CVE: CVE-2022-1106

[{'lang': 'en', 'value': 'use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.'}]

Fix commit: vm.c: vm.c: stack may be reallocated in functions calls; aaa28a5

`mrb_range_new()` also calls VM recursively.


CVE: CVE-2022-1154

[{'lang': 'en', 'value': 'Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.'}]

Fix commit: patch 8.2.4646: using buffer line after it has been freed

Problem:    Using buffer line after it has been freed in old regexp engine.
Solution:   After getting mark get the line again.


CVE: CVE-2022-1155

[{'lang': 'en', 'value': 'Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.'}]

Fix commit: Logout user when their activated status is switched to off

Signed-off-by: snipe <snipe@snipe.net>


CVE: CVE-2022-1160

[{'lang': 'en', 'value': 'heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.'}]

Fix commit: patch 8.2.4647: "source" can read past end of copied line

Problem:    "source" can read past end of copied line.
Solution:   Add a terminating NUL.


CVE: CVE-2022-1163

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.'}]

Fix commit: improv. fix xss with navbar


CVE: CVE-2022-1172

[{'lang': 'en', 'value': 'Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.'}]

Fix commit: fixed #2153


CVE: CVE-2022-1173

[{'lang': 'en', 'value': 'stored xss in GitHub repository getgrav/grav prior to 1.7.33.'}]

Fix commit: Fixed XSS check not detecting onX events without quotes


CVE: CVE-2022-1176

[{'lang': 'en', 'value': 'Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.'}]

Fix commit: Type check


CVE: CVE-2022-1177

[{'lang': 'en', 'value': 'Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.'}]

Fix commit: limit access to reports for front and back office (#4893)

* add acl report check to custom report

* remove report and notes access for accountants and front office on install

* revert change to administrators

* adjust install and upgrade

* reorder case in shiftAcl

* add alter acls to template

* review fixes,


CVE: CVE-2022-1191

[{'lang': 'en', 'value': 'SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.'}]

Fix commit: Harden to avoid SSRF


CVE: CVE-2022-1201

[{'lang': 'en', 'value': 'NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.'}]

Fix commit: vm.c: target class may be NULL.


CVE: CVE-2022-1207

[{'lang': 'en', 'value': 'Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.'}]

Fix commit: Fix 1 byte oobread in the cris analysis plugin ##crash


CVE: CVE-2022-1212

[{'lang': 'en', 'value': 'Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.'}]

Fix commit: vm.c: create break object before clearing GC arena.

Otherwise it possibly cause use-after-free.


CVE: CVE-2022-1213

[{'lang': 'en', 'value': 'SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191'}]

Fix commit: fix #1752


CVE: CVE-2022-1219

[{'lang': 'en', 'value': 'SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data'}]

Fix commit: [Recyclebin] Quote condition filter


CVE: CVE-2022-1222

[{'lang': 'en', 'value': 'Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.'}]

Fix commit: fixed #2159


CVE: CVE-2022-1231

[{'lang': 'en', 'value': 'XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web base


CVE: CVE-2022-1233

[{'lang': 'en', 'value': 'URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.'}]

Fix commit: fix(parse): handle excessive slashes in scheme-relative URLs

reported by @zeyu2001 via huntr.dev


CVE: CVE-2022-1234

[{'lang': 'en', 'value': 'XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the userâ€™s device.'}]

Fix commit: Add missing applicaiton/json header where missing


CVE: CVE-2022-1235

[{'lang': 'en', 'value': 'Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.'}]

Fix commit: Increase size of secret hash and chagne it's algorithm


CVE: CVE-2022-1236

[{'lang': 'en', 'value': 'Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.'}]

Fix commit: Merge pull request #5630 from weseek/imprv/extend-minimum-password-length

fix: Displaying minimum length of password


CVE: CVE-2022-1237

[{'lang': 'en', 'value': 'Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).'}]

Fix commit: Fix oobread segfaults in the NE bin parser ##crash

* Reported by @han0nly via huntr.dev
* Reproducers: seed1 seed2
* BountyID: ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40


CVE: CVE-2022-1238

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).'}]

Fix commit: Fix another oobread segfault in the NE bin parser ##crash

* Reported by @han0nly via huntr.dev
* Reproducers: sample1 sample2 sample3
* BountyID: 47422cdf


CVE: CVE-2022-1240

[{'lang': 'en', 'value': 'Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).'}]

Fix commit: Fix oobread in the macho parser ##crash

* Re


CVE: CVE-2022-1243

[{'lang': 'en', 'value': 'CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.'}]

Fix commit: fix(parse): handle CR,LF,TAB

reported by @haxatron via huntr.dev


CVE: CVE-2022-1244

[{'lang': 'en', 'value': 'heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.'}]

Fix commit: Fix oobread in dyldcache ##crash

* Reported by @hdthky via huntr.dev
* Reproducers: poc1
* BountyID: 8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82


CVE: CVE-2022-1253

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.'}]

Fix commit: error on out-of-range cpb_cnt_minus1 (oss-fuzz issue 27590)


CVE: CVE-2022-1276

[{'lang': 'en', 'value': 'Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.'}]

Fix commit: codegen.c: need to pack argument when `n==13` too.

Because we have extra 2 arguments coming (kw and rhs).


CVE: CVE-2022-1283

[{'lang': 'en', 'value': 'NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cause a denial of service (application crash).'}]

Fix commit: Fix null deref in the ne parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepoc00
* BountyID: bfeb8fb8-644d-4587-80d4-cb704c404013


CVE: CVE-2022-1284

[{'lang': 'en', 'value': 'heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.'}]

Fix commit: Fix UAF in `aaef` ##crash

* Reported by @hdthky
* Reproducer: uaf-aef
* BountyID: e98ad92c-3a64-48fb-84d4-d13afdbcbdd7


CVE: CVE-2022-1285

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.'}]

Fix commit: webhook: revalidate local hostname before each delivery (#6988)


CVE: CVE-2022-1286

[{'lang': 'en', 'value': 'heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.'}]

Fix commit: class.c: clear method cache after `remove_method`.


