# Vulnerabilities published in 2022


- [CVE-2022-41974](https://insights.sbomify.com/CVE-2022-41974/): Privilege escalation in debian:debian linux (high 7.8)
- [CVE-2022-41973](https://insights.sbomify.com/CVE-2022-41973/): Privilege escalation in debian:debian linux (high 7.8)
- [CVE-2022-41972](https://insights.sbomify.com/CVE-2022-41972/): Contiki-NG contains NULL Pointer Dereference in BLE L2CAP module (low 2.9)
- [CVE-2022-41971](https://insights.sbomify.com/CVE-2022-41971/): Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation (medium 4.8)
- [CVE-2022-41970](https://insights.sbomify.com/CVE-2022-41970/): Nextcloud Server's disabled download shares still allow download through preview images (low 2.6)
- [CVE-2022-4197](https://insights.sbomify.com/CVE-2022-4197/): Sliderby10Web < 1.2.53 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41969](https://insights.sbomify.com/CVE-2022-41969/): Nextcloud Server has no password length limit when creating a user as an administrator (low 2.4)
- [CVE-2022-41968](https://insights.sbomify.com/CVE-2022-41968/): Nextcloud Server's calendar name length not validated before writing to database (low 3.5)
- [CVE-2022-41967](https://insights.sbomify.com/CVE-2022-41967/): Improper Restriction of XML External Entity Reference in Dragonfly (high 7.0)
- [CVE-2022-41966](https://insights.sbomify.com/CVE-2022-41966/): XStream Denial of Service via stack overflow (high 8.2)
- [CVE-2022-41965](https://insights.sbomify.com/CVE-2022-41965/): Opencast Authenticated OpenRedirect Vulnerability (medium 5.7)
- [CVE-2022-41964](https://insights.sbomify.com/CVE-2022-41964/): BigBlueButton contains Response leaks in anonymous polls (medium 5.7)
- [CVE-2022-41963](https://insights.sbomify.com/CVE-2022-41963/): BigBlueButton contains Improper Preservation of Permissions for whiteboard (low 2.7)
- [CVE-2022-41962](https://insights.sbomify.com/CVE-2022-41962/): BigBlueButton contains Incorrect Authorization for setting emoji status (low 2.7)
- [CVE-2022-41961](https://insights.sbomify.com/CVE-2022-41961/): BigBlueButton subject to Ineffective user bans (medium 4.3)
- [CVE-2022-41960](https://insights.sbomify.com/CVE-2022-41960/): BigBlueButton contains DoS via failed authToken validation (medium 4.3)
- [CVE-2022-4196](https://insights.sbomify.com/CVE-2022-4196/): Multi Step Form < 1.7.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41958](https://insights.sbomify.com/CVE-2022-41958/): Deserialization Vulnerability by yaml config input in super-xray (high 7.3)
- [CVE-2022-41957](https://insights.sbomify.com/CVE-2022-41957/): muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereference (high 7.5)
- [CVE-2022-41956](https://insights.sbomify.com/CVE-2022-41956/): Autolab is vulnerable to file disclosure via remote handin feature (medium 6.5)
- [CVE-2022-41955](https://insights.sbomify.com/CVE-2022-41955/): Autolab is vulnerable to remote code execution (RCE) via MOSS functionality (high 8.8)
- [CVE-2022-41954](https://insights.sbomify.com/CVE-2022-41954/): Temporary File Information Disclosure Vulnerability (low 3.3)
- [CVE-2022-41953](https://insights.sbomify.com/CVE-2022-41953/): Git clone remote code execution vulnerability in git-for-windows (high 8.6)
- [CVE-2022-41952](https://insights.sbomify.com/CVE-2022-41952/): Uncontrolled Resource Consumption in Matrix Synapse (medium 6.5)
