Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 257 of 437.
- CVE-2022-39278 Istio vulnerable to denial of service attack due to Golang Regex Library
- CVE-2022-39277 Cross-Site Scripting (XSS) in external links in GLPI
- CVE-2022-39276 Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning
- CVE-2022-39275 Improper object type validation in saleor
- CVE-2022-39274 Buffer Overflow in `ProcessRadioRxDone` in LoRaMac-node
- CVE-2022-39273 Default OAuth Authorization Server secret in FlyteAdmin
- CVE-2022-39272 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration
- CVE-2022-39271 Traefik HTTP/2 connections management could cause a denial of service
- CVE-2022-39270 Arbitrary HTML injection in table-of-contents theme component in DiscoTOC
- CVE-2022-3927 Hardcoded credentials in FOXMAN-UN
- CVE-2022-39269 Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip
- CVE-2022-39268 orchest vulnerable to cross-site request forgery that allows control of a user instance
- CVE-2022-39267 Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groups
- CVE-2022-39266 isolated-vm has vulnerable CachedDataOptions in API
- CVE-2022-39265 Mail settings' command parameter injection in mybb
- CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver
- CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
- CVE-2022-39262 Stored Cross-Site Scripting (XSS) on login page in GLPI
- CVE-2022-39261 Twig may load a template outside a configured directory when using the filesystem loader
- CVE-2022-39260 Git vulnerable to Remote Code Execution via Heap overflow in `git shell`
- CVE-2022-3926 WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF
- CVE-2022-39259 Jadx-gui subject to Denial of Service via Swing HTML rendering
- CVE-2022-39258 mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
- CVE-2022-39257 Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions
- CVE-2022-39256 Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
- CVE-2022-39255 Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion
- CVE-2022-39254 When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
- CVE-2022-39253 Git subject to exposure of sensitive information via local clone of symbolic links
- CVE-2022-39252 matrix-sdk-crypto contains potential impersonation via room key forward responses
- CVE-2022-39251 Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
- CVE-2022-39250 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
- CVE-2022-3925 Buddybadges <= 1.0.0 - Admin+ SQLi
- CVE-2022-39249 Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
- CVE-2022-39248 matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion
- CVE-2022-39246 matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions
- CVE-2022-39245 Mist vulnerable to user providing a Sudo binary for authentication checks
- CVE-2022-39244 Buffer overflow in pjlib scanner and pjmedia
- CVE-2022-39243 NuProcess vulnerable to command-line injection through insertion of NUL character(s)
- CVE-2022-39242 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices
- CVE-2022-39241 Possible Server-Side Request Forgery (SSRF) in webhooks
- CVE-2022-39240 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in MyGraph
- CVE-2022-3924 named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota
- CVE-2022-39239 @netlify/ipx vulnerable to Full Response SSRF and Stored XSS via Cache Poisoning and Improper Host Validation
- CVE-2022-39238 Improper Authentication in Arvados when using PAM as identity provider
- CVE-2022-39237 Digital Signature Hash Algorithms Not Validated in sylabs/sif
- CVE-2022-39236 Matrix Javascript SDK improper beacon events can cause availability issues
- CVE-2022-39234 user session persists even after permanently deleting account in GLPI
- CVE-2022-39233 Tuleap subject to Missing Authorization allowing for branch prefix modification
- CVE-2022-39232 Discourse vulnerable to incomplete quote causing a topic to crash in the browser
- CVE-2022-39231 Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
- CVE-2022-39230 Security issue in fhir-works-on-aws-authz-smart
- CVE-2022-3923 ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup
- CVE-2022-39229 Grafana users with email as a username can block other users from signing in
- CVE-2022-39228 Observable Response Discrepancy in vantage6
- CVE-2022-39227 Python-jwt subject to Authentication Bypass by Spoofing
- CVE-2022-39226 Discourse user profile location and website fields were not sufficiently length-limited
- CVE-2022-39225 Parse Server subject to Incorrect Resource Transfer Between Spheres
- CVE-2022-39224 Arbitrary shell execution when extracting or listing files contained in a malicious rpm.
- CVE-2022-39222 OAuth authorization code exposure in Dex
- CVE-2022-39221 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod
- CVE-2022-39220 XSS Vulnerabilities in WebClient
- CVE-2022-3922 Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting
- CVE-2022-39219 Bifrost users using basic authntication can bypass write permission limit
- CVE-2022-39218 Random number seed fixed during compilation
- CVE-2022-39217 Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv
- CVE-2022-39216 Combodo iTop's weak password reset token leads to account takeover
- CVE-2022-39215 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
- CVE-2022-39214 Authenticated users of Combodo iTop can take over any account
- CVE-2022-39213 Out-of-bounds Read in go-cvss
- CVE-2022-39212 Last video frame is still sent after video is disabled in a call in Nextcloud Talk
- CVE-2022-39211 Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
- CVE-2022-39210 Access to internal files of the Nextcloud Android app
- CVE-2022-3921 Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
- CVE-2022-39209 Uncontrolled Resource Consumption in cmark-gfm
- CVE-2022-39208 Git Repository Disclosure in Onedev
- CVE-2022-39207 Persistent XSS in OneDev
- CVE-2022-39206 CI/CD Docker Escape in OneDev
- CVE-2022-39205 Access Control Bypass in Onedev
- CVE-2022-39203 Parsing issue in matrix-org/node-irc leading to room takeovers
- CVE-2022-39202 IRC mode parameter confusion in matrix-appservice-irc
- CVE-2022-39201 Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
- CVE-2022-39200 Signature checks not applied to some retrieved missing events
- CVE-2022-3920 Consul Peering Imported Nodes/Services Leak
- CVE-2022-39199 Lack of proper validation in immudb
- CVE-2022-39198 Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
- CVE-2022-39197 Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS)
- CVE-2022-39196 Information disclosure in blackboard:blackboard learn
- CVE-2022-39195 Cross-site scripting in lsoft:listserv
- CVE-2022-39194 Denial of service in mediawiki:mediawiki
- CVE-2022-39193 Information disclosure in mediawiki:mediawiki
- CVE-2022-39190 Denial of service in debian:debian linux
- CVE-2022-3919 Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting
- CVE-2022-39189 Privilege escalation in linux:linux kernel
- CVE-2022-39188 Race condition in debian:debian linux
- CVE-2022-39187 Rumpus - FTP server Reflected cross-site scripting (RXSS)
- CVE-2022-39186 EXFO - BV-10 Performance Endpoint Unit Misconfiguration
- CVE-2022-39185 EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.
- CVE-2022-39184 EXFO - BV-10 Performance Endpoint Unit Authentication bypass
- CVE-2022-39183 Moodle Plugin - SAML Auth Open Redirect
- CVE-2022-39182 H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation