Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 367 of 437.
- CVE-2022-25213 Hardcoded credentials in Phicomm Routers
- CVE-2022-25212 CSRF vulnerability in Jenkins SWAMP Plugin allows capturing credentials
- CVE-2022-25211 Missing permission check in Jenkins SWAMP Plugin allows capturing credentials
- CVE-2022-25210 Improper Synchronization in Jenkins Convertigo Mobile Platform Plugin
- CVE-2022-2521 Memory corruption in libtiff
- CVE-2022-25209 Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
- CVE-2022-25208 Missing permission checks in Jenkins Chef Sinatra Plugin allow XXE
- CVE-2022-25207 CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE
- CVE-2022-25206 Missing Authorization in Jenkins dbCharts Plugin
- CVE-2022-25205 Cross-Site Request Forgery in Jenkins dbCharts Plugin
- CVE-2022-25204 Protection Mechanism Failure in Jenkins Doktor Plugin
- CVE-2022-25203 Stored Cross-site Scripting vulnerability in Jenkins Team Views Plugin
- CVE-2022-25202 Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds (Simple) Plugin
- CVE-2022-25201 Missing permission checks in Jenkins Checkmarx Plugin allow capturing credentials
- CVE-2022-25200 CSRF vulnerability in Jenkins Checkmarx Plugin allow capturing credentials
- CVE-2022-2520 Denial of service in libtiff
- CVE-2022-25199 Missing permission check in Jenkins SCP publisher Plugin
- CVE-2022-25198 CSRF vulnerability in Jenkins SCP publisher Plugin
- CVE-2022-25197 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin allows reading arbitrary files
- CVE-2022-25196 Open redirect vulnerability in Jenkins GitLab Authentication Plugin
- CVE-2022-25195 Missing permission check in Jenkins autonomiq Plugin
- CVE-2022-25194 CSRF vulnerability in Jenkins autonomiq plugin
- CVE-2022-25193 Jenkins Snow Commander Plugin prior to 2.0 vulnerable to Missing Authorization
- CVE-2022-25192 Jenkins Snow Commander Plugin 2.0 vulnerable to Cross-Site Request Forgery
- CVE-2022-25191 Stored Cross-site Scripting vulnerability in Jenkins Agent Server Parameter Plugin
- CVE-2022-25190 Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs
- CVE-2022-2519 Memory corruption in libtiff
- CVE-2022-25189 Stored Cross-site Scripting vulnerability in Jenkins Custom Checkbox Parameter Plugin
- CVE-2022-25188 Path traversal vulnerability in Jenkins Fortify Plugin
- CVE-2022-25187 Jenkins Support Core Plugin stores sensitive data in plain text
- CVE-2022-25186 Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
- CVE-2022-25185 Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin
- CVE-2022-25184 Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin
- CVE-2022-25183 Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure
- CVE-2022-25182 Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure
- CVE-2022-25181 Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure
- CVE-2022-25180 Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials
- CVE-2022-2518 Stockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2022-25179 Link Following in Jenkins Pipeline Multibranch Plugin
- CVE-2022-25178 Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
- CVE-2022-25177 Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
- CVE-2022-25176 Improper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin
- CVE-2022-25175 Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection
- CVE-2022-25174 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin
- CVE-2022-25173 Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Groovy Plugin
- CVE-2022-25172 Misconfiguration in InRouter302
- CVE-2022-25171 Command Injection
- CVE-2022-25170 ICSA-22-055-01 FATEK Automation FvDesigner
- CVE-2022-2517 Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover
- CVE-2022-25169 Apache Tika BPGParser Memory Usage DoS
- CVE-2022-25168 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
- CVE-2022-25167 Apache Flume vulnerable to a JNDI RCE in JMSSource
- CVE-2022-25166 Information disclosure in amazon:aws client vpn
- CVE-2022-25165 Race condition in amazon:aws client vpn
- CVE-2022-25164 Information disclosure in GX Works3
- CVE-2022-25163 Other in Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi Electric MELSEC-L series LJ71E71-100; Mitsubishi Electric MELSEC iQ-R Series RD81MES96N
- CVE-2022-25162 Denial of service in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS); Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R); Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS)
