High
CVE-2022-28220
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,074
Reset filters
Critical
CVE-2022-25914
com.google.cloud.tools:jib-core vulnerable to Remote Code Execution (RCE)
Critical
CVE-2022-36663
Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter
Medium
CVE-2022-38750
snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write
Medium
CVE-2022-38749
snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write
Medium
CVE-2022-38752
snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write
Medium
CVE-2022-38751
snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write
High
CVE-2022-38370
Apache IoTDB grafana-connector contains an interface without authorization
High
CVE-2022-38369
Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
High
CVE-2022-37435
Apache ShenYu Admin has insecure permissions
Medium
CVE-2022-36033
jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled
Medium
CVE-2022-37023
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data
High
CVE-2022-37022
Apache Geode versions deserialization of untrusted datawhen using JMX over RMI on Java 11
Critical
CVE-2022-37021
Apache Geode vulnerable to Deserialization of Untrusted Data
Critical
CVE-2022-2466
Quarkus does not terminate HTTP requests header context
High
CVE-2022-25857
Uncontrolled Resource Consumption in snakeyaml
Low
CVE-2021-3644
wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault
Medium
CVE-2021-3856
Keycloak has Files or Directories Accessible to External Parties
High
CVE-2021-3632
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
High
CVE-2022-0084
XNIO `notifyReadClosed` method logging message to unexpected end
Medium
CVE-2022-0225
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
High
Exploited in attacks
CVE-2022-36537
ZK Framework vulnerable to malicious POST
High
CVE-2021-25642
Deserialization of Untrusted Data in Apache Hadoop YARN
Medium
CVE-2022-36527
Jfinal Cross-site Scripting vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.