2022 CVE Vulnerabilities
27,563 CVEs published in 2022.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2022-1239 | HIGH | 8.8 | 1.4% | May 2, 2022 | The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could... |
| CVE-2022-0952 | HIGH | 8.8 | 12.5% | May 2, 2022 | The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options v... |
| CVE-2022-27983 | HIGH | 7.5 | 0.9% | May 2, 2022 | RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain an arbitrary file read vulnerability via the url par... |
| CVE-2022-28572 | HIGH | 8.8 | 2.6% | May 2, 2022 | Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability in `SetIPv6Status` function |
| CVE-2022-23064 | HIGH | 8.8 | 1.2% | May 2, 2022 | In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host ... |
| CVE-2022-23904 | HIGH | 8 | 0.4% | May 2, 2022 | Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated us... |
| CVE-2022-29970 | HIGH | 7.5 | 1.9% | May 2, 2022 | Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. |
| CVE-2022-29968 | HIGH | 7.8 | 1.1% | May 2, 2022 | An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kio... |
| CVE-2022-29849 | HIGH | 7.8 | 0.3% | May 2, 2022 | In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were s... |
| CVE-2022-28451 | HIGH | 7.5 | 1.5% | May 2, 2022 | nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. |
| CVE-2022-26068 | HIGH | 7.5 | 1.5% | May 1, 2022 | This affects the package pistacheio/pistache before 0.0.3.20220425. It is possible to traverse directories to fetch arbi... |
| CVE-2022-25850 | HIGH | 7.5 | 1.3% | May 1, 2022 | The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when int... |
| CVE-2022-25844 | HIGH | 7.5 | 4.7% | May 1, 2022 | The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom loc... |
| CVE-2022-25647 | HIGH | 7.5 | 11.6% | May 1, 2022 | The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeRepl... |
| CVE-2022-25645 | HIGH | 8.1 | 1.8% | May 1, 2022 | All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks fo... |
| CVE-2022-21227 | HIGH | 7.5 | 2.0% | May 1, 2022 | The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of th... |
| CVE-2022-21144 | HIGH | 7.5 | 1.8% | May 1, 2022 | This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument t... |
| CVE-2022-1544 | HIGH | 7.8 | 2.3% | May 1, 2022 | Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luya... |
| CVE-2022-28323 | HIGH | 7.5 | 1.3% | Apr 30, 2022 | An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp... |
| CVE-2022-29265 | HIGH | 7.5 | 2.4% | Apr 30, 2022 | Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configu... |
| CVE-2022-29967 | HIGH | 7.5 | 1.5% | Apr 29, 2022 | static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal. |
| CVE-2022-29945 | HIGH | 7.5 | 0.7% | Apr 29, 2022 | DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical locati... |
| CVE-2022-1543 | HIGH | 8.8 | 1.1% | Apr 29, 2022 | Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large e... |
| CVE-2022-29937 | HIGH | 8.8 | 1.5% | Apr 29, 2022 | USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because som... |
| CVE-2022-29936 | HIGH | 8.8 | 2.0% | Apr 29, 2022 | USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/q... |
Check if your code is affected by 2022 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now