CVE: CVE-2022-1289

[{'lang': 'en', 'value': 'A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.'}]

Fix commit: fix possible pattern crash

issue #325


CVE: CVE-2022-1290

[{'lang': 'en', 'value': 'Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user\'s browser and it can lead to session hijacking, sensitive data exposure, and worse.'}]

Fix commit: chore(security): fix issue where html was allowed in some input fields


CVE: CVE-2022-1291

[{'lang': 'en', 'value': 'XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers'}]

Fix commit: Release 1.25


CVE: CVE-2022-1295

[{'lang': 'en', 'value': 'Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.'}]

Fix commit: Merge pull request #4351 from alvarotrigo/dev

- Fixed bug: jquery adaptor didnt work


CVE: CVE-2022-1296

[{'lang': 'en', 'value': 'Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.'}]

Fix commit: Fix oobread in NE parser ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: necrash
* BountyID: 52b57274-0e1a-4d61-ab29-1373b555fea0/


CVE: CVE-2022-1297

[{'lang': 'en', 'value': 'Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.'}]

Fix commit: Fix oobread and unaligned casts in the NE entrypoint logic ##crash

* Reported by @hmsec via huntr.dev
* Reproducer: nepocaligns
* BountyID: ec538fa4-06c6-4050-a141-f60153ddeaac


CVE: CVE-2022-1316

[{'lang': 'en', 'value': 'ZeroTierOne for windows local privilege escalation because of incorrect directory privilege in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation'}]

Fix commit: 1.8.8 bump


CVE: CVE-2022-1330

[{'lang': 'en', 'value': 'stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .'}]

Fix commit: Merge pull request #4360 from ranjit-git/ranjit-git-patch-1

Ranjit git patch 1


CVE: CVE-2022-1339

[{'lang': 'en', 'value': 'SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data'}]

Fix commit: Added Quote In Condition Filters


CVE: CVE-2022-1341

[{'lang': 'en', 'value': 'An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c.'}]

Fix commit: Fix https://github.com/vgropp/bwm-ng/issues/26


CVE: CVE-2022-1344

[{'lang': 'en', 'value': "Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]

Fix commit: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved imag


CVE: CVE-2022-1345

[{'lang': 'en', 'value': "Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]

Fix commit: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


CVE: CVE-2022-1346

[{'lang': 'en', 'value': "Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]

Fix commit: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


CVE: CVE-2022-1347

[{'lang': 'en', 'value': 'Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation'}]

Fix commit: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


CVE: CVE-2022-1351

[{'lang': 'en', 'value': 'Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.'}]

Fix commit: [Security] ContentSecurityPolicyHandler - Add exclude paths property to disable csp for specific paths

Signed-off-by: dpahuja <divesh.pahuja@gmail.com>


CVE: CVE-2022-1353

[{'lang': 'en', 'value': 'A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.'}]

Fix commit: af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register

Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
to initialize the buffer of supp_skb t


CVE: CVE-2022-1365

[{'lang': 'en', 'value': 'Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.'}]

Fix commit: chore: updated node-fetch version to 2.6.7 (#124)

* chore: updated node-fetch version to 2.6.7

* build: use node 16.x instead of 15.x


CVE: CVE-2022-1379

[{'lang': 'en', 'value': 'URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.'}]

Fix commit: Import version 1.2022.5


CVE: CVE-2022-1380

[{'lang': 'en', 'value': 'Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.'}]

Fix commit: Merge pull request #10942 from snipe/fixes/xss_user_requested

Fixes potential XSS vuln in user requestable results


CVE: CVE-2022-1381

[{'lang': 'en', 'value': 'global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution'}]

Fix commit: patch 8.2.4763: using invalid pointer with "V:" in Ex mode

Problem:    Using invalid pointer with "V:" in Ex mode.
Solution:   Correctly handle the command being changed to "+".


CVE: CVE-2022-1382

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the availability of the system.'}]

Fix commit: Fix null deref in ne parser ##crash

* Reported by @cnitlrt via huntr.dev
* BountyID: d8b6d239-6d7b-4783-b26b-5be848c01aa1/
* Reproducer: nenull


CVE: CVE-2022-1383

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.'}]

Fix commit: Fix oobread bug in NE parser ##crash

* Reported by @cnitlrt via huntrdev
* BountyID: 02b4b563-b946-4343-9092-38d1c5cd60c9
* Reproducer: neoobread


CVE: CVE-2022-1411

[{'lang': 'en', 'value': "Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover."}]

Fix commit: Added validation to pasted files to the wysiwyg editor


CVE: CVE-2022-1420

[{'lang': 'en', 'value': 'Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.'}]

Fix commit: patch 8.2.4774: crash when using a number for lambda name

Problem:    Crash when using a number for lambda name.
Solution:   Check the type of the lambda reference.


CVE: CVE-2022-1427

[{'lang': 'en', 'value': 'Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.'}]

Fix commit: vm.c: check if target_class is NULL (when prepended).


CVE: CVE-2022-1430

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.'}]

Fix commit: 🔒 Sanitize and validate login redirect

Fixes an XSS and an open redirect issue.


CVE: CVE-2022-1432

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.'}]

Fix commit: 🔒 Fix XSS in webcam stream test


CVE: CVE-2022-1437

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.'}]

Fix commit: Fix oobread and null deref in symbols file parser ##crash

* Reported by @cnitlrt
* BountyID: af6c3e9e-b7df-4d80-b48f-77fdd17b4038/
* Reproducer: symoob


CVE: CVE-2022-1439

[{'lang': 'en', 'value': 'Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It\'s the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.'}]

Fix commit: update


CVE: CVE-2022-1440

[{'lang': 'en', 'value': 'Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.'}]

Fix commit: fix potential vulnerability with git clone


CVE: CVE-2022-1441

[{'lang': 'en', 'value': 'MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.'}]

Fix commit: fixed #2175


CVE: CVE-2022-1444

[{'lang': 'en', 'value': 'heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.'}]

Fix commit: Redo minor cleanup in new_rbtree


CVE: CVE-2022-1445

[{'lang': 'en', 'value': 'Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.'}]

Fix commit: Escape checkout target name

Signed-off-by: snipe <snipe@snipe.net>


CVE: CVE-2022-1451

[{'lang': 'en', 'value': 'Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).'}]

Fix commit: Fix oobread crash in java parser


CVE: CVE-2022-1452

[{'lang': 'en', 'value': 'Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).'}]

Fix commit: Fix oobread in java parser ##c


CVE: CVE-2022-1453

[{'lang': 'en', 'value': 'The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.'}]

Fix commit: fixes for sql injection, card testing


CVE: CVE-2022-1457

[{'lang': 'en', 'value': "Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account."}]

Fix commi


CVE: CVE-2022-1504

[{'lang': 'en', 'value': 'XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.'}]

Fix commit: update


CVE: CVE-2022-1509

[{'lang': 'en', 'value': 'Sed Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.'}]

Fix commit: [Security] Patches multiple security issue  (#2555)

* Add missing check in is_format_valid

* Add check on v-delete-dns-domain

* Validate theme via is_format_valid

* No need for extra code

* Prevent LF command passed trough + Add test to veri


CVE: CVE-2022-1511

[{'lang': 'en', 'value': 'Improper Access Control in GitHub repository snipe/snipe-it prior to 5.4.4.'}]

Fix commit: Added access gate to the requested assets index

Signed-off-by: snipe <snipe@snipe.net>


CVE: CVE-2022-1514

[{'lang': 'en', 'value': "Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account."}]

Fix commit: Sanitized the da


CVE: CVE-2022-1530

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.'}]

Fix commit: 3.99v


CVE: CVE-2022-1531

[{'lang': 'en', 'value': 'SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.'}]

Fix commit: avoid SQL injection exploits


CVE: CVE-2022-1533

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.'}]

Fix commit: Fix wrong boundary checks in inflections parser resulting in stack buffer over-read with corrupt input


CVE: CVE-2022-1534

[{'lang': 'en', 'value': 'Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.'}]

Fix commit: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input


CVE: CVE-2022-1537

[{'lang': 'en', 'value': "file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or re


CVE: CVE-2022-1543

[{'lang': 'en', 'value': 'Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server.'}]

Fix commit: fixed profile name not limited in length


CVE: CVE-2022-1544

[{'lang': 'en', 'value': 'Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.'}]

Fix commit: Merge pull request #7 from luyadev/csv-sanitizer

Csv sanitizer


CVE: CVE-2022-1553

[{'lang': 'en', 'value': 'Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.'}]

Fix commit: Do not create article meta description for password-protected articles


CVE: CVE-2022-1555

[{'lang': 'en', 'value': 'DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...'}]

Fix commit: Update order_filtering.blade.php


CVE: CVE-2022-1571

[{'lang': 'en', 'value': "Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ..."}]

Fix commit: Escaped html code from model fields to improve security.
------
Escapado el html de los campos del modelo para mejorar la seguridad.


CVE: CVE-2022-1584

[{'lang': 'en', 'value': 'Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim'}]

Fix commit: update


CVE: CVE-2022-1586

[{'lang': 'en', 'value': 'An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.'}]

Fix commit: Fixed a unicode properrty matching issue in JIT


CVE: CVE-2022-1586

[{'lang': 'en', 'value': 'An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.'}]

Fix commit: Fix incorrect value reading in JIT.


CVE: CVE-2022-1587

[{'lang': 'en', 'value': 'An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.'}]

Fix commit: Fixed an issue affecting recursions in JIT


CVE: CVE-2022-1592

[{'lang': 'en', 'value': 'Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requests to fishing steal cookie, request to private area, or lead to xss...'}]

Fix commit: Protect remote_cors from Server-Side Request Forgery (#3326)

* Protect remote_cors from Server-Side Request Forgery

* Improved code and added test

* Fix a couple of comments in a test


CVE: CVE-2022-1616

[{'lang': 'en', 'value': 'Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution'}]

Fix commit: patch 8.2.4895: buffer overflow with invalid command with composing chars

Problem:    Buffer overflow with invalid command with composing chars.
Solution:   Check that the whole character fits in the buffer.


CVE: CVE-2022-1619

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution'}]

Fix commit: patch 8.2.4899: with latin1 encoding CTRL-W might go before the cmdline

Problem:    With latin1 encoding CTRL-W might go before the start of the
            command line.
Solution:   Check already being at the start of the command


CVE: CVE-2022-1620

[{'lang': 'en', 'value': 'NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.'}]

Fix commit: patch 8.2.4901: NULL pointer access when using invalid pattern

Problem:    NULL pointer access when using invalid pattern.
Solution:   Check for failed rege


CVE: CVE-2022-1621

[{'lang': 'en', 'value': 'Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution'}]

Fix commit: patch 8.2.4919: can add invalid bytes with :spellgood

Problem:    Can add invalid bytes with :spellgood.
Solution:   Check for a valid word string.


CVE: CVE-2022-1629

[{'lang': 'en', 'value': 'Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution'}]

Fix commit: patch 8.2.4925: trailing backslash may cause reading past end of line

Problem:    Trailing backslash may cause reading past end of line.
Solution:   Check for NUL after backslash.


CVE: CVE-2022-1631

[{'lang': 'en', 'value': 'Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an accoun


CVE: CVE-2022-1649

[{'lang': 'en', 'value': 'Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html).'}]

Fix commit: Fix null deref in macho parser ##crash

* Reported by Han0nly via huntrdev
* BountyID: c07e4918-cf86-4d2e-8969-5fb63575b449
* Reproducer: machonull


CVE: CVE-2022-1650

[{'lang': 'en', 'value': 'Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.'}]

Fix commit: fix: strip sensitive headers on redirect to different origin


CVE: CVE-2022-1674

[{'lang': 'en', 'value': 'NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.'}]

Fix commit: patch 8.2.4938: crash when matching buffer with invalid pattern

Problem:    Crash when matching buffer with invalid pattern.
Solution:   Check for NULL regp


CVE: CVE-2022-1681

[{'lang': 'en', 'value': 'Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions'}]

Fix commit: fix: prevent manage system assignment from manage groups permission


CVE: CVE-2022-1682

[{'lang': 'en', 'value': "Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser"}]

Fix commit: We check the url parameter of the link to ensure that it is a valid controller.
------
Comprobamos el parámetro url del enlace para asegurar que sea un controlador válido.


