# Vulnerabilities published in 2022


- [CVE-2022-31047](https://insights.sbomify.com/CVE-2022-31047/): Insertion of Sensitive Information into Log File in typo3/cms-core (medium 5.3)
- [CVE-2022-31046](https://insights.sbomify.com/CVE-2022-31046/): Information Disclosure via Export Module in TYPO3 CMS (medium 4.3)
- [CVE-2022-31045](https://insights.sbomify.com/CVE-2022-31045/): Ill-formed headers may lead to unexpected behavior in Istio (high 7.0)
- [CVE-2022-31044](https://insights.sbomify.com/CVE-2022-31044/): Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation (high 7.5)
- [CVE-2022-31043](https://insights.sbomify.com/CVE-2022-31043/): Fix failure to strip Authorization header on HTTP downgrade in Guzzle (high 7.5)
- [CVE-2022-31042](https://insights.sbomify.com/CVE-2022-31042/): Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle (high 7.5)
- [CVE-2022-31041](https://insights.sbomify.com/CVE-2022-31041/): Insufficient content-type validation for uploaded files in open-forms (high 7.6)
- [CVE-2022-31040](https://insights.sbomify.com/CVE-2022-31040/): Open Redirect in open-forms (high 7.1)
- [CVE-2022-3104](https://insights.sbomify.com/CVE-2022-3104/): Null dereference in Kernel (medium 5.5)
- [CVE-2022-31039](https://insights.sbomify.com/CVE-2022-31039/): Improper privilege management - Anyone can view room settings in GreenLight (medium 4.3)
- [CVE-2022-31038](https://insights.sbomify.com/CVE-2022-31038/): XSS vulnerability in repository issue list in Gogs (medium 5.4)
- [CVE-2022-31037](https://insights.sbomify.com/CVE-2022-31037/): OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page (medium 6.9)
- [CVE-2022-31036](https://insights.sbomify.com/CVE-2022-31036/): Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server (medium 4.3)
- [CVE-2022-31035](https://insights.sbomify.com/CVE-2022-31035/): External URLs for Deployments can include javascript in argo-cd (critical 9.0)
- [CVE-2022-31034](https://insights.sbomify.com/CVE-2022-31034/): Insecure entropy in argo-cd (high 8.3)
- [CVE-2022-31033](https://insights.sbomify.com/CVE-2022-31033/): Authorization header leak in rubygem Mechanize (medium 5.9)
- [CVE-2022-31032](https://insights.sbomify.com/CVE-2022-31032/): Resources of private projects can be exposed in Tuleap (medium 4.3)
- [CVE-2022-31031](https://insights.sbomify.com/CVE-2022-31031/): Potential stack buffer overflow when parsing message as a STUN client (critical 9.8)
- [CVE-2022-31030](https://insights.sbomify.com/CVE-2022-31030/): containerd CRI plugin: Host memory exhaustion through ExecSync (medium 5.5)
- [CVE-2022-3103](https://insights.sbomify.com/CVE-2022-3103/): off-by-one in io_uring module. (high 7.8)
- [CVE-2022-31029](https://insights.sbomify.com/CVE-2022-31029/): Authenticated XSS in Pi-hole AdminLTE (medium 5.9)
- [CVE-2022-31028](https://insights.sbomify.com/CVE-2022-31028/): Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO (high 7.5)
- [CVE-2022-31027](https://insights.sbomify.com/CVE-2022-31027/): Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator (medium 4.2)
- [CVE-2022-31026](https://insights.sbomify.com/CVE-2022-31026/): Use of Uninitialized Variable in trilogy (medium 5.9)
- [CVE-2022-31025](https://insights.sbomify.com/CVE-2022-31025/): Invite bypasses user approval in Discourse (low 2.6)
- [CVE-2022-31024](https://insights.sbomify.com/CVE-2022-31024/): Federated editing allows iframing remote servers by default in richdocuments (medium 6.5)
- [CVE-2022-31023](https://insights.sbomify.com/CVE-2022-31023/): Dev error stack trace leaking into prod in Play Framework (medium 5.9)
- [CVE-2022-31022](https://insights.sbomify.com/CVE-2022-31022/): Missing Role Based Access Control for the REST handlers in bleve/http package (medium 6.2)
- [CVE-2022-31021](https://insights.sbomify.com/CVE-2022-31021/): Unlinkability broken in ursa when verifiers use malicious keys (low 3.3)
- [CVE-2022-31020](https://insights.sbomify.com/CVE-2022-31020/): Remote code execution in Indy's NODE_UPGRADE transaction (high 8.8)
- [CVE-2022-31019](https://insights.sbomify.com/CVE-2022-31019/): DoS Vulnerability in URLEncodedFormDecoder in Vapor (high 7.5)
- [CVE-2022-31018](https://insights.sbomify.com/CVE-2022-31018/): Denial of service binding form from JSON in Play Framework (high 7.5)
- [CVE-2022-31017](https://insights.sbomify.com/CVE-2022-31017/): Expression Always True vulnerability in Zulip Server (low 2.0)
- [CVE-2022-31016](https://insights.sbomify.com/CVE-2022-31016/): Argo CD vulnerable to Uncontrolled Memory Consumption (medium 6.5)
- [CVE-2022-31015](https://insights.sbomify.com/CVE-2022-31015/): Uncaught Exception (due to a data race) leads to process termination in Waitress (medium 6.5)
- [CVE-2022-31014](https://insights.sbomify.com/CVE-2022-31014/): SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server (medium 5.4)
- [CVE-2022-31013](https://insights.sbomify.com/CVE-2022-31013/): Authentication bypass in Vartalap chat-server (critical 9.1)
- [CVE-2022-31012](https://insights.sbomify.com/CVE-2022-31012/): Git for Windows' installer can be tricked into executing an untrusted binary (high 8.2)
- [CVE-2022-31011](https://insights.sbomify.com/CVE-2022-31011/): TiDB authentication bypass vulnerability (high 7.8)
- [CVE-2022-3101](https://insights.sbomify.com/CVE-2022-3101/): tripleo-ansible may disclose important configuration details from an OpenStack deployment (medium 5.5)
- [CVE-2022-31009](https://insights.sbomify.com/CVE-2022-31009/): DoS vulnerability: Invalid Accent Colors (medium 5.7)
- [CVE-2022-31008](https://insights.sbomify.com/CVE-2022-31008/): Predictable credential obfuscation seed value used in rabbitmq-server (medium 5.5)
- [CVE-2022-31007](https://insights.sbomify.com/CVE-2022-31007/): Privilege escalation from administrator in eLabFTW (medium 4.9)
- [CVE-2022-31006](https://insights.sbomify.com/CVE-2022-31006/): Hyperledger Indy DOS vulnerability (high 7.5)
- [CVE-2022-31005](https://insights.sbomify.com/CVE-2022-31005/): Integer Overflow in Vapor's HTTP Range Request (high 7.5)
- [CVE-2022-31004](https://insights.sbomify.com/CVE-2022-31004/): Potential secrets being logged to disk in CVE Services (high 7.5)
- [CVE-2022-31003](https://insights.sbomify.com/CVE-2022-31003/): Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP (critical 9.1)
- [CVE-2022-31002](https://insights.sbomify.com/CVE-2022-31002/): Out-of-bounds Read in Sofia-SIP (high 7.5)
- [CVE-2022-31001](https://insights.sbomify.com/CVE-2022-31001/): Out-of-bounds Read in Sofia-SIP (high 7.5)
