# Vulnerabilities published in 2022


- [CVE-2022-36017](https://insights.sbomify.com/CVE-2022-36017/): Segfault in `Requantize` in TensorFlow (medium 5.9)
- [CVE-2022-36016](https://insights.sbomify.com/CVE-2022-36016/): `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs` in TensorFlow (medium 5.9)
- [CVE-2022-36015](https://insights.sbomify.com/CVE-2022-36015/): Integer overflow in math ops in TensorFlow (medium 5.9)
- [CVE-2022-36014](https://insights.sbomify.com/CVE-2022-36014/): Null-dereference in `mlir::tfg::TFOp::nameAttr` in TensorFlow (medium 5.9)
- [CVE-2022-36013](https://insights.sbomify.com/CVE-2022-36013/): Null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef` in TensorFlow (medium 5.9)
- [CVE-2022-36012](https://insights.sbomify.com/CVE-2022-36012/): Assertion fail on MLIR empty edge names in TensorFlow (medium 5.9)
- [CVE-2022-36011](https://insights.sbomify.com/CVE-2022-36011/): Null dereference on MLIR on empty function attributes in TensorFlow (medium 5.9)
- [CVE-2022-36010](https://insights.sbomify.com/CVE-2022-36010/): Arbitrary code execution via function parsing in react-editable-json-tree (critical 10.0)
- [CVE-2022-3601](https://insights.sbomify.com/CVE-2022-3601/): Image Hover Effects Css3 <= 4.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-36009](https://insights.sbomify.com/CVE-2022-36009/): Incorrect parsing of access level in gomatrixserverlib and dendrite (medium 5.0)
- [CVE-2022-36008](https://insights.sbomify.com/CVE-2022-36008/): Message length overflow in frontier (high 7.1)
- [CVE-2022-36007](https://insights.sbomify.com/CVE-2022-36007/): Partial Path Traversal in com.github.jlangch:venice (medium 6.1)
- [CVE-2022-36006](https://insights.sbomify.com/CVE-2022-36006/): Authenticated remote code execution due to insecure deserialization (GHSL-2022-063) (high 7.9)
- [CVE-2022-36005](https://insights.sbomify.com/CVE-2022-36005/): `CHECK` fail in `FakeQuantWithMinMaxVarsGradient` in TensorFlow (medium 5.9)
- [CVE-2022-36004](https://insights.sbomify.com/CVE-2022-36004/): `CHECK` fail in `tf.random.gamma` in TensorFlow (medium 5.9)
- [CVE-2022-36003](https://insights.sbomify.com/CVE-2022-36003/): `CHECK` fail in `RandomPoissonV2` in TensorFlow (medium 5.9)
- [CVE-2022-36002](https://insights.sbomify.com/CVE-2022-36002/): `CHECK` fail in `Unbatch` in TensorFlow (medium 5.9)
- [CVE-2022-36001](https://insights.sbomify.com/CVE-2022-36001/): `CHECK` fail in `DrawBoundingBoxes` in TensorFlow (medium 5.9)
- [CVE-2022-36000](https://insights.sbomify.com/CVE-2022-36000/): Null dereference on MLIR on empty function attributes in TensorFlow (medium 5.9)
- [CVE-2022-3600](https://insights.sbomify.com/CVE-2022-3600/): Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection (critical 9.8)
- [CVE-2022-35999](https://insights.sbomify.com/CVE-2022-35999/): `CHECK` fail in `Conv2DBackpropInput` in TensorFlow (medium 5.9)
- [CVE-2022-35998](https://insights.sbomify.com/CVE-2022-35998/): `CHECK` fail in `EmptyTensorList` in TensorFlow (medium 5.9)
- [CVE-2022-35997](https://insights.sbomify.com/CVE-2022-35997/): `CHECK` fail in `tf.sparse.cross` in TensorFlow (medium 5.9)
- [CVE-2022-35996](https://insights.sbomify.com/CVE-2022-35996/): Floating point exception in `Conv2D` in TensorFlow (medium 5.9)
- [CVE-2022-35995](https://insights.sbomify.com/CVE-2022-35995/): `CHECK` fail in `AudioSummaryV2` in TensorFlow (medium 5.9)
- [CVE-2022-35994](https://insights.sbomify.com/CVE-2022-35994/): `CHECK` fail in `CollectiveGather` in TensorFlow (medium 5.9)
- [CVE-2022-35993](https://insights.sbomify.com/CVE-2022-35993/): `CHECK` fail in `SetSize` in TensorFlow (medium 5.9)
- [CVE-2022-35992](https://insights.sbomify.com/CVE-2022-35992/): `CHECK` fail in `TensorListFromTensor` in TensorFlow (medium 5.9)
- [CVE-2022-35991](https://insights.sbomify.com/CVE-2022-35991/): `CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in TensorFlow (medium 5.9)
- [CVE-2022-35990](https://insights.sbomify.com/CVE-2022-35990/): `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient` in TensorFlow (medium 5.9)
- [CVE-2022-3599](https://insights.sbomify.com/CVE-2022-3599/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-35989](https://insights.sbomify.com/CVE-2022-35989/): `CHECK` fail in `MaxPool` in TensorFlow (medium 5.9)
- [CVE-2022-35988](https://insights.sbomify.com/CVE-2022-35988/): `CHECK` fail in `tf.linalg.matrix_rank` in TensorFlow (medium 5.9)
- [CVE-2022-35987](https://insights.sbomify.com/CVE-2022-35987/): `CHECK` fail in `DenseBincount` in TensorFlow (medium 5.9)
- [CVE-2022-35986](https://insights.sbomify.com/CVE-2022-35986/): Segfault in `RaggedBincount` in TensorFlow (medium 5.9)
- [CVE-2022-35985](https://insights.sbomify.com/CVE-2022-35985/): `CHECK` fail in `LRNGrad` in TensorFlow (medium 5.9)
- [CVE-2022-35984](https://insights.sbomify.com/CVE-2022-35984/): `CHECK` fail in `ParameterizedTruncatedNormal` in TensorFlow (medium 5.9)
- [CVE-2022-35983](https://insights.sbomify.com/CVE-2022-35983/): `CHECK` fail in `Save` and `SaveSlices` in TensorFlow (medium 5.9)
- [CVE-2022-35982](https://insights.sbomify.com/CVE-2022-35982/): Segfault in `SparseBincount` in TensorFlow (medium 5.9)
- [CVE-2022-35981](https://insights.sbomify.com/CVE-2022-35981/): `CHECK` fail in `FractionalMaxPoolGrad` in TensorFlow (medium 5.9)
- [CVE-2022-35980](https://insights.sbomify.com/CVE-2022-35980/): OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information (high 7.5)
- [CVE-2022-3598](https://insights.sbomify.com/CVE-2022-3598/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-35979](https://insights.sbomify.com/CVE-2022-35979/): Segfault in `QuantizedRelu` and `QuantizedRelu6` (medium 5.9)
- [CVE-2022-35978](https://insights.sbomify.com/CVE-2022-35978/): Lua sandbox escape from mod in Minetest (high 7.7)
- [CVE-2022-35977](https://insights.sbomify.com/CVE-2022-35977/): Integer overflow in certain command arguments can drive Redis to OOM panic (medium 5.5)
- [CVE-2022-35976](https://insights.sbomify.com/CVE-2022-35976/): Improper KubeConfig handling allