# Vulnerabilities published in 2022


- [CVE-2022-21675](https://insights.sbomify.com/CVE-2022-21675/): Bytecode Viewer v2.10.x Zip Slip (critical 9.9)
- [CVE-2022-21673](https://insights.sbomify.com/CVE-2022-21673/): OAuth Identity Token exposure in Grafana (medium 4.3)
- [CVE-2022-21672](https://insights.sbomify.com/CVE-2022-21672/): /etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-ca (medium 6.5)
- [CVE-2022-21671](https://insights.sbomify.com/CVE-2022-21671/): Potential exposure of Replit tokens to an Unauthorized Actor in @replit/crosis (high 8.1)
- [CVE-2022-21670](https://insights.sbomify.com/CVE-2022-21670/): Uncontrolled Resource Consumption in markdown-it (medium 5.3)
- [CVE-2022-2167](https://insights.sbomify.com/CVE-2022-2167/): Newspaper < 12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-21669](https://insights.sbomify.com/CVE-2022-21669/): Bot token exposed in main.py (critical 9.1)
- [CVE-2022-21668](https://insights.sbomify.com/CVE-2022-21668/): Pipenv's requirements.txt parsing allows malicious index url in comments (high 8.0)
- [CVE-2022-21667](https://insights.sbomify.com/CVE-2022-21667/): Denial of Service in soketi (high 7.5)
- [CVE-2022-21666](https://insights.sbomify.com/CVE-2022-21666/): SQL Injection in useredit.php (high 7.2)
- [CVE-2022-21664](https://insights.sbomify.com/CVE-2022-21664/): SQL injection in WordPress (high 7.4)
- [CVE-2022-21663](https://insights.sbomify.com/CVE-2022-21663/): Authenticated Object Injection in Multisites in WordPress (medium 6.6)
- [CVE-2022-21662](https://insights.sbomify.com/CVE-2022-21662/): Stored XSS in WordPress (high 8.0)
- [CVE-2022-21661](https://insights.sbomify.com/CVE-2022-21661/): SQL injection in WordPress (high 8.0)
- [CVE-2022-21660](https://insights.sbomify.com/CVE-2022-21660/): Missing authorization in gin-vue-admin (high 8.1)
- [CVE-2022-2166](https://insights.sbomify.com/CVE-2022-2166/): Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon (critical 9.8)
- [CVE-2022-21659](https://insights.sbomify.com/CVE-2022-21659/): Observable Response Discrepancy in Flask-AppBuilder (medium 5.3)
- [CVE-2022-21658](https://insights.sbomify.com/CVE-2022-21658/): Race condition in std::fs::remove_dir_all in rustlang (high 7.3)
- [CVE-2022-21657](https://insights.sbomify.com/CVE-2022-21657/): X.509 Extended Key Usage and Trust Purposes bypass in Envoy (medium 6.8)
- [CVE-2022-21656](https://insights.sbomify.com/CVE-2022-21656/): X.509 subjectAltName matching bypass in Envoy (high 7.4)
- [CVE-2022-21655](https://insights.sbomify.com/CVE-2022-21655/): Incorrect handling of internal redirects results in crash in Envoy (high 7.5)
- [CVE-2022-21654](https://insights.sbomify.com/CVE-2022-21654/): Incorrect configuration handling allows TLS session re-use without re-validation in Envoy (high 7.4)
- [CVE-2022-21653](https://insights.sbomify.com/CVE-2022-21653/): Hash collision in typelevel jawn (medium 5.9)
- [CVE-2022-21652](https://insights.sbomify.com/CVE-2022-21652/): Insufficient Session Expiration in shopware (low 3.5)
- [CVE-2022-21651](https://insights.sbomify.com/CVE-2022-21651/): Open redirect in shopware (medium 6.8)
- [CVE-2022-21650](https://insights.sbomify.com/CVE-2022-21650/): Stored XSS via html file upload in convos (high 7.6)
- [CVE-2022-2165](https://insights.sbomify.com/CVE-2022-2165/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-21649](https://insights.sbomify.com/CVE-2022-21649/): Stored XSS via attribute in convos (high 7.6)
- [CVE-2022-21648](https://insights.sbomify.com/CVE-2022-21648/): Sandbox bypass in Latte templates (high 8.2)
- [CVE-2022-21647](https://insights.sbomify.com/CVE-2022-21647/): Deserialization of Untrusted Data in Codeigniter4 (high 7.7)
- [CVE-2022-21646](https://insights.sbomify.com/CVE-2022-21646/): Lookup operations do not take into account wildcards in SpiceDB (high 8.1)
- [CVE-2022-21644](https://insights.sbomify.com/CVE-2022-21644/): SQL Injection via search in USOC (critical 9.1)