- [CVE-2022-31000](https://insights.sbomify.com/CVE-2022-31000/): CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend (low 2.3)
- [CVE-2022-3100](https://insights.sbomify.com/CVE-2022-3100/): Auth bypass in Red Hat OpenStack Platform (medium 5.9)
- [CVE-2022-30999](https://insights.sbomify.com/CVE-2022-30999/): Possible cross-site scripting attack via unsanitized SVG files in FoF Upload (high 8.7)
- [CVE-2022-30998](https://insights.sbomify.com/CVE-2022-30998/): SQL injection in Homepage Product Organizer for WooCommerce (WordPress plugin) (critical 9.1)
- [CVE-2022-30997](https://insights.sbomify.com/CVE-2022-30997/): Hardcoded credentials in STARDOM Controller (medium 6.3)
- [CVE-2022-30995](https://insights.sbomify.com/CVE-2022-30995/): Auth bypass in Acronis Cyber Backup 12.5 (critical 9.3)
- [CVE-2022-30994](https://insights.sbomify.com/CVE-2022-30994/): Cleartext transmission of sensitive information (high 7.5)
- [CVE-2022-30993](https://insights.sbomify.com/CVE-2022-30993/): Cleartext transmission of sensitive information (high 7.5)
- [CVE-2022-30992](https://insights.sbomify.com/CVE-2022-30992/): Open redirect via user-controlled query parameter (medium 6.1)
- [CVE-2022-30991](https://insights.sbomify.com/CVE-2022-30991/): HTML injection via report name (medium 6.1)
- [CVE-2022-30990](https://insights.sbomify.com/CVE-2022-30990/): Sensitive information disclosure due to insecure folder permissions (high 7.5)
- [CVE-2022-3099](https://insights.sbomify.com/CVE-2022-3099/): Use After Free in vim/vim (high 7.8)
- [CVE-2022-30984](https://insights.sbomify.com/CVE-2022-30984/): Memory corruption in rubrik:cdm (high 7.8)
- [CVE-2022-30983](https://insights.sbomify.com/CVE-2022-30983/): A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inj (medium 6.1)
- [CVE-2022-30982](https://insights.sbomify.com/CVE-2022-30982/): Cross-site scripting in gentics:gentics cms (medium 5.4)
- [CVE-2022-30981](https://insights.sbomify.com/CVE-2022-30981/): Deserialization in gentics:gentics cms (high 8.8)
- [CVE-2022-3098](https://insights.sbomify.com/CVE-2022-3098/): Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF (medium 4.3)
- [CVE-2022-30976](https://insights.sbomify.com/CVE-2022-30976/): Memory corruption in gpac:gpac (high 7.1)
- [CVE-2022-30975](https://insights.sbomify.com/CVE-2022-30975/): Null dereference in artifex:mujs (medium 5.5)
- [CVE-2022-30974](https://insights.sbomify.com/CVE-2022-30974/): Denial of service in artifex:mujs (medium 5.5)
- [CVE-2022-30973](https://insights.sbomify.com/CVE-2022-30973/): Missing fix for CVE-2022-30126 in 1.28.2 (medium 5.5)
- [CVE-2022-30972](https://insights.sbomify.com/CVE-2022-30972/): Cross Site Request Forgery in Jenkins Storable Configs Plugin (high 8.8)
- [CVE-2022-30971](https://insights.sbomify.com/CVE-2022-30971/): XML External Entity Reference in Jenkins Storable Configs Plugin (high 8.8)
- [CVE-2022-30970](https://insights.sbomify.com/CVE-2022-30970/): Cross-site Scripting in Jenkins Autocomplete Parameter Plugin (medium 5.4)
- [CVE-2022-3097](https://insights.sbomify.com/CVE-2022-3097/): LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-30969](https://insights.sbomify.com/CVE-2022-30969/): Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin (high 8.8)
- [CVE-2022-30968](https://insights.sbomify.com/CVE-2022-30968/): Cross-site Scripting in Jenkins vboxwrapper Plugin (medium 5.4)
- [CVE-2022-30967](https://insights.sbomify.com/CVE-2022-30967/): Cross site scripting in Jenkins Selection tasks Plugin (medium 5.4)
- [CVE-2022-30966](https://insights.sbomify.com/CVE-2022-30966/): Cross-site Scripting in Jenkins Random String Parameter Plugin (medium 5.4)
- [CVE-2022-30965](https://insights.sbomify.com/CVE-2022-30965/): Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types (medium 5.4)
- [CVE-2022-30964](https://insights.sbomify.com/CVE-2022-30964/): Cross-site Scripting in Jenkins Multiselect parameter Plugin (medium 5.4)
- [CVE-2022-30963](https://insights.sbomify.com/CVE-2022-30963/): Cross-site Scripting in Jenkins JDK Parameter Plugin (medium 5.4)
- [CVE-2022-30962](https://insights.sbomify.com/CVE-2022-30962/): Cross-site Scripting in Jenkins Global Variable String Parameter Plugin (medium 5.4)
- [CVE-2022-30961](https://insights.sbomify.com/CVE-2022-30961/): Cross-site Scripting in Jenkins Autocomplete Parameter Plugin (medium 5.4)
- [CVE-2022-30960](https://insights.sbomify.com/CVE-2022-30960/): Cross-site Scripting in Jenkins Application Detector Plugin (medium 5.4)
- [CVE-2022-3096](https://insights.sbomify.com/CVE-2022-3096/): WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS (medium 5.4)
- [CVE-2022-30959](https://insights.sbomify.com/CVE-2022-30959/): Missing Authorization in Jenkins SSH plugin (medium 6.5)
- [CVE-2022-30958](https://insights.sbomify.com/CVE-2022-30958/): Cross Site Request Forgery in Jenkins SSH Plugin (high 8.8)
- [CVE-2022-30957](https://insights.sbomify.com/CVE-2022-30957/): Missing permission check in Jenkins SSH Plugin (medium 4.3)
- [CVE-2022-30956](https://insights.sbomify.com/CVE-2022-30956/): Cross-site Scripting in Jenkins Rundeck Plugin (medium 5.4)
- [CVE-2022-30955](https://insights.sbomify.com/CVE-2022-30955/): Missing permission check in Jenkins GitLab Plugin (medium 6.5)
- [CVE-2022-30954](https://insights.sbomify.com/CVE-2022-30954/): Missing permission check in Jenkins Blue Ocean Plugin (medium 6.5)
- [CVE-2022-30953](https://insights.sbomify.com/CVE-2022-30953/): Cross Site Request Forgery in Jenkins Blue Ocean Plugin (medium 6.5)
- [CVE-2022-30952](https://insights.sbomify.com/CVE-2022-30952/): Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin (medium 6.5)
- [CVE-2022-30951](https://insights.sbomify.com/CVE-2022-30951/): Missing Authorization in Jenkins WMI Windows Agents plugin (high 8.8)
- [CVE-2022-30950](https://insights.sbomify.com/CVE-2022-30950/): Buffer overflow in Jenkins WMI Windows Agents plugin (high 8.8)
- [CVE-2022-3095](https://insights.sbomify.com/CVE-2022-3095/): Incorrect parsing of the backslash characters in Dart library (critical 9.8)
- [CVE-2022-30949](https://insights.sbomify.com/CVE-2022-30949/): Path traversal in Jenkins REPO Plugin (medium 5.3)
- [CVE-2022-30948](https://insights.sbomify.com/CVE-2022-30948/): Path traversal in Jenkins Mercurial Plugin (high 7.5)
- [CVE-2022-30947](https://insights.sbomify.com/CVE-2022-30947/): Path traversal in Jenkins Git Mercurial and Repo Plugins (high 7.5)
- [CVE-2022-30946](https://insights.sbomify.com/CVE-2022-30946/): CSRF vulnerability in Jenkins Script Security Plugin (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/320/