Vulnerabilities published in 2022
43,624 vulnerabilities were published in 2022: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 370 of 437.
- CVE-2022-24849 Contact to DisCatSharp-owned server using authenticated client
- CVE-2022-24848 SQL Injection in DHIS2's in OrgUnit program association
- CVE-2022-24847 Improper Input Validation in GeoServer
- CVE-2022-24846 Unchecked JNDI lookups in GeoWebCache
- CVE-2022-24845 Integer bounds error in Vyper
- CVE-2022-24844 SQL Injection in github.com/flipped-aurora/gin-vue-admin
- CVE-2022-24843 Path Traversal in github.com/flipped-aurora/gin-vue-admin
- CVE-2022-24842 Improper Privilege Management in MinIO
- CVE-2022-24841 Improper Authorization in github.com/fleetdm/fleet
- CVE-2022-24840 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file
- CVE-2022-2484 Security feature bypass in ASIK AirScale
- CVE-2022-24839 Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)
- CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2022-24837 Enumerable upload file names in hedgedoc
- CVE-2022-24836 Inefficient Regular Expression Complexity in Nokogiri
- CVE-2022-24834 Heap overflow issue with the Lua cjson library used by Redis
- CVE-2022-24833 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin
- CVE-2022-24832 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames
- CVE-2022-24831 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in OpenClinica
- CVE-2022-24830 Path Traversal in OpenClinica
- CVE-2022-2483 Security feature bypass in ASIK AirScale
- CVE-2022-24829 Missing authentication in Garden
- CVE-2022-24828 Missing input validation can lead to command execution in composer
- CVE-2022-24827 SQL Injection in elide-datastore-aggregation
- CVE-2022-24826 Git LFS can execute a binary from the current directory on Windows
- CVE-2022-24825 Smokescreen SSRF via deny list bypass
- CVE-2022-24824 Anonymous user cache poisoning in discourse
- CVE-2022-24823 Local Information Disclosure Vulnerability in io.netty:netty-codec-http
- CVE-2022-24822 Denial of Service in @podium/layout and @podium/proxy
- CVE-2022-24821 Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
- CVE-2022-24820 Unauthenticated user can list hidden document from multiple velocity templates
- CVE-2022-2482 Code injection in ASIK AirScale
- CVE-2022-24819 Unauthenticated user can retrieve the list of users through uorgsuggest.vm
- CVE-2022-24818 Unchecked JNDI lookups in GeoTools
- CVE-2022-24817 Improper kubeconfig validation allows arbitrary code execution
- CVE-2022-24816 OSGeo GeoServer JAI-EXT Code Injection
- CVE-2022-24815 SQL Injection when creating an application with Reactive SQL backend
- CVE-2022-24814 Cross-site Scripting in Directus
- CVE-2022-24813 Authentication Bypass Using an Alternate Path or Channel in CreateWiki
- CVE-2022-24812 FGAC API Key privilege escalation in Grafana
- CVE-2022-24811 Cross-site Scripting in Combodo iTop
- CVE-2022-24810 net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.
- CVE-2022-2481 Use after free in Chrome
- CVE-2022-24809 net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
- CVE-2022-24808 net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
- CVE-2022-24807 Memory corruption in net-snmp
- CVE-2022-24806 net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously
- CVE-2022-24805 net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
- CVE-2022-24804 Private group name exposure in discourse
- CVE-2022-24803 Command Injection vulnerability in asciidoctor-include-ext
- CVE-2022-24802 Prototype Pollution in deepmerge-ts
- CVE-2022-24801 HTTP Request Smuggling in twisted.web
- CVE-2022-24800 Race Condition in October CMS upload process
- CVE-2022-2480 Use after free in Chrome
- CVE-2022-24799 Cross Site Scripting in Wire Webapp
- CVE-2022-24798 Insufficient password hash filtering in some IRRd queries and exports
- CVE-2022-24797 Exposure of Sensitive Information in Pomerium
- CVE-2022-24796 Remote Command Injection in RaspberryMatic
- CVE-2022-24795 Buffer Overflow and Integer Overflow in yajl-ruby
- CVE-2022-24794 Open Redirect in express-openid-connect
- CVE-2022-24793 Potential heap buffer overflow when parsing DNS packets in PJSIP
- CVE-2022-24792 Potential infinite loop when parsing WAV format file in PJSIP
- CVE-2022-24791 Use after free in Wasmtime
- CVE-2022-24790 HTTP Request Smuggling in puma
- CVE-2022-2479 Information disclosure in Chrome
- CVE-2022-24789 Deserialization of untrusted data in C1 CMS.
- CVE-2022-24788 Buffer overflow in Vyper
- CVE-2022-24787 Incorrect Comparison in Vyper
- CVE-2022-24786 Potential out-of-bound read/write in PJSIP
- CVE-2022-24785 Path Traversal in Moment.js
- CVE-2022-24784 Discoverability of user password hash in Statamic CMS
- CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno
- CVE-2022-24782 Secure category names leaked via user activity export in Discourse
- CVE-2022-24781 Malicious users can take over the session of other players
- CVE-2022-24780 Code Injection in Combodo iTop
- CVE-2022-2478 Use after free in Chrome
- CVE-2022-24778 Incorrect Authorization in imgcrypt
- CVE-2022-24777 Denial of Service via reachable assertion in grpc-swift
- CVE-2022-24776 Open Redirect in Flask-AppBuilder
- CVE-2022-24775 Improper Input Validation in guzzlehttp/psr7
- CVE-2022-24774 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
- CVE-2022-24773 Improper Verification of Cryptographic Signature in `node-forge`
- CVE-2022-24772 Improper Verification of Cryptographic Signature in `node-forge`
- CVE-2022-24771 Improper Verification of Cryptographic Signature in node-forge
- CVE-2022-24770 Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
- CVE-2022-2477 Use after free in Chrome
- CVE-2022-24769 Default inheritable capabilities for linux container should be empty
- CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD
- CVE-2022-24767 Privilege escalation in Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- CVE-2022-24766 Insufficient Protection against HTTP Request Smuggling in mitmproxy
- CVE-2022-24765 Uncontrolled search for the Git directory in Git for Windows
- CVE-2022-24764 Stack buffer overflow in pjproject
- CVE-2022-24763 Infinite Loop in PJSIP
- CVE-2022-24762 Exposure of Sensitive Information to an Unauthorized Actor in sysend.js
- CVE-2022-24761 HTTP Request Smuggling in waitress
- CVE-2022-24760 Command Injection in Parse server
- CVE-2022-2476 Null dereference in Wavpack
- CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise
- CVE-2022-24758 Insertion of Sensitive Information into Log File affects Jupyter Notebook
- CVE-2022-24757 Sensitive Auth & Cookie data stored in Jupyter server logs