- [CVE-2022-21643](https://insights.sbomify.com/CVE-2022-21643/): SQL Injection in USOC (critical 10.0)
- [CVE-2022-21642](https://insights.sbomify.com/CVE-2022-21642/): Exposure of whisper participants in discourse (medium 4.3)
- [CVE-2022-21641](https://insights.sbomify.com/CVE-2022-21641/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21640](https://insights.sbomify.com/CVE-2022-21640/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-2164](https://insights.sbomify.com/CVE-2022-2164/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2022-21639](https://insights.sbomify.com/CVE-2022-21639/): Cross-site scripting in PeopleSoft Enterprise PT PeopleTools (medium 6.1)
- [CVE-2022-21638](https://insights.sbomify.com/CVE-2022-21638/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21637](https://insights.sbomify.com/CVE-2022-21637/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21636](https://insights.sbomify.com/CVE-2022-21636/): Other in Applications Framework (medium 6.5)
- [CVE-2022-21635](https://insights.sbomify.com/CVE-2022-21635/): Other in MySQL Server (medium 6.5)
- [CVE-2022-21634](https://insights.sbomify.com/CVE-2022-21634/): Denial of service in GraalVM Enterprise Edition (high 7.5)
- [CVE-2022-21633](https://insights.sbomify.com/CVE-2022-21633/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21632](https://insights.sbomify.com/CVE-2022-21632/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21631](https://insights.sbomify.com/CVE-2022-21631/): Cross-site scripting in JD Edwards EnterpriseOne Tools (medium 6.1)
- [CVE-2022-21630](https://insights.sbomify.com/CVE-2022-21630/): Cross-site scripting in JD Edwards EnterpriseOne Tools (medium 6.1)
- [CVE-2022-2163](https://insights.sbomify.com/CVE-2022-2163/): Use after free in Chrome (high 8.8)
- [CVE-2022-21629](https://insights.sbomify.com/CVE-2022-21629/): Other in JD Edwards EnterpriseOne Tools (medium 5.4)
- [CVE-2022-21628](https://insights.sbomify.com/CVE-2022-21628/): Denial of service in Java SE JDK and JRE (medium 5.3)
- [CVE-2022-21627](https://insights.sbomify.com/CVE-2022-21627/): Denial of service in VM VirtualBox (medium 4.4)
- [CVE-2022-21626](https://insights.sbomify.com/CVE-2022-21626/): Denial of service in Java SE JDK and JRE (medium 5.3)
- [CVE-2022-21625](https://insights.sbomify.com/CVE-2022-21625/): Denial of service in MySQL Server (medium 4.4)
- [CVE-2022-21624](https://insights.sbomify.com/CVE-2022-21624/): Deserialization in Java SE JDK and JRE (low 3.7)
- [CVE-2022-21623](https://insights.sbomify.com/CVE-2022-21623/): Other in Enterprise Manager Base Platform (high 7.5)
- [CVE-2022-21622](https://insights.sbomify.com/CVE-2022-21622/): Other in SOA Suite (high 7.5)
- [CVE-2022-21621](https://insights.sbomify.com/CVE-2022-21621/): Denial of service in VM VirtualBox (medium 6.0)
- [CVE-2022-21620](https://insights.sbomify.com/CVE-2022-21620/): Other in VM VirtualBox (high 7.5)
- [CVE-2022-2162](https://insights.sbomify.com/CVE-2022-2162/): Security feature bypass in Chrome (high 8.8)
- [CVE-2022-21619](https://insights.sbomify.com/CVE-2022-21619/): Security feature bypass in Java SE JDK and JRE (low 3.7)
- [CVE-2022-21618](https://insights.sbomify.com/CVE-2022-21618/): Auth bypass in Java SE JDK and JRE (medium 5.3)
- [CVE-2022-21617](https://insights.sbomify.com/CVE-2022-21617/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21616](https://insights.sbomify.com/CVE-2022-21616/): Other in WebLogic Server (medium 5.2)
- [CVE-2022-21615](https://insights.sbomify.com/CVE-2022-21615/): Other in Enterprise Data Quality (high 7.4)
- [CVE-2022-21614](https://insights.sbomify.com/CVE-2022-21614/): Information disclosure in Enterprise Data Quality (high 7.5)
- [CVE-2022-21613](https://insights.sbomify.com/CVE-2022-21613/): Other in Enterprise Data Quality (high 8.8)
- [CVE-2022-21612](https://insights.sbomify.com/CVE-2022-21612/): Other in Enterprise Data Quality (high 8.1)
