Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 281 of 437.
- CVE-2022-3611 Information disclosure in App Store
- CVE-2022-36109 Moby vulnerability relating to supplementary group permissions
- CVE-2022-36108 Cross-Site Scripting in typo3/cms-core
- CVE-2022-36107 Stored Cross-Site Scripting via FileDumpController
- CVE-2022-36106 Missing check for expiration time of password reset token in TYPO3
- CVE-2022-36105 User Enumeration via Response Timing in TYPO3
- CVE-2022-36104 Denial of Service via Page Error Handling in TYPO3/cms
- CVE-2022-36103 Talos worker join token can be used to get elevated access level to the Talos API
- CVE-2022-36102 Acess control list bypassed via crafted specific URLs
- CVE-2022-36101 Sensitive data in backend customer module
- CVE-2022-36100 XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
- CVE-2022-3610 Jeeng Push Notifications < 2.0.4 - Admin+ Stored Cross-Site Scripting
- CVE-2022-36099 XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
- CVE-2022-36098 XWiki Platform Mentions UI vulnerable to Cross-site Scripting
- CVE-2022-36097 XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
- CVE-2022-36096 XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list
- CVE-2022-36095 XWiki Cross-Site Request Forgery (CSRF) for actions on tags
- CVE-2022-36094 XWiki Platform Web Parent POM vulnerable to XSS in the attachment history
- CVE-2022-36093 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
- CVE-2022-36092 XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
- CVE-2022-36091 XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
- CVE-2022-36090 org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users
- CVE-2022-3609 GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS
- CVE-2022-36089 VelaUX APIServer vulnerable to Authentication Bypass by Capture-replay
- CVE-2022-36088 GoCD Windows installations outside default location inadequately restrict installation file permissions
- CVE-2022-36087 OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI
- CVE-2022-36086 linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`
- CVE-2022-36085 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
- CVE-2022-36084 cruddl vulnerable to AQL injection through flexSearch
- CVE-2022-36083 JOSE vulnerable to resource exhaustion via specifically crafted JWE
- CVE-2022-36082 mangadex-downloader vulnerable to unauthorized file reading
- CVE-2022-36081 Wikmd vulnerable to Local File Enumeration when accessing /list
- CVE-2022-36080 Wikmd Cross-site Scripting vulnerability
- CVE-2022-3608 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
- CVE-2022-36079 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
- CVE-2022-36078 Slice Memory Allocation with Excessive Size Value in binary
- CVE-2022-36077 Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect
- CVE-2022-36076 Account takeover via SSO plugins in NodeBB
- CVE-2022-36075 File list exposure in Nextcloud Files Access Control
- CVE-2022-36074 Authentication headers exposed on by Nextcloud Server
- CVE-2022-36073 RubyGems allows creation of users with arbitrary unverified emails
- CVE-2022-36072 SilverwareGames.io used == for hashing instead of ===
- CVE-2022-36071 Recovery codes abuse in SFTPGo
- CVE-2022-36070 Poetry's Untrusted Search Path can lead to Local Code Execution on Windows
- CVE-2022-3607 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint
- CVE-2022-36069 Poetry Argument Injection vulnerability can lead to local Code Execution
- CVE-2022-36068 Discourse moderators can edit themes via the API
- CVE-2022-36067 vm2 vulnerable to Sandbox Escape before v3.9.11
- CVE-2022-36066 Discourse vulnerable to RCE via admins uploading maliciously zipped file
- CVE-2022-36065 GrowthBook account creation and file upload vulnerability in self-hosted configurations
- CVE-2022-36064 Shescape Inefficient Regular Expression Complexity vulnerability
- CVE-2022-36063 USBX Host CDC ECM integer underflow with buffer overflow
- CVE-2022-36062 Grafana folders admin only permission privilege escalation
- CVE-2022-36061 Elrond go can execute on same context checks in VM
- CVE-2022-36060 Prototype pollution in matrix-react-sdk
- CVE-2022-3606 Linux Kernel BPF libbpf.c find_prog_by_sec_insn null pointer dereference
- CVE-2022-36059 Prototype pollution in matrix-js-sdk
- CVE-2022-36058 elrond-go MultiESDTNFTTransfer call on a SC address with missing function name
- CVE-2022-36057 Discourse-Chat Cross-Site Scripting issue for channel names and descriptions
- CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign
- CVE-2022-36055 Denial of service in Helm
- CVE-2022-36054 Out-of-bounds write when decompressing 6LoWPAN payload in Contiki-NG
- CVE-2022-36053 Out-of-bounds read in the uIP buffer module
- CVE-2022-36052 Out-of-bounds read when decompressing UDP header
- CVE-2022-36051 Broken Authorization in ZITADEL Actions
- CVE-2022-3605 WP CSV Exporter < 1.3.7 - CSV Injection
- CVE-2022-36049 Flux2 Helm Controller denial of service
- CVE-2022-36048 IP address leak via image proxy bypass in Zulip Server
- CVE-2022-36046 Unexpected server crash in Next.js version 12.2.3
- CVE-2022-36045 Account takeover via cryptographically weak PRNG in NodeBB Forum
- CVE-2022-36044 Rizin Out-of-bounds Write vulnerability in Lua binary plugin
- CVE-2022-36043 Rizin Double Free in bobj.c when using qnx binary plugin
- CVE-2022-36042 Rizin Out-of-bounds Write vulnerability in dyld cache binary plugin
- CVE-2022-36041 Rizin Out-of-bounds Write vulnerability in Mach-O binary plugin
- CVE-2022-36040 Rizin Out-of-bounds Write vulnerability in pyc/marshal.c
- CVE-2022-3604 Contact Form Entries < 1.3.0 - CSV Injection
- CVE-2022-36039 Out-of-bounds write when parsing DEX files in Rizin
- CVE-2022-36038 CircuitVerse potential RCE vulnerability via Oj.load
- CVE-2022-36037 Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby
- CVE-2022-36036 Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
- CVE-2022-36035 Flux CLI Workload Injection
- CVE-2022-36034 Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.js
- CVE-2022-36033 jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled
- CVE-2022-36032 ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent
- CVE-2022-36031 Unhandled exception on illegal filename_disk value
- CVE-2022-36030 SQL Injection in Project-nexus
- CVE-2022-3603 Export customers list CSV for WooCommerce < 2.0.69 - CSV Injection
- CVE-2022-36029 BigBlueButton Greenlight Open Redirect vulnerability
- CVE-2022-36028 BigBlueButton Greenlight Open Redirect vulnerability
- CVE-2022-36027 Segfault TFLite converter on per-channel quantized transposed convolutions in TensorFlow
- CVE-2022-36026 `CHECK` fail in `QuantizeAndDequantizeV3` in TensorFlow
- CVE-2022-36025 Incorrect Conversion between Numeric Types in Besu Ethereum Client
- CVE-2022-36024 Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code execution
- CVE-2022-36023 Remote denial of service in Hyperledger Fabric Gateway
- CVE-2022-36022 Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples
- CVE-2022-36021 Redis string pattern matching can be abused to achieve Denial of Service
- CVE-2022-36020 Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer
- CVE-2022-3602 X.509 Email Address 4-byte Buffer Overflow
- CVE-2022-36019 `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel` in TensorFlow
- CVE-2022-36018 `CHECK` fail in `RaggedTensorToVariant` in TensorFlow