CVE: CVE-2022-1698

[{'lang': 'en', 'value': 'Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.'}]

Fix commit: fix more lengths of user inputs


CVE: CVE-2022-1699

[{'lang': 'en', 'value': 'Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.'}]

Fix commit: fix more lengths of user inputs


CVE: CVE-2022-1706

[{'lang': 'en', 'value': 'A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.'}]

Fix commit: Merge pull request #1350 from bgilbert/userdata

Delete userdata fro


CVE: CVE-2022-1708

[{'lang': 'en', 'value': 'A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the


CVE: CVE-2022-1711

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.'}]

Fix commit: Adds isLinkLocalAddress() to address checks


CVE: CVE-2022-1713

[{'lang': 'en', 'value': 'SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.'}]

Fix commit: 18.0.3 release


CVE: CVE-2022-1714

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.'}]

Fix commit: Fix 4 byte oobread in msp430 disassembler ##crash

* Only crashes with asan builds
* Add missing =SN register
* Reported by cnitlrt via huntrdev
* BountyID: 1c22055b-b01


CVE: CVE-2022-1715

[{'lang': 'en', 'value': 'Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.'}]

Fix commit: Fixed string comparison to avoid automatic cast during database password check.
------
Corregida la comparación de cadenas para evitar cast automático durante la comprobación de la contraseña de la basew de datos.


CVE: CVE-2022-1720

[{'lang': 'en', 'value': 'Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.'}]

Fix commit: patch 8.2.4956: reading past end of line with "gf" in Visual block mode

Problem:    Reading past end of line with "gf" in Visual block mode.
Solution:   Do not include the NUL in the length.


CVE: CVE-2022-1721

[{'lang': 'en', 'value': 'Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.'}]

Fix commit: Limit wellknown servlet to serve single file


CVE: CVE-2022-1722

[{'lang': 'en', 'value': "SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses"}]

Fix commit: Adds isLinkLocalAddress() to address checks


CVE: CVE-2022-1723

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.'}]

Fix commit: 18.0.6 release


CVE: CVE-2022-1727

[{'lang': 'en', 'value': 'Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.'}]

Fix commit: 18.0.4 release


CVE: CVE-2022-1728

[{'lang': 'en', 'value': 'Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.'}]

Fix commit: fix(account): security fix


CVE: CVE-2022-1730

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.'}]

Fix commit: 18.0.4 release


CVE: CVE-2022-1733

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.'}]

Fix commit: patch 8.2.4968: reading past end of the line when C-indenting

Problem:    Reading past end of the line when C-indenting.
Solution:   Check for NUL.


CVE: CVE-2022-1734

[{'lang': 'en', 'value': 'A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.'}]

Fix commit: nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs

There are destructive operations such as nfcmrvl_fw_dnld_abort and
gpio_free in nfcmrvl_nci_unregister_dev. The resources such a


CVE: CVE-2022-1735

[{'lang': 'en', 'value': 'Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.'}]

Fix commit: patch 8.2.4969: changing text in Visual mode may cause invalid memory access

Problem:    Changing text in Visual mode may cause invalid memory access.
Solution:   Check the Visual position after making a change.


CVE: CVE-2022-1752

[{'lang': 'en', 'value': 'Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2.'}]

Fix commit: refactor(accounts): security enhancements


CVE: CVE-2022-1754

[{'lang': 'en', 'value': 'Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.'}]

Fix commit: fix(account): security fix


CVE: CVE-2022-1767

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.'}]

Fix commit: 18.0.7 release


CVE: CVE-2022-1769

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.'}]

Fix commit: patch 8.2.4974: ":so" command may read after end of buffer

Problem:    ":so" command may read after end of buffer.
Solution:   Compute length of text properly.


CVE: CVE-2022-1770

[{'lang': 'en', 'value': 'Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.'}]

Fix commit: refactor(core): apiv2 route enhancements


CVE: CVE-2022-1771

[{'lang': 'en', 'value': 'Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.'}]

Fix commit: patch 8.2.4975: recursive command line loop may cause a crash

Problem:    Recursive command line loop may cause a crash.
Solution:   Limit recursion of getcmdline().


CVE: CVE-2022-1774

[{'lang': 'en', 'value': 'Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.'}]

Fix commit: 18.0.7 release


CVE: CVE-2022-1775

[{'lang': 'en', 'value': 'Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.'}]

Fix commit: refactor(accounts): password security enhancements


CVE: CVE-2022-1782

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.'}]

Fix commit: added option to escape HTML when compiling Mustache templates


CVE: CVE-2022-1784

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.'}]

Fix commit: 18.0.7 release


CVE: CVE-2022-1785

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.'}]

Fix commit: patch 8.2.4977: memory access error when substitute expression changes window

Problem:    Memory access error when substitute expression changes window.
Solution:   Disallow changing window in substitute expression.


CVE: CVE-2022-1795

[{'lang': 'en', 'value': 'Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV.'}]

Fix commit: fixed #2194


CVE: CVE-2022-1796

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 8.2.4979.'}]

Fix commit: patch 8.2.4979: accessing freed memory when line is flushed

Problem:    Accessing freed memory when line is flushed.
Solution:   Make a copy of the pattern to search for.