- [CVE-2022-21611](https://insights.sbomify.com/CVE-2022-21611/): Denial of service in MySQL Server (medium 4.1)
- [CVE-2022-21610](https://insights.sbomify.com/CVE-2022-21610/): Other in Solaris Operating System (low 3.3)
- [CVE-2022-2161](https://insights.sbomify.com/CVE-2022-2161/): Use after free in Chrome (high 8.8)
- [CVE-2022-21609](https://insights.sbomify.com/CVE-2022-21609/): Other in Business Intelligence Enterprise Edition (medium 5.7)
- [CVE-2022-21608](https://insights.sbomify.com/CVE-2022-21608/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21607](https://insights.sbomify.com/CVE-2022-21607/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21606](https://insights.sbomify.com/CVE-2022-21606/): Cross-site scripting in Services for Microsoft Transaction Server (medium 6.1)
- [CVE-2022-21605](https://insights.sbomify.com/CVE-2022-21605/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21604](https://insights.sbomify.com/CVE-2022-21604/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21603](https://insights.sbomify.com/CVE-2022-21603/): Other in Database - Enterprise Edition (high 7.2)
- [CVE-2022-21602](https://insights.sbomify.com/CVE-2022-21602/): Information disclosure in PeopleSoft Enterprise PT PeopleTools (medium 5.3)
- [CVE-2022-21601](https://insights.sbomify.com/CVE-2022-21601/): Other in Communications Billing and Revenue Management (medium 6.5)
- [CVE-2022-21600](https://insights.sbomify.com/CVE-2022-21600/): Other in MySQL Server (high 7.2)
- [CVE-2022-2160](https://insights.sbomify.com/CVE-2022-2160/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2022-21599](https://insights.sbomify.com/CVE-2022-21599/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21598](https://insights.sbomify.com/CVE-2022-21598/): Other in Siebel Core - DB Deployment and Configuration (high 7.5)
- [CVE-2022-21597](https://insights.sbomify.com/CVE-2022-21597/): Information disclosure in GraalVM Enterprise Edition (medium 5.3)
- [CVE-2022-21596](https://insights.sbomify.com/CVE-2022-21596/): Other in Database - Enterprise Edition (high 7.2)
- [CVE-2022-21595](https://insights.sbomify.com/CVE-2022-21595/): Denial of service in MySQL Server (medium 4.4)
- [CVE-2022-21594](https://insights.sbomify.com/CVE-2022-21594/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2022-21593](https://insights.sbomify.com/CVE-2022-21593/): Other in HTTP Server (high 7.1)
- [CVE-2022-21592](https://insights.sbomify.com/CVE-2022-21592/): Information disclosure in MySQL Server (medium 4.3)
- [CVE-2022-21591](https://insights.sbomify.com/CVE-2022-21591/): Other in Transportation Management (medium 5.4)
- [CVE-2022-21590](https://insights.sbomify.com/CVE-2022-21590/): Other in BI Publisher (formerly XML Publisher) (high 7.6)
- [CVE-2022-21589](https://insights.sbomify.com/CVE-2022-21589/): Information disclosure in MySQL Server (medium 4.3)
- [CVE-2022-21587](https://insights.sbomify.com/CVE-2022-21587/): Oracle E-Business Suite Unspecified (critical 9.8, exploited in the wild)
- [CVE-2022-21586](https://insights.sbomify.com/CVE-2022-21586/): Missing authorization in Banking Trade Finance (medium 6.4)
- [CVE-2022-21585](https://insights.sbomify.com/CVE-2022-21585/): Other in Banking Trade Finance (medium 6.7)
- [CVE-2022-21584](https://insights.sbomify.com/CVE-2022-21584/): Other in Banking Trade Finance (medium 6.4)
- [CVE-2022-21583](https://insights.sbomify.com/CVE-2022-21583/): Other in Banking Trade Finance (medium 6.4)
- [CVE-2022-21582](https://insights.sbomify.com/CVE-2022-21582/): Other in Banking Trade Finance (medium 6.7)
- [CVE-2022-21581](https://insights.sbomify.com/CVE-2022-21581/): Other in Banking Trade Finance (medium 5.9)
- [CVE-2022-21580](https://insights.sbomify.com/CVE-2022-21580/): Other in Financial Services Revenue Management and Billing (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/399/