# Vulnerabilities published in 2022


- [CVE-2022-31139](https://insights.sbomify.com/CVE-2022-31139/): No security checking for UnsafeAccess.getInstance() in UnsafeAccessor (medium 5.9)
- [CVE-2022-31138](https://insights.sbomify.com/CVE-2022-31138/): OS Command Injection in mailcow (high 8.8)
- [CVE-2022-31137](https://insights.sbomify.com/CVE-2022-31137/): Unauthenticated Remote Code Execution in Roxy-WI (critical 10.0)
- [CVE-2022-31136](https://insights.sbomify.com/CVE-2022-31136/): Cross-site Scripting in BookWyrm (medium 6.3)
- [CVE-2022-31135](https://insights.sbomify.com/CVE-2022-31135/): Maliciously crafted evidence packet may cause denial of service (medium 6.5)
- [CVE-2022-31134](https://insights.sbomify.com/CVE-2022-31134/): Zulip Server public data export contains attachments that are non-public (medium 4.9)
- [CVE-2022-31133](https://insights.sbomify.com/CVE-2022-31133/): Cross site scripting in HumHub (medium 5.9)
- [CVE-2022-31132](https://insights.sbomify.com/CVE-2022-31132/): Unauthenticated SSRF in 3rd party module "cerdic/csstidy" (high 8.3)
- [CVE-2022-31131](https://insights.sbomify.com/CVE-2022-31131/): Ownership check missing when updating or deleting mail attachments in Nextcloud mail (medium 5.4)
- [CVE-2022-31130](https://insights.sbomify.com/CVE-2022-31130/): Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (medium 4.9)
- [CVE-2022-3113](https://insights.sbomify.com/CVE-2022-3113/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31129](https://insights.sbomify.com/CVE-2022-31129/): Inefficient Regular Expression Complexity in moment (high 7.5)
- [CVE-2022-31128](https://insights.sbomify.com/CVE-2022-31128/): Fine grained permissions are not checked in Tuleap (medium 5.4)
- [CVE-2022-31127](https://insights.sbomify.com/CVE-2022-31127/): Improper handling of email input in next-auth (high 7.1)
- [CVE-2022-31126](https://insights.sbomify.com/CVE-2022-31126/): Unauthenticated Remote Code Execution in Roxy-wi (critical 10.0)
- [CVE-2022-31125](https://insights.sbomify.com/CVE-2022-31125/): Authentication Bypass in Roxy-wi (critical 10.0)
- [CVE-2022-31124](https://insights.sbomify.com/CVE-2022-31124/): Possible leak of key's raw field if declared length is incorrect in openssh_key_parser (high 7.7)
- [CVE-2022-31123](https://insights.sbomify.com/CVE-2022-31123/): Grafana plugin signature bypass vulnerability (medium 6.1)
- [CVE-2022-31122](https://insights.sbomify.com/CVE-2022-31122/): Auth bypass in wire-server (critical 9.8)
- [CVE-2022-31121](https://insights.sbomify.com/CVE-2022-31121/): Improper Input Validation in fabric hyperledger (high 7.5)
- [CVE-2022-31120](https://insights.sbomify.com/CVE-2022-31120/): Federated share accepting/declining is not logged in audit log in Nextcloud Server (low 2.1)
- [CVE-2022-3112](https://insights.sbomify.com/CVE-2022-3112/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31119](https://insights.sbomify.com/CVE-2022-31119/): Password disclosure in log file in Nextcloud Mail App (low 3.1)
- [CVE-2022-31118](https://insights.sbomify.com/CVE-2022-31118/): Missing brute force protection on cloud federation sharing in Nextcloud Server (medium 6.5)
- [CVE-2022-31117](https://insights.sbomify.com/CVE-2022-31117/): Double free of buffer during string decoding in ujson (medium 5.9)
- [CVE-2022-31116](https://insights.sbomify.com/CVE-2022-31116/): Incorrect handling of invalid surrogate pair characters in ujson (high 7.5)
- [CVE-2022-31115](https://insights.sbomify.com/CVE-2022-31115/): Unsafe YAML deserialization in opensearch-ruby (high 8.8)
- [CVE-2022-31114](https://insights.sbomify.com/CVE-2022-31114/): backpack/crud Vulnerable to Cross-site Scripting (medium 5.1)
- [CVE-2022-31113](https://insights.sbomify.com/CVE-2022-31113/): Cross-Site Scripting in Canarytoken history (medium 6.3)
- [CVE-2022-31112](https://insights.sbomify.com/CVE-2022-31112/): Protected fields exposed via LiveQuery in parse-server (high 8.2)
- [CVE-2022-31111](https://insights.sbomify.com/CVE-2022-31111/): Discrepency in transfer value and actual value due to incorrect truncation in Frontier (medium 5.3)
- [CVE-2022-31110](https://insights.sbomify.com/CVE-2022-31110/): Denial of Service (DoS) vulnerability in RSSHub (medium 5.3)
- [CVE-2022-3111](https://insights.sbomify.com/CVE-2022-3111/): Other in Kernel (medium 5.5)
