CVE-2022-1766

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-17677.5Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-17687.5The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user CVE-2022-17697.8Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.CVE-2022-17708.8Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-17715.5Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.CVE-2022-17724.8The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site'CVE-2022-17736.1The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to CVE-2022-17746.1Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-17759.8Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-17765.4The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign paramete CVE-2022-17778.8The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any aut CVE-2022-17784.4Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-ov