CVE: CVE-2022-1803

[{'lang': 'en', 'value': 'Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.'}]

Fix commit: fix(core): iframe security fix


CVE: CVE-2022-1806

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.'}]

Fix commit: remove some cruft and implement a sanitizer for the client-supplied callback function name


CVE: CVE-2022-1808

[{'lang': 'en', 'value': 'Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.'}]

Fix commit: fix(core): verify user exists


CVE: CVE-2022-1809

[{'lang': 'en', 'value': 'Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.'}]

Fix commit: Fix crash in vtable analysis on UB ##crash

* Reported by @greatergoodest via huntrdev
* BountyID 0730a95e-c485-4ff2-9a5d-bb3abfda0b17
* Reproducer: minified_crash


CVE: CVE-2022-1810

[{'lang': 'en', 'value': 'Improper Access Control in GitHub repository publify/publify prior to 9.2.9.'}]

Fix commit: Use only the main id parameter to find Article to update


CVE: CVE-2022-1811

[{'lang': 'en', 'value': 'Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.'}]

Fix commit: Refuse html files as resources even if declared to be plain text


CVE: CVE-2022-1813

[{'lang': 'en', 'value': 'OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.'}]

Fix commit: Fix command injection issue on detect cms


CVE: CVE-2022-1815

[{'lang': 'en', 'value': 'Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.'}]

Fix commit: 18.1.2 release


CVE: CVE-2022-1825

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.'}]

Fix commit: Print potential XSS in error message handler


CVE: CVE-2022-1848

[{'lang': 'en', 'value': 'Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.'}]

Fix commit: fixed password length issues


CVE: CVE-2022-1849

[{'lang': 'en', 'value': 'Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.'}]

Fix commit: regenerate session on user update


CVE: CVE-2022-1850

[{'lang': 'en', 'value': 'Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.'}]

Fix commit: path traversal fix


CVE: CVE-2022-1851

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5013: after text formatting cursor may be in an invalid position

Problem:    After text formatting the cursor may be in an invalid position.
Solution:   Correct the cursor position after formatting.


CVE: CVE-2022-1852

[{'lang': 'en', 'value': 'A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.'}]

Fix commit: KVM: x86: avoid calling x86 emulator without a decoded instruction

Whenever x86_decode_emulated_instruction() detects a breakpoint, it
returns the value that kvm_vcpu_check_breakpoint() wri


CVE: CVE-2022-1883

[{'lang': 'en', 'value': 'SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.'}]

Fix commit: fix(db): possible sql injection on /search endpoint


CVE: CVE-2022-1886

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5016: access before start of text with a put command

Problem:    Access before start of text with a put command.
Solution:   Check the length is more than zero.


CVE: CVE-2022-1893

[{'lang': 'en', 'value': 'Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository polonel/trudesk prior to 1.2.3.'}]

Fix commit: fix(core): image data removal


CVE: CVE-2022-1897

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5023: substitute overwrites allocated buffer

Problem:    Substitute overwrites allocated buffer.
Solution:   Disallow undo when in a substitute command.


CVE: CVE-2022-1898

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5024: using freed memory with "]d"

Problem:    Using freed memory with "]d".
Solution:   Copy the pattern before searching.


CVE: CVE-2022-1899

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.'}]

Fix commit: Fix integer overflow in string search causing oobread ##crash

* Reported by @greatergoodest via huntrdev
* BountyID: 8a3dc5cb-08b3-4807-82b2-77f08c137a04
* Reproducer bfileovf


CVE: CVE-2022-1907

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.'}]

Fix commit: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input


CVE: CVE-2022-1908

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.'}]

Fix commit: Fix boundary checking error in markup search, that could cause buffer over-read with corrupt input


CVE: CVE-2022-1909

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.'}]

Fix commit: sanitize tab image and group image


CVE: CVE-2022-1926

[{'lang': 'en', 'value': 'Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.'}]

Fix commit: fix(messages): xss security


CVE: CVE-2022-1927

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5037: cursor position may be invalid after "0;" range

Problem:    Cursor position may be invalid after "0;" range.
Solution:   Check the cursor position when it was set by ";" in the range.


CVE: CVE-2022-1928

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.'}]

Fix commit: Fix raw endpoint PDF file headers (#19825)


CVE: CVE-2022-1931

[{'lang': 'en', 'value': 'Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.'}]

Fix commit: fix(messages): validation check


CVE: CVE-2022-1934

[{'lang': 'en', 'value': 'Use After Free in GitHub repository mruby/mruby prior to 3.2.'}]

Fix commit: vm.c (hash_new_from_regs): stack may be reallocated.


CVE: CVE-2022-1942

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5043: can open a cmdline window from a substitute expression

Problem:    Can open a cmdline window from a substitute expression.
Solution:   Disallow opening a command line window when text or buffer is
            locked.


CVE: CVE-2022-1947

[{'lang': 'en', 'value': 'Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.'}]

Fix commit: fix(messages): invalid permissions


CVE: CVE-2022-1968

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5050: using freed memory when searching for pattern in path

Problem:    Using freed memory when searching for pattern in path.
Solution:   Make a copy of the line.


CVE: CVE-2022-1986

[{'lang': 'en', 'value': 'OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.'}]

Fix commit: repo_editor: check both styles of `os.PathSeparator` in all systems (#7005)


CVE: CVE-2022-1987

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.'}]

Fix commit: Fix: index entry label not being zero-terminated with corrupt input


CVE: CVE-2022-1988

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.'}]

Fix commit: - Añadida comprobación de html en descripción al test unitario del modelo cuenta.
- Eliminado el test unitario de subcuenta por obsoleto. Se creará uno nuevo a continuación.


CVE: CVE-2022-1992

[{'lang': 'en', 'value': 'Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.'}]

Fix commit: pathutil: check both styles of `os.PathSeparator` (#7020)


CVE: CVE-2022-1993

[{'lang': 'en', 'value': 'Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.'}]

Fix commit: http: clean request path from Git endpoints (#7022)


CVE: CVE-2022-1996

[{'lang': 'en', 'value': 'Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.'}]

Fix commit: use exact matching of allowed domain entries, issue #489 (#493)

* use exact matching of allowed domain entries, issue #489

* update doc, add testcases from PR conversation

* introduce AllowedDomainFunc #489

* more tests, fix doc

* lowercase origin before checking cors


CVE: CVE-2022-1997

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.'}]

Fix commit: Fix stored XSS security issue: remove inline JS from URL in PreparePHP_SELF.fnc.php


CVE: CVE-2022-2000

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5063: error for a command may go over the end of IObuff

Problem:    Error for a command may go over the end of IObuff.
Solution:   Truncate the message.