- [CVE-2022-31109](https://insights.sbomify.com/CVE-2022-31109/): HTTP Host Header Attack Vulnerability in laminas-diactoros (high 7.2)
- [CVE-2022-31108](https://insights.sbomify.com/CVE-2022-31108/): Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js (medium 4.1)
- [CVE-2022-31107](https://insights.sbomify.com/CVE-2022-31107/): Grafana account takeover via OAuth vulnerability (high 7.1)
- [CVE-2022-31106](https://insights.sbomify.com/CVE-2022-31106/): Prototype Pollution in underscore.deep (high 8.3)
- [CVE-2022-31105](https://insights.sbomify.com/CVE-2022-31105/): Argo CD's certificate verification is skipped for connections to OIDC providers (high 8.3)
- [CVE-2022-31104](https://insights.sbomify.com/CVE-2022-31104/): Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime (medium 4.8)
- [CVE-2022-31103](https://insights.sbomify.com/CVE-2022-31103/): Improper handling of CSS at-rules in lettersanitizer (high 7.5)
- [CVE-2022-31102](https://insights.sbomify.com/CVE-2022-31102/): Cross-site Scripting for Argo CD single sign on users (low 2.6)
- [CVE-2022-31101](https://insights.sbomify.com/CVE-2022-31101/): SQL Injection in prestashop/blockwishlist (high 8.1)
- [CVE-2022-31100](https://insights.sbomify.com/CVE-2022-31100/): Reachable Assertion in rulex (medium 6.5)
- [CVE-2022-3110](https://insights.sbomify.com/CVE-2022-3110/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31099](https://insights.sbomify.com/CVE-2022-31099/): Uncontrolled Recursion in rulex (medium 6.5)
- [CVE-2022-31098](https://insights.sbomify.com/CVE-2022-31098/): Weave GitOps leaked cluster credentials into logs on connection errors (critical 9.0)
- [CVE-2022-31097](https://insights.sbomify.com/CVE-2022-31097/): Stored XSS in Grafana's Unified Alerting (high 7.3)
- [CVE-2022-31096](https://insights.sbomify.com/CVE-2022-31096/): Security feature bypass in discourse (medium 5.7)
- [CVE-2022-31095](https://insights.sbomify.com/CVE-2022-31095/): Exposure of Sensitive Information in discourse-chat (medium 4.3)
- [CVE-2022-31094](https://insights.sbomify.com/CVE-2022-31094/): Cross site scripting vulnerability in ScratchTools (high 7.1)
- [CVE-2022-31093](https://insights.sbomify.com/CVE-2022-31093/): Improper Handling of `callbackUrl` parameter in next-auth (high 7.5)
- [CVE-2022-31092](https://insights.sbomify.com/CVE-2022-31092/): SQL injection in pimcore (high 7.5)
- [CVE-2022-31091](https://insights.sbomify.com/CVE-2022-31091/): Change in port should be considered a change in origin in Guzzle (high 7.7)
- [CVE-2022-31090](https://insights.sbomify.com/CVE-2022-31090/): CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle (high 7.7)
- [CVE-2022-3109](https://insights.sbomify.com/CVE-2022-3109/): Null dereference in FFmpeg (high 7.5)
- [CVE-2022-31089](https://insights.sbomify.com/CVE-2022-31089/): Invalid file request can crashe parse-server (high 7.5)
- [CVE-2022-31088](https://insights.sbomify.com/CVE-2022-31088/): Unauthenticated LDAP Injection in ldap-account-manager (medium 6.5)
- [CVE-2022-31087](https://insights.sbomify.com/CVE-2022-31087/): Incorrect Default Permissions in ldap-account-manager (high 7.8)
- [CVE-2022-31086](https://insights.sbomify.com/CVE-2022-31086/): Incorrect Regular Expressions in ldap-account-manager (medium 6.6)
- [CVE-2022-31085](https://insights.sbomify.com/CVE-2022-31085/): Missing Encryption of Sensitive Data in ldap-account-manager (medium 5.5)
- [CVE-2022-31084](https://insights.sbomify.com/CVE-2022-31084/): Unauthenticated Remote Code Execution in ldap-account-manager (critical 9.0)
- [CVE-2022-31083](https://insights.sbomify.com/CVE-2022-31083/): Authentication bypass in Parse Server Apple Game Center auth adapter (high 8.6)
- [CVE-2022-31082](https://insights.sbomify.com/CVE-2022-31082/): SQL Injection via package deployment tasks in glpi-inventory-plugin (medium 5.8)
- [CVE-2022-31081](https://insights.sbomify.com/CVE-2022-31081/): Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon (high 7.3)
- [CVE-2022-31080](https://insights.sbomify.com/CVE-2022-31080/): KubeEdge Websocket Client in package Viaduct: DoS from large response message (medium 4.4)
- [CVE-2022-3108](https://insights.sbomify.com/CVE-2022-3108/): Other in Kernel (medium 5.5)
- [CVE-2022-31079](https://insights.sbomify.com/CVE-2022-31079/): KubeEdge Cloud Stream and Edge Stream DoS from large stream message (medium 4.4)
- [CVE-2022-31078](https://insights.sbomify.com/CVE-2022-31078/): KubeEdge CloudCore Router memory exhaustion (medium 4.4)
- [CVE-2022-31077](https://insights.sbomify.com/CVE-2022-31077/): Malicious response from KubeEdge can crash CSI Driver controller server (medium 4.0)
- [CVE-2022-31076](https://insights.sbomify.com/CVE-2022-31076/): Malicious Message can crash CloudCore in KubeEdge (medium 4.2)
- [CVE-2022-31075](https://insights.sbomify.com/CVE-2022-31075/): KubeEdge DoS when signing the CSR from EdgeCore (medium 4.9)
- [CVE-2022-31074](https://insights.sbomify.com/CVE-2022-31074/): KubeEdge Cloud AdmissionController component DoS (medium 4.5)
- [CVE-2022-31073](https://insights.sbomify.com/CVE-2022-31073/): KubeEdge Edge ServiceBus module DoS (medium 6.5)
- [CVE-2022-31072](https://insights.sbomify.com/CVE-2022-31072/): Octokit gem published with world-writable files (low 2.5)
- [CVE-2022-31071](https://insights.sbomify.com/CVE-2022-31071/): Octopoller gem published with world-writable files (low 2.5)
- [CVE-2022-31070](https://insights.sbomify.com/CVE-2022-31070/): Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy (medium 5.8)
- [CVE-2022-3107](https://insights.sbomify.com/CVE-2022-3107/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31069](https://insights.sbomify.com/CVE-2022-31069/): Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy (medium 5.8)
- [CVE-2022-31068](https://insights.sbomify.com/CVE-2022-31068/): Sensitive Data Exposure on Refused Inventory Files in GLPI (medium 5.3)
- [CVE-2022-31066](https://insights.sbomify.com/CVE-2022-31066/): Configuration API in EdgeXFoundry exposes message bus credentials to local unauthenticated users (medium 5.9)
- [CVE-2022-31065](https://insights.sbomify.com/CVE-2022-31065/): Cross site scripting vulnerability for private chat in bigbluebutton (medium 6.5)
- [CVE-2022-31064](https://insights.sbomify.com/CVE-2022-31064/): Cross site scripting in username that will trigger by sending chat (medium 6.5)
- [CVE-2022-31063](https://insights.sbomify.com/CVE-2022-31063/): Cross site scripting via the title of a document in Tuleap (medium 6.5)
- [CVE-2022-31062](https://insights.sbomify.com/CVE-2022-31062/): Unauthenticated Local File Inclusion (medium 5.3)
- [CVE-2022-31061](https://insights.sbomify.com/CVE-2022-31061/): SQL injection on login page in GLPI (critical 9.8)
- [CVE-2022-31060](https://insights.sbomify.com/CVE-2022-31060/): Banner topic data is exposed on login-required Discourse sites (medium 5.3)
- [CVE-2022-3106](https://insights.sbomify.com/CVE-2022-3106/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31059](https://insights.sbomify.com/CVE-2022-31059/): Discourse Calendar Event names susceptible to Cross-site Scripting (medium 6.5)
- [CVE-2022-31058](https://insights.sbomify.com/CVE-2022-31058/): SQL injection via the field name of a tracker in Tuleap (high 7.2)
- [CVE-2022-31057](https://insights.sbomify.com/CVE-2022-31057/): Authenticated Stored XSS in Shopware Administration (medium 6.5)
- [CVE-2022-31056](https://insights.sbomify.com/CVE-2022-31056/): SQL injection with _actor parameter in GLPI (critical 9.8)
- [CVE-2022-31055](https://insights.sbomify.com/CVE-2022-31055/): Improper Access Control in kctf (high 7.5)
- [CVE-2022-31054](https://insights.sbomify.com/CVE-2022-31054/): Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events (high 7.5)
- [CVE-2022-31053](https://insights.sbomify.com/CVE-2022-31053/): Signature forgery in Biscuit (critical 9.8)
- [CVE-2022-31052](https://insights.sbomify.com/CVE-2022-31052/): URL previews can crash Synapse media repositories or Synapse monoliths (medium 6.5)
- [CVE-2022-31051](https://insights.sbomify.com/CVE-2022-31051/): Exposure of Sensitive Information to an Unauthorized Actor in semantic-release (medium 4.4)
- [CVE-2022-31050](https://insights.sbomify.com/CVE-2022-31050/): Insufficient Session Expiration in TYPO3 Admin Tool (medium 6.0)
- [CVE-2022-3105](https://insights.sbomify.com/CVE-2022-3105/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31049](https://insights.sbomify.com/CVE-2022-31049/): Cross-Site Scripting in Frontend Login Mailer (medium 5.4)
- [CVE-2022-31048](https://insights.sbomify.com/CVE-2022-31048/): Cross-Site Scripting in Form Framework (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/319/