- [CVE-2022-41951](https://insights.sbomify.com/CVE-2022-41951/): OroPlatform vulnerable to path traversal during temporary file manipulations (high 8.6)
- [CVE-2022-41950](https://insights.sbomify.com/CVE-2022-41950/): Privilege Escalation Vulnerability by wrong chmod param (medium 6.4)
- [CVE-2022-4195](https://insights.sbomify.com/CVE-2022-4195/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41949](https://insights.sbomify.com/CVE-2022-41949/): Semi-blind Server-Side Request Forgery in dhis2-core (medium 5.0)
- [CVE-2022-41948](https://insights.sbomify.com/CVE-2022-41948/): Privilege Chaining with the user admin role in dhis2-core (medium 6.7)
- [CVE-2022-41947](https://insights.sbomify.com/CVE-2022-41947/): Cross-site Scripting with user-uploaded files in dhis2-core (medium 5.4)
- [CVE-2022-41946](https://insights.sbomify.com/CVE-2022-41946/): TemporaryFolder on unix-like systems does not limit access to created files in pgjdbc (medium 4.7)
- [CVE-2022-41945](https://insights.sbomify.com/CVE-2022-41945/): Remote Code Execution (RCE) vulnerability in super-xray via URL input (medium 6.5)
- [CVE-2022-41944](https://insights.sbomify.com/CVE-2022-41944/): Discourse users can see notifications for topics they no longer have access to (low 3.5)
- [CVE-2022-41943](https://insights.sbomify.com/CVE-2022-41943/): Incorrect default permissions found in Sourcegraph (critical 9.0)
- [CVE-2022-41942](https://insights.sbomify.com/CVE-2022-41942/): Sourcegraph vulnerable to Comand Injection via gitserver (high 7.9)
- [CVE-2022-41941](https://insights.sbomify.com/CVE-2022-41941/): glpi contains XSS Stored inside Standard Interface Help Link href attribute (medium 6.2)
- [CVE-2022-41940](https://insights.sbomify.com/CVE-2022-41940/): Uncaught exception in engine.io (high 7.1)
- [CVE-2022-4194](https://insights.sbomify.com/CVE-2022-4194/): Use after free in Chrome (high 8.8)
- [CVE-2022-41939](https://insights.sbomify.com/CVE-2022-41939/): Credential exposure when running third-party builders in knative/func (medium 6.1)
- [CVE-2022-41938](https://insights.sbomify.com/CVE-2022-41938/): Cross site scripting vulnerability with discussion titles in flarum (critical 9.0)
- [CVE-2022-41937](https://insights.sbomify.com/CVE-2022-41937/): Missing Authorization in XWiki Platform (critical 9.6)
- [CVE-2022-41936](https://insights.sbomify.com/CVE-2022-41936/): Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server (medium 5.3)
- [CVE-2022-41935](https://insights.sbomify.com/CVE-2022-41935/): Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui (medium 5.3)
- [CVE-2022-41934](https://insights.sbomify.com/CVE-2022-41934/): Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui (critical 9.9)
- [CVE-2022-41933](https://insights.sbomify.com/CVE-2022-41933/): Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default (medium 6.2)
- [CVE-2022-41932](https://insights.sbomify.com/CVE-2022-41932/): Creation of new database tables through login form on PostgreSQL (high 7.5)
- [CVE-2022-41931](https://insights.sbomify.com/CVE-2022-41931/): Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui (critical 9.9)
- [CVE-2022-41930](https://insights.sbomify.com/CVE-2022-41930/): org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users (high 7.5)
- [CVE-2022-4193](https://insights.sbomify.com/CVE-2022-4193/): Security feature bypass in Chrome (high 8.8)