- CVE-2022-25161 Denial of service in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS); Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS; Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS); Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R); Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS)
- CVE-2022-25160 Information disclosure in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100
- CVE-2022-2516 Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'
- CVE-2022-25159 Auth bypass in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100
- CVE-2022-25158 Information disclosure in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; itsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ71GF11-T2; Mitsubishi Electric MELSEC iQ-R series RJ71GP21(S)-SX; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2
- CVE-2022-25157 Auth bypass in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ71GF11-T2; Mitsubishi Electric MELSEC iQ-R series RJ71GP21(S)-SX; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2
- CVE-2022-25156 Weak cryptography in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC Q series QJ72BR15; Mitsubishi Electric MELSEC Q series QJ72LP25(-25/G/GE); Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2
- CVE-2022-25155 Auth bypass in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU; Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU; Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU; Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU; Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU; Mitsubishi Electric MELSEC iQ-R series RJ71GN11-T2; Mitsubishi Electric MELSEC iQ-R series RJ71GN11-EIP; Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4); Mitsubishi Electric MELSEC iQ-R series RJ71EN71; Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2; Mitsubishi Electric MELSEC Q series Q03UDECPU; Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4); Mitsubishi Electric MELSEC Q series QJ71E71-100; Mitsubishi Electric MELSEC Q series QJ72BR15; Mitsubishi Electric MELSEC Q series QJ72LP25(-25/G/GE); Mitsubishi Electric MELSEC L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC L series L26CPU-(P)BT; Mitsubishi Electric MELSEC L series LJ71C24(-R2); Mitsubishi Electric MELSEC L series LJ71E71-100; Mitsubishi Electric MELSEC L series LJ72GF15-T2
- CVE-2022-25154 Privilege escalation in samsung:t5 firmware
- CVE-2022-25153 ITarian - Local privilege escalation in Endpoint Manager agent on Windows
- CVE-2022-25152 ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals
- CVE-2022-25151 ITarian - Session cookie not protected by HttpOnly flag
- CVE-2022-25150 Privilege escalation in malwarebytes:binisoft windows firewall control
- CVE-2022-2515 Simple Banner <= 2.11.0 - Authenticated Stored Cross-Site Scripting
- CVE-2022-25149 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP
- CVE-2022-25148 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id
- CVE-2022-25147 Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
- CVE-2022-25146 Liferay Portal and Liferay DXP fails to check origin of event messages
- CVE-2022-2514 Cross-site Scripting (XSS) - Reflected in beancount/fava
- CVE-2022-25139 Use after free in f5:njs
- CVE-2022-25138 Cross-site scripting in axelor:open suite
- CVE-2022-25137 Command injection in totolink:t10 firmware
- CVE-2022-25136 Command injection in totolink:t10 firmware
- CVE-2022-25135 Command injection in totolink:t6 firmware
- CVE-2022-25134 Command injection in totolink:t6 firmware
- CVE-2022-25133 Command injection in totolink:t6 firmware
- CVE-2022-25132 Command injection in totolink:t10 firmware
- CVE-2022-25131 Command injection in totolink:t10 firmware
- CVE-2022-25130 Command injection in totolink:t10 firmware
- CVE-2022-2513 Information disclosure in 650 Connectivity Package
- CVE-2022-25125 SQL injection in mingsoft:mcms
- CVE-2022-2512 Information disclosure in GitLab
- CVE-2022-25115 File upload in home owners collection management system project:home owners collection management system
- CVE-2022-25114 Cross-site scripting in event management project:event management
- CVE-2022-2511 Potential XSS in title URL parameter
- CVE-2022-25108 Null dereference in foxit:pdf editor
- CVE-2022-25106 Memory corruption in dlink:dir-859 a3 firmware
- CVE-2022-25104 Path traversal in horizontcms project:horizontcms
- CVE-2022-25101 Code injection in wbce:wbce cms
- CVE-2022-2510 Potential XSS on Special:SearchCenter
- CVE-2022-25099 Code injection in wbce:wbce cms
- CVE-2022-25098 Arbitrary file delete in ectouch/ectouch
- CVE-2022-25096 SQL injection in home owners collection management system project:home owners collection management system