVE-2022-39286 Execution with Unnecessary Privileges in JupyterApp
- CVE-2022-39285 Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
- CVE-2022-39284 Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
- CVE-2022-39283 FreeRDP may read and display out of bounds data
- CVE-2022-39282 RDP client: Read of uninitialized memory with parallel port redirection
- CVE-2022-39281 Remote Denial of Service via Tasks endpoint in fat_free_crm
- CVE-2022-39280 Regular expression denial of service in dparse
- CVE-2022-3928 Hardcoded credential is found in the message queue
- CVE-2022-39279 Discourse-chat plugin susceptible to XSS in channel name and description