- [CVE-2022-41929](https://insights.sbomify.com/CVE-2022-41929/): Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore (medium 4.9)
- [CVE-2022-41928](https://insights.sbomify.com/CVE-2022-41928/): Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml (critical 9.9)
- [CVE-2022-41927](https://insights.sbomify.com/CVE-2022-41927/): XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags (high 7.4)
- [CVE-2022-41926](https://insights.sbomify.com/CVE-2022-41926/): Nextcloud Talk Android broadcast incorrect permission handling (low 3.3)
- [CVE-2022-41925](https://insights.sbomify.com/CVE-2022-41925/): Tailscale daemon is vulnerable to information disclosure via CSRF (low 3.8)
- [CVE-2022-41924](https://insights.sbomify.com/CVE-2022-41924/): Tailscale Windows daemon is vulnerable to RCE via CSRF (critical 9.6)
- [CVE-2022-41923](https://insights.sbomify.com/CVE-2022-41923/): Grails Spring Security Core plugin vulnerable to privilege escalation (critical 9.1)
- [CVE-2022-41922](https://insights.sbomify.com/CVE-2022-41922/): Prevent RCE when deserializing untrusted user input (high 8.1)
- [CVE-2022-41921](https://insights.sbomify.com/CVE-2022-41921/): Discourse chat messages should have a maximum character limit (low 3.5)
- [CVE-2022-41920](https://insights.sbomify.com/CVE-2022-41920/): Zip slip in Lancet (medium 6.3)
- [CVE-2022-4192](https://insights.sbomify.com/CVE-2022-4192/): Use after free in Chrome (high 8.8)
- [CVE-2022-41919](https://insights.sbomify.com/CVE-2022-41919/): Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type (medium 4.2)
- [CVE-2022-41918](https://insights.sbomify.com/CVE-2022-41918/): Issue with fine-grained access control of indices backing data streams (medium 6.3)
- [CVE-2022-41917](https://insights.sbomify.com/CVE-2022-41917/): Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch (medium 4.3)
- [CVE-2022-41916](https://insights.sbomify.com/CVE-2022-41916/): Read one byte past a buffer when normalizing Unicode (medium 5.9)
- [CVE-2022-41915](https://insights.sbomify.com/CVE-2022-41915/): Netty vulnerable to HTTP Response splitting from assigning header value iterator (medium 6.5)
- [CVE-2022-41914](https://insights.sbomify.com/CVE-2022-41914/): Non-constant-time SCIM token comparison in Zulip Server (low 3.7)
- [CVE-2022-41913](https://insights.sbomify.com/CVE-2022-41913/): Discourse-calendar exposes members of hidden groups (medium 4.3)
- [CVE-2022-41912](https://insights.sbomify.com/CVE-2022-41912/): crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements (critical 9.1)
- [CVE-2022-41911](https://insights.sbomify.com/CVE-2022-41911/): Invalid char to bool conversion when printing a tensor in Tensorflow (medium 4.8)
- [CVE-2022-41910](https://insights.sbomify.com/CVE-2022-41910/): Heap out of bounds read in `QuantizeAndDequantizeV2` in Tensorflow (medium 4.8)
- [CVE-2022-4191](https://insights.sbomify.com/CVE-2022-4191/): Use after free in Chrome (high 8.8)
- [CVE-2022-41909](https://insights.sbomify.com/CVE-2022-41909/): Segfault in `CompositeTensorVariantToComponents` in Tensorflow (medium 4.8)
- [CVE-2022-41908](https://insights.sbomify.com/CVE-2022-41908/): `CHECK` fail via inputs in `PyFunc` in Tensorflow (medium 4.8)
- [CVE-2022-41907](https://insights.sbomify.com/CVE-2022-41907/): Overflow in `ResizeNearestNeighborGrad` in Tensorflow (medium 4.8)
- [CVE-2022-41906](https://insights.sbomify.com/CVE-2022-41906/): OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) (high 7.7)
