Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 369 of 437.
- CVE-2022-24951 Race condition in Eternal Terminal
- CVE-2022-24950 Race condition in Eternal Terminal
- CVE-2022-2495 Cross-site Scripting (XSS) - Stored in microweber/microweber
- CVE-2022-24949 Race condition in Eternal Terminal
- CVE-2022-24948 Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen
- CVE-2022-24947 Apache JSPWiki CSRF Account Takeover
- CVE-2022-24946 Denial of service in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V; Mitsubishi Electric MELSEC-Q Series Q03UDECPU; Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V; Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G); Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS; Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC-L series L26CPU-(P)BT; Mitsubishi Electric MELIPC Series MI5122-VW
- CVE-2022-24942 Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution
- CVE-2022-2494 Cross-site Scripting (XSS) - Stored in openemr/openemr
- CVE-2022-24939 Malformed Zigbee packet with invalid destination address causes Assert
- CVE-2022-24938 Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earlier
- CVE-2022-24937 Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier
- CVE-2022-24936 Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices
- CVE-2022-24935 Missing authorization in lexmark:lexmark firmware
- CVE-2022-24934 Code injection in wps:wps office
- CVE-2022-24932 Security feature bypass in Samsung Clould
- CVE-2022-24931 Missing authorization in Samsung Mobile Devices
- CVE-2022-24930 Missing authorization in Samsung Wearable Devices
- CVE-2022-2493 Data Access from Outside Expected Data Manager Component in openemr/openemr
- CVE-2022-24929 Missing authorization in Samsung Mobile Devices
- CVE-2022-24928 Misconfiguration in Samsung Mobile Devices
- CVE-2022-24927 Privilege escalation in Samsung Video Player
- CVE-2022-24926 Cross-site scripting in SmartTagPlugin
- CVE-2022-24925 Denial of service in Samsung Mobile Devices
- CVE-2022-24924 Missing authorization in LiveWallpaper
- CVE-2022-24923 Missing authorization in SearchWidget
- CVE-2022-24921 Denial of service in debian:debian linux
- CVE-2022-2492 SourceCodester Library Management System index.php sql injection
- CVE-2022-24919 Reflected XSS in graph configuration window of Zabbix Frontend
- CVE-2022-24918 Reflected XSS in item configuration window of Zabbix Frontend
- CVE-2022-24917 Reflected XSS in service configuration window of Zabbix Frontend
- CVE-2022-24916 Business logic in optimism:eth-optimism\/l2geth
- CVE-2022-24915 ICSA-22-062-01 IPCOMM ipDIO
- CVE-2022-24913 Java Merge-sort Insecure Temporary File vulnerability
- CVE-2022-24912 Timing Attack
- CVE-2022-24910 Memory corruption in InRouter302
- CVE-2022-2491 SourceCodester Library Management System lab.php sql injection
- CVE-2022-24908 Memory corruption in PDF Reader
- CVE-2022-24907 Memory corruption in PDF Reader
- CVE-2022-24906 Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
- CVE-2022-24905 Argo CD login screen allows message spoofing if SSO is enabled
- CVE-2022-24904 Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
- CVE-2022-24903 Buffer overflow in TCP syslog server (receiver) components in rsyslog
- CVE-2022-24902 Memory issue in playing videos
- CVE-2022-24901 Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
- CVE-2022-24900 Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED Visualizer
- CVE-2022-2490 SourceCodester Simple E-Learning System search.php sql injection
- CVE-2022-24899 Cross site scripting via canonical tag
- CVE-2022-24898 Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
- CVE-2022-24897 Arbitrary filesystem write access from Velocity
- CVE-2022-24896 Tracker report renderer and chart widgets leak information in Tuleap
- CVE-2022-24895 Symfony vulnerable to Session Fixation of CSRF tokens
- CVE-2022-24894 Symfony storing cookie headers in HttpCache
- CVE-2022-24893 Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption
- CVE-2022-24892 Multiple valid tokens for password reset in Shopware
- CVE-2022-24891 Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file
- CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk
- CVE-2022-2489 SourceCodester Simple E-Learning System classRoom.php sql injection
- CVE-2022-24889 Insufficient Verification of Data Authenticity in Nextcloud Server
- CVE-2022-24888 Possible Injection in Nextcloud Server
- CVE-2022-24887 Open Redirect in Nextcloud Talk
- CVE-2022-24886 Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
- CVE-2022-24885 Improper Authentication in Nextcloud Android Files
- CVE-2022-24884 Trivial signature forgery in ecdsautils
- CVE-2022-24883 FreeRDP Server authentication might allow invalid credentials to pass
- CVE-2022-24882 Server side NTLM does not properly check parameters in FreeRDP
- CVE-2022-24881 Command Injection in Ballcat Codegen
- CVE-2022-24880 Potential Captcha Validate Bypass in flask-session-captcha
- CVE-2022-2488 WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection
- CVE-2022-24879 Malfunction of Cross-Site Request Forgery token validation
- CVE-2022-24878 Improper path handling in Kustomization files allows for denial of service
- CVE-2022-24877 Improper path handling in kustomization files allows path traversal
- CVE-2022-24876 Stored cross site scrpting in GLPI's Kanban
- CVE-2022-24875 Potential Secrets being logged to disk in CVEProject/cve-services
- CVE-2022-24873 Non-Stored Cross-site Scripting in Shopware storefront
- CVE-2022-24872 Improper Access Control in shopware
- CVE-2022-24871 Server-Side Request Forgery (SSRF) in Shopware
- CVE-2022-24870 Stored Cross-site Scripting in Combodo iTop
- CVE-2022-2487 WAVLINK WN535K2/WN535K3 nightled.cgi os command injection
- CVE-2022-24869 Cross Site Scripting in GLPI
- CVE-2022-24868 Cross site scripting via SVG file upload in GLPI
- CVE-2022-24867 LDAP password exposure in glpi
- CVE-2022-24866 Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign
- CVE-2022-24865 Improper access control in humhub
- CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website
- CVE-2022-24863 Denial of service in http-swagger
- CVE-2022-24862 Server-Side Request Forgery in Databasir
- CVE-2022-24861 Remote Code Execution in Databasir
- CVE-2022-24860 Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.
- CVE-2022-2486 WAVLINK WN535K2/WN535K3 os command injection
- CVE-2022-24859 Manipulated inline images can cause Infinite Loop in PyPDF2
- CVE-2022-24858 Default redirect callback vulnerable to open redirects
- CVE-2022-24857 Multi factor authentication bypass in django-mfa3
- CVE-2022-24856 Server-Side Request Forgery in FlyteConsole
- CVE-2022-24855 XSS vulnerability in Metabase
- CVE-2022-24854 Database bypassing any permissions in Metabase via SQlite attach
- CVE-2022-24853 File system exposure in Metabase
- CVE-2022-24851 Stored XSS and path traversal in LDAPAccountManager/lam
- CVE-2022-24850 Category group permissions leaked in Discourse
- CVE-2022-2485 AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information