CVE: CVE-2022-2014

[{'lang': 'en', 'value': 'Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.'}]

Fix commit: 19.0.2 release


CVE: CVE-2022-2015

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.'}]

Fix commit: 19.0.2 release


CVE: CVE-2022-2016

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.'}]

Fix commit: Escaped the html of the balance fields before any other tests. Also added the corresponding unit test.
------
Escapado el html de los campos del balance antes de cualquier otro test. Añadido también el correspondiente test unitario.


CVE: CVE-2022-2023

[{'lang': 'en', 'value': 'Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.'}]

Fix commit: fix(accounts): security enhancement


CVE: CVE-2022-2026

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.'}]

Fix commit: 🔒 fixes three critical stored XSS vulnerabilities thanks @saharshtapi for reporting this
🔒 fixes a formula injection vulnerability in the Excel export functionality thanks @saharshtapi for reprorting this
❗this is an important security release, we recommend to migrate asap, all titra versions below version 0.77.0 are considered insecure for pro


CVE: CVE-2022-2027

[{'lang': 'en', 'value': 'Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.'}]

Fix commit: 🔒 fixes three critical stored XSS vulnerabilities thanks @saharshtapi for reporting this
🔒 fixes a formula injection vulnerability in the Excel export functionality thanks @saharshtapi for reprorting this
❗this is an important security release, we recommend to migrate asap, all titra versions below version 0.77.0 are consi


CVE: CVE-2022-2028

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0.'}]

Fix commit: 🔒 fixes three critical stored XSS vulnerabilities thanks @saharshtapi for reporting this
🔒 fixes a formula injection vulnerability in the Excel export functionality thanks @saharshtapi for reprorting this
❗this is an important security release, we recommend to migrate asap, all titra versions below version 0.77.0 are considered insecure for pr


CVE: CVE-2022-2029

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0.'}]

Fix commit: 🔒 fixes three critical stored XSS vulnerabilities thanks @saharshtapi for reporting this
🔒 fixes a formula injection vulnerability in the Excel export functionality thanks @saharshtapi for reprorting this
❗this is an important security release, we recommend to migrate asap, all titra versions below version 0.77.0 are considered insecure for produc


CVE: CVE-2022-2036

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.'}]

Fix commit: Fix stored XSS security issue: decode HTML entities from URL


CVE: CVE-2022-2037

[{'lang': 'en', 'value': 'Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.'}]

Fix commit: [BUG] Account level security issue (#3150)

* bug fixes

* changes

* changes for single workspace support

* added guards for signup route

* test cases fixes

* Workspace invite and user onboarding flow changes (#3190)

* invite user flow changes

* review comments

* cleanup

* testcase fix


CVE: CVE-2022-2042

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5072: using uninitialized value and freed memory in spell command

Problem:    Using uninitialized value and freed memory in spell command.
Solution:   Initialize "attr".  Check for empty line early.


CVE: CVE-2022-2060

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.'}]

Fix commit: Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop


CVE: CVE-2022-2061

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.'}]

Fix commit: libnsgif: fix oob in lzw_decode


CVE: CVE-2022-2065

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.'}]

Fix commit: Force to download SVG files to prevent security problems.
------
Forzamos a descargar los archivos SVG para evitar problemas de seguridad.


CVE: CVE-2022-2066

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.'}]

Fix commit: Sanitized username when showing user not found message.
------
Saneado nombre de usuario al mostrar el mensaje de usuario no encontrado.


CVE: CVE-2022-2067

[{'lang': 'en', 'value': 'SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.'}]

Fix commit: Fix SQL injection escape DB identifier


CVE: CVE-2022-2073

[{'lang': 'en', 'value': 'Code Injection in GitHub repository getgrav/grav prior to 1.7.34.'}]

Fix commit: Fixed Twig `|filter()` allowing code execution


CVE: CVE-2022-2098

[{'lang': 'en', 'value': 'Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.'}]

Fix commit: 🔒 fixed further security vulnerabilities adding additional password validation
💄 improved light and dark theme (thanks @thomas-kromit)


CVE: CVE-2022-21122

[{'lang': 'en', 'value': "The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor."}]

Fix commit: Prevent arbitrary js code execution

PR-URL: https://github.com/metarhia/metacalc/pull/16


CVE: CVE-2022-21144

[{'lang': 'en', 'value': "This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash."}]

Fix commit: Ensure parseXml/parseHtml input is string or buffer (#594)


CVE: CVE-2022-21159

[{'lang': 'en', 'value': 'A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.'}]

Fix commit: - fixed - Bug in presentation layer parser can cause infinite loop (LIB61850-302)


CVE: CVE-2022-21164

[{'lang': 'en', 'value': 'The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.'}]

Fix commit: Perform argument check for putString


CVE: CVE-2022-21189

[{'lang': 'en', 'value': 'The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modif


CVE: CVE-2022-21190

[{'lang': 'en', 'value': "This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible


CVE: CVE-2022-21208

[{'lang': 'en', 'value': 'The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.'}]

Fix commit: fix message chunk overflow detection


CVE: CVE-2022-21208

[{'lang': 'en', 'value': 'The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.'}]

Fix commit: PacketAssembler add chunksize verification & refactor


CVE: CVE-2022-21221

[{'lang': 'en', 'value': 'The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.'}]

Fix commit: Warn about unsafe ServeFile usage (#1228)

See: https://github.com/valyala/fasthttp/issues/1226


CVE: CVE-2022-21221

[{'lang': 'en', 'value': 'The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.'}]

Fix commit: Add windows support to normalizePath

This is probably still not 100% sure and there are still many bugs with
FS on windows. But it's a slight improve


CVE: CVE-2022-21227

[{'lang': 'en', 'value': 'The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.'}]

Fix commit: bug: fix segfault of invalid toString() object (#1450)

* bug: verify toString() returns valid data
* test: faulty toString test


CVE: CVE-2022-2124

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5120: searching for quotes may go over the end of the line

Problem:    Searching for quotes may go over the end of the line.
Solution:   Check for running into the NUL.


CVE: CVE-2022-2125

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5122: lisp indenting my run over the end of the line

Problem:    Lisp indenting my run over the end of the line.
Solution:   Check for NUL earlier.


CVE: CVE-2022-2126

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5123: using invalid index when looking for spell suggestions

Problem:    Using invalid index when looking for spell suggestions.
Solution:   Do not decrement the index when it is zero.


CVE: CVE-2022-2128

[{'lang': 'en', 'value': 'Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.'}]

Fix commit: fix(attachments): file type security fix


CVE: CVE-2022-2129

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5126: substitute may overrun destination buffer

Problem:    Substitute may overrun destination buffer.
Solution:   Disallow switching buffers in a substitute expression.


CVE: CVE-2022-2130

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.'}]

Fix commit: Merge branch 'dev' of github.com:microweber/microweber into dev


CVE: CVE-2022-2134

[{'lang': 'en', 'value': 'Denial of Service in GitHub repository inventree/inventree prior to 0.8.0.'}]

Fix commit: Remove reliance on django-markdownx (#3231)

* Remove reliance on django-markdownx

- We are now rendering notes on the client side using easymde
- No longer any need to utilize the markdownx integration
- Adds character limit for notes fields`

* Adjust legacy migrations - remove references to markdownx

* Fix bug for company notes field


CVE: CVE-2022-21504

[{'lang': 'en', 'value': 'The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socket to be closed and freed while it was still in use by another portion of the kernel. An attack with local access can operate on the socket, and cause a denial of service. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).'}]

Fix commit


CVE: CVE-2022-21642

[{'lang': 'en', 'value': 'Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.'}]

Fix commit: SECURITY: only show user suggestions with regular post (#15436)


CVE: CVE-2022-21646

[{'lang': 'en', 'value': 'SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entir


CVE: CVE-2022-21647

[{'lang': 'en', 'value': 'CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `o


CVE: CVE-2022-21648

[{'lang': 'en', 'value': 'Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.'}]

Fix commit: PhpWriter: complex express


CVE: CVE-2022-21649

[{'lang': 'en', 'value': 'Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.'}]

Fix commit: Fix XSS vulnerabil


CVE: CVE-2022-21650

[{'lang': 'en', 'value': "Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users


CVE: CVE-2022-21651

[{'lang': 'en', 'value': 'Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.'}]

Fix commit: SW-26435 - Improve routing


CVE: CVE-2022-21652

[{'lang': 'en', 'value': "Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically


CVE: CVE-2022-21654

[{'lang': 'en', 'value': "Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade."}]

Fix commit: CVE-2022-21654

tls allows re-use when some cert validation settings have changed

Signed-off-by: Yan Avlasov <yavlasov@google.


CVE: CVE-2022-21655

[{'lang': 'en', 'value': 'Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.'}]

Fix commit: CVE-2022-21655

Crash with direct_response

Signed-off-by: Yan Avlaso


CVE: CVE-2022-21656

[{'lang': 'en', 'value': 'Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underl


CVE: CVE-2022-21666

[{'lang': 'en', 'value': 'Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection in usersearch.php only for users with administrative privileges. Users should replace the file `admin/pages/useredit.php` with a newer version. USOC version Pb2.4Bfx3 contains a fixed version of `admin/pages/useredit.php`.'}]

Fix commit: Update usersearch.php


CVE: CVE-2022-21667

[{'lang': 'en', 'value': "soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, it will crash the server. All users that run the server are affected by this vulnerability and it's highly recommended to upgrade to the


CVE: CVE-2022-21668

[{'lang': 'en', 'value': "pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code


CVE: CVE-2022-21670

[{'lang': 'en', 'value': 'markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.'}]

Fix commit: Fix possible ReDOS in newline rule.

Co-authored-by: MakeNowJust <make.just.on@gmail.com>


CVE: CVE-2022-21671

[{'lang': 'en', 'value': "@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy


CVE: CVE-2022-21675

[{'lang': 'en', 'value': 'Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (AKA "Zip Slip"). The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The Zip Slip vulnerability can affect numerous archive formats, including zip, jar, tar, war, cpio, apk, rar and 7z. The attacker can the


CVE: CVE-2022-21676

[{'lang': 'en', 'value': 'Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package starting from version `4.0.0`, including those who uses depending packages like `socket.io`. Versions prior to `4.0.0` are not impacted. A fix ha


CVE: CVE-2022-21677

[{'lang': 'en', 'value': "Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a group's visibility and the group's members visibility can be configured such that it is restricted to logged on users, members of the group or staff users. A


CVE: CVE-2022-21678

[{'lang': 'en', 'value': "Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse."}]

Fix com


CVE: CVE-2022-21680

[{'lang': 'en', 'value': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through


CVE: CVE-2022-21681

[{'lang': 'en', 'value': 'Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or


CVE: CVE-2022-21682

[{'lang': 'en', 'value': 'Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror


CVE: CVE-2022-21683

[{'lang': 'en', 'value': 'Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long as they have left a comment or reply somewhere on the s


CVE: CVE-2022-21684

[{'lang': 'en', 'value': 'Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with `must_approve_users` enabled is going to be automatically logged in, bypassing the check that does not allow unapproved users to sign in. They will be able to do everything an approved us


CVE: CVE-2022-21685

[{'lang': 'en', 'value': "Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. Users who do not use MODEXP precompile in their runt


CVE: CVE-2022-21686

[{'lang': 'en', 'value': 'PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.'}]

Fix commit: Merge pull request from GHSA-mrq4-7ch7-2465

Properly escape smarty output for twig


CVE: CVE-2022-21687

[{'lang': 'en', 'value': "gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead t


CVE: CVE-2022-21697

[{'lang': 'en', 'value': 'Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, wh


CVE: CVE-2022-21699

[{'lang': 'en', 'value': 'IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.'}]

Fix commit: Merge pull request f


CVE: CVE-2022-21700

[{'lang': 'en', 'value': 'Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously


CVE: CVE-2022-21706

[{'lang': 'en', 'value': "Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation created in one organization (potentially as a role with elevated permissions) can be used to join any other organization. This bypasses any restrictions on re


CVE: CVE-2022-21707

[{'lang': 'en', 'value': 'wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior to 0.52.2 actors can bypass capability authorization. Actors are normally required to declare their capabilities for inbound invocations, but with this vulnerability actor capability claims are not verified upon receiving invocations. This compromises the security model for actors as they can


CVE: CVE-2022-21708

[{'lang': 'en', 'value': 'graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. Th


CVE: CVE-2022-21710

[{'lang': 'en', 'value': 'ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:<img src=x onerror=alert()>}}`. This issue has a patch in version


CVE: CVE-2022-21711

[{'lang': 'en', 'value': 'elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.'}]

Fix commit: Fix #1 about out-of-b


CVE: CVE-2022-21712

[{'lang': 'en', 'value': 'twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.'}]

Fix commit: Merge pull request from GHSA-92x2-jw7w-xvvx

10294 Advisory fix 1


CVE: CVE-2022-21715

[{'lang': 'en', 'value': 'CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\\ResponseTrait` or `ResourceController` Users


CVE: CVE-2022-21716

[{'lang': 'en', 'value': "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds."}]

Fix commit: Update


CVE: CVE-2022-21719

[{'lang': 'en', 'value': 'GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.'}]

Fix commit: Merge pull request from GHSA-6cj4-g839-gj5j


CVE: CVE-2022-21720

[{'lang': 'en', 'value': 'GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.'}]

Fix commit: Merge pull request from GHSA-5hg4-r64r-rf83


CVE: CVE-2022-21722

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master


CVE: CVE-2022-21723

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known


CVE: CVE-2022-21724

[{'lang': 'en', 'value': 'pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection propertie


CVE: CVE-2022-21725

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a division by 0. The function fails to check that the stride argument is strictly positive. Hence, the fix is to add a check for the stride argument to ensure it is valid. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3,


CVE: CVE-2022-21726

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and can result in heap OOB accesses. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions o


CVE: CVE-2022-21727

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer overflow weakness. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes `axis + 1`, an attacker can trigger an integer overflow. The fix


CVE: CVE-2022-21728

[{'lang': 'en', 'value': "Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batch_dim` and can result in a heap OOB read. There is a check to make sure the value of `batch_dim` does not go over the rank of the input, but there is no check for negative values. Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of


CVE: CVE-2022-21729

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by an integer overflow bug. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Fix integer overflow leading to divide by zero error in Unravel index ke


CVE: CVE-2022-21730

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalAvgPoolGrad` does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Add negative


CVE: CVE-2022-21731

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank. How


CVE: CVE-2022-21732

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocating too much memory. This is because the `num_threads` argument is only checked to not be negative, but there is no upper bound on its value. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these a


CVE: CVE-2022-21733

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on


CVE: CVE-2022-21734

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `MapStage` is vulnerable a `CHECK`-fail if the key tensor is not a scalar. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Add a check for Key being scalar tensor for MapStage and OrderedMapStage ops.

Acco


CVE: CVE-2022-21735

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Fix potential divide by zero error when executing FractionalMaxPool, when p


CVE: CVE-2022-21736

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseTensorSliceDataset` has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value. The 3 input arguments to `SparseTensorSliceDataset` represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation. The fix will be included in TensorFlow 2.8.0.


CVE: CVE-2022-21737

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocat


CVE: CVE-2022-21738

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Prevent crash due


CVE: CVE-2022-21739

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Fix nullptr exception in QuantizedM


CVE: CVE-2022-2174

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.'}]

Fix commit: update


CVE: CVE-2022-21740

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Cleanup and remove duplicate validation in `SparseCount`.

We have valdiation that is duplicated,


CVE: CVE-2022-21740

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Further validate sparse tensor for `SparseCount`: indices must be valid within dense shape.

Piper


CVE: CVE-2022-21741

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is strict


CVE: CVE-2022-2175

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5148: invalid memory access when using expression on command line

Problem:    Invalid memory access when using an expression on the command line.
Solution:   Make sure the position does not go negative.


CVE: CVE-2022-21802

[{'lang': 'en', 'value': 'The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.'}]

Fix commit: Protect Selector Manager views from XSS. Closes #4411


CVE: CVE-2022-2182

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5150: read past the end of the first line with ":0;'{"

Problem:    Read past the end of the first line with ":0;'{".
Solution:   When on line zero check the column is valid for line one.


CVE: CVE-2022-2183

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5151: reading beyond the end of the line with lisp indenting

Problem:    Reading beyond the end of the line with lisp indenting.
Solution:   Avoid going over the NUL at the end of the line.


CVE: CVE-2022-2206

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5160: accessing invalid memory after changing terminal size

Problem:    Accessing invalid memory after changing terminal size.
Solution:   Adjust cmdline_row and msg_row to the value of Rows.


CVE: CVE-2022-2207

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5162: reading before the start of the line with BS in Replace mode

Problem:    Reading before the start of the line with BS in Replace mode.
Solution:   Check the cursor column is more than zero.


CVE: CVE-2022-2208

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.'}]

Fix commit: patch 8.2.5163: crash when deleting buffers in diff mode

Problem:    Crash when deleting buffers in diff mode.
Solution:   Recompute diffs later.  Skip window without a valid buffer.