- [CVE-2022-41905](https://insights.sbomify.com/CVE-2022-41905/): wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled (high 8.2)
- [CVE-2022-41904](https://insights.sbomify.com/CVE-2022-41904/): Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions (medium 6.4)
- [CVE-2022-41903](https://insights.sbomify.com/CVE-2022-41903/): Integer overflow in `git archive`, `git log --format` leading to RCE in git (critical 9.8)
- [CVE-2022-41902](https://insights.sbomify.com/CVE-2022-41902/): Out of bounds write in grappler in Tensorflow (high 7.1)
- [CVE-2022-41901](https://insights.sbomify.com/CVE-2022-41901/): `CHECK_EQ` fail via input in `SparseMatrixNNZ` in Tensorflow (medium 4.8)
- [CVE-2022-41900](https://insights.sbomify.com/CVE-2022-41900/): FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow (high 7.1)
- [CVE-2022-4190](https://insights.sbomify.com/CVE-2022-4190/): Security feature bypass in Chrome (high 8.8)
- [CVE-2022-41899](https://insights.sbomify.com/CVE-2022-41899/): `CHECK` fail via inputs in `SdcaOptimizer` in Tensorflow (medium 4.8)
- [CVE-2022-41898](https://insights.sbomify.com/CVE-2022-41898/): `CHECK` fail via inputs in `SparseFillEmptyRowsGrad` in Tensorflow (medium 4.8)
- [CVE-2022-41897](https://insights.sbomify.com/CVE-2022-41897/): `FractionalMaxPoolGrad` Heap out of bounds read in Tensorflow (medium 4.8)
- [CVE-2022-41896](https://insights.sbomify.com/CVE-2022-41896/): `tf.raw_ops.Mfcc` crashes in Tensorflow (medium 4.8)
- [CVE-2022-41895](https://insights.sbomify.com/CVE-2022-41895/): `MirrorPadGrad` heap out of bounds read in Tensorflow (medium 4.8)
- [CVE-2022-41894](https://insights.sbomify.com/CVE-2022-41894/): Buffer overflow in `CONV_3D_TRANSPOSE` on TFLite (high 7.1)
- [CVE-2022-41893](https://insights.sbomify.com/CVE-2022-41893/): `CHECK_EQ` fail in `tf.raw_ops.TensorListResize` in Tensorflow (medium 4.8)
- [CVE-2022-41892](https://insights.sbomify.com/CVE-2022-41892/): Arches vulnerable to SQL Injection (high 8.6)
- [CVE-2022-41891](https://insights.sbomify.com/CVE-2022-41891/): Segfault in `tf.raw_ops.TensorListConcat` in Tensorflow (medium 4.8)
- [CVE-2022-41890](https://insights.sbomify.com/CVE-2022-41890/): `CHECK` fail in `BCast` overflow in Tensorflow (medium 4.8)
- [CVE-2022-4189](https://insights.sbomify.com/CVE-2022-4189/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2022-41889](https://insights.sbomify.com/CVE-2022-41889/): Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow (medium 5.5)
- [CVE-2022-41888](https://insights.sbomify.com/CVE-2022-41888/): Unckecked rank size in `tf.image.generate_bounding_box_proposals` in Tensorflow (medium 4.8)
- [CVE-2022-41887](https://insights.sbomify.com/CVE-2022-41887/): Overflow in `tf.keras.losses.poisson` in Tensorflow (medium 4.8)
- [CVE-2022-41886](https://insights.sbomify.com/CVE-2022-41886/): Overflow in `ImageProjectiveTransformV2` in Tensorflow (medium 4.8)
- [CVE-2022-41885](https://insights.sbomify.com/CVE-2022-41885/): Overflow in `FusedResizeAndPadConv2D` in Tensorflow (medium 4.8)
- [CVE-2022-41884](https://insights.sbomify.com/CVE-2022-41884/): Seg fault in `ndarray_tensor_bridge` due to zero and large inputs in Tensorflow (medium 4.8)
- [CVE-2022-41883](https://insights.sbomify.com/CVE-2022-41883/): Out of bounds segmentation fault due to unequal op inputs in Tensorflow (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/238/