Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 320 of 437.
- CVE-2022-31047 Insertion of Sensitive Information into Log File in typo3/cms-core
- CVE-2022-31046 Information Disclosure via Export Module in TYPO3 CMS
- CVE-2022-31045 Ill-formed headers may lead to unexpected behavior in Istio
- CVE-2022-31044 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
- CVE-2022-31043 Fix failure to strip Authorization header on HTTP downgrade in Guzzle
- CVE-2022-31042 Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
- CVE-2022-31041 Insufficient content-type validation for uploaded files in open-forms
- CVE-2022-31040 Open Redirect in open-forms
- CVE-2022-3104 Null dereference in Kernel
- CVE-2022-31039 Improper privilege management - Anyone can view room settings in GreenLight
- CVE-2022-31038 XSS vulnerability in repository issue list in Gogs
- CVE-2022-31037 OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page
- CVE-2022-31036 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
- CVE-2022-31035 External URLs for Deployments can include javascript in argo-cd
- CVE-2022-31034 Insecure entropy in argo-cd
- CVE-2022-31033 Authorization header leak in rubygem Mechanize
- CVE-2022-31032 Resources of private projects can be exposed in Tuleap
- CVE-2022-31031 Potential stack buffer overflow when parsing message as a STUN client
- CVE-2022-31030 containerd CRI plugin: Host memory exhaustion through ExecSync
- CVE-2022-3103 off-by-one in io_uring module.
- CVE-2022-31029 Authenticated XSS in Pi-hole AdminLTE
- CVE-2022-31028 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO
- CVE-2022-31027 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator
- CVE-2022-31026 Use of Uninitialized Variable in trilogy
- CVE-2022-31025 Invite bypasses user approval in Discourse
- CVE-2022-31024 Federated editing allows iframing remote servers by default in richdocuments
- CVE-2022-31023 Dev error stack trace leaking into prod in Play Framework
- CVE-2022-31022 Missing Role Based Access Control for the REST handlers in bleve/http package
- CVE-2022-31021 Unlinkability broken in ursa when verifiers use malicious keys
- CVE-2022-31020 Remote code execution in Indy's NODE_UPGRADE transaction
- CVE-2022-31019 DoS Vulnerability in URLEncodedFormDecoder in Vapor
- CVE-2022-31018 Denial of service binding form from JSON in Play Framework
- CVE-2022-31017 Expression Always True vulnerability in Zulip Server
- CVE-2022-31016 Argo CD vulnerable to Uncontrolled Memory Consumption
- CVE-2022-31015 Uncaught Exception (due to a data race) leads to process termination in Waitress
- CVE-2022-31014 SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server
- CVE-2022-31013 Authentication bypass in Vartalap chat-server
- CVE-2022-31012 Git for Windows' installer can be tricked into executing an untrusted binary
- CVE-2022-31011 TiDB authentication bypass vulnerability
- CVE-2022-3101 tripleo-ansible may disclose important configuration details from an OpenStack deployment
- CVE-2022-31009 DoS vulnerability: Invalid Accent Colors
- CVE-2022-31008 Predictable credential obfuscation seed value used in rabbitmq-server
- CVE-2022-31007 Privilege escalation from administrator in eLabFTW
- CVE-2022-31006 Hyperledger Indy DOS vulnerability
- CVE-2022-31005 Integer Overflow in Vapor's HTTP Range Request
- CVE-2022-31004 Potential secrets being logged to disk in CVE Services
- CVE-2022-31003 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
- CVE-2022-31002 Out-of-bounds Read in Sofia-SIP
- CVE-2022-31001 Out-of-bounds Read in Sofia-SIP
- CVE-2022-31000 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
- CVE-2022-3100 Auth bypass in Red Hat OpenStack Platform
- CVE-2022-30999 Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
- CVE-2022-30998 SQL injection in Homepage Product Organizer for WooCommerce (WordPress plugin)
- CVE-2022-30997 Hardcoded credentials in STARDOM Controller
- CVE-2022-30995 Auth bypass in Acronis Cyber Backup 12.5
- CVE-2022-30994 Cleartext transmission of sensitive information
- CVE-2022-30993 Cleartext transmission of sensitive information
- CVE-2022-30992 Open redirect via user-controlled query parameter
- CVE-2022-30991 HTML injection via report name
- CVE-2022-30990 Sensitive information disclosure due to insecure folder permissions
- CVE-2022-3099 Use After Free in vim/vim
- CVE-2022-30984 Memory corruption in rubrik:cdm
- CVE-2022-30983 A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inj
- CVE-2022-30982 Cross-site scripting in gentics:gentics cms
- CVE-2022-30981 Deserialization in gentics:gentics cms
- CVE-2022-3098 Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF
- CVE-2022-30976 Memory corruption in gpac:gpac
- CVE-2022-30975 Null dereference in artifex:mujs
- CVE-2022-30974 Denial of service in artifex:mujs
- CVE-2022-30973 Missing fix for CVE-2022-30126 in 1.28.2
- CVE-2022-30972 Cross Site Request Forgery in Jenkins Storable Configs Plugin
- CVE-2022-30971 XML External Entity Reference in Jenkins Storable Configs Plugin
- CVE-2022-30970 Cross-site Scripting in Jenkins Autocomplete Parameter Plugin
- CVE-2022-3097 LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF
- CVE-2022-30969 Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin
- CVE-2022-30968 Cross-site Scripting in Jenkins vboxwrapper Plugin
- CVE-2022-30967 Cross site scripting in Jenkins Selection tasks Plugin
- CVE-2022-30966 Cross-site Scripting in Jenkins Random String Parameter Plugin
- CVE-2022-30965 Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types
- CVE-2022-30964 Cross-site Scripting in Jenkins Multiselect parameter Plugin
- CVE-2022-30963 Cross-site Scripting in Jenkins JDK Parameter Plugin
- CVE-2022-30962 Cross-site Scripting in Jenkins Global Variable String Parameter Plugin
- CVE-2022-30961 Cross-site Scripting in Jenkins Autocomplete Parameter Plugin
- CVE-2022-30960 Cross-site Scripting in Jenkins Application Detector Plugin
- CVE-2022-3096 WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS
- CVE-2022-30959 Missing Authorization in Jenkins SSH plugin
- CVE-2022-30958 Cross Site Request Forgery in Jenkins SSH Plugin
- CVE-2022-30957 Missing permission check in Jenkins SSH Plugin
- CVE-2022-30956 Cross-site Scripting in Jenkins Rundeck Plugin
- CVE-2022-30955 Missing permission check in Jenkins GitLab Plugin
- CVE-2022-30954 Missing permission check in Jenkins Blue Ocean Plugin
- CVE-2022-30953 Cross Site Request Forgery in Jenkins Blue Ocean Plugin
- CVE-2022-30952 Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin
- CVE-2022-30951 Missing Authorization in Jenkins WMI Windows Agents plugin
- CVE-2022-30950 Buffer overflow in Jenkins WMI Windows Agents plugin
- CVE-2022-3095 Incorrect parsing of the backslash characters in Dart library
- CVE-2022-30949 Path traversal in Jenkins REPO Plugin
- CVE-2022-30948 Path traversal in Jenkins Mercurial Plugin
- CVE-2022-30947 Path traversal in Jenkins Git Mercurial and Repo Plugins
- CVE-2022-30946 CSRF vulnerability in Jenkins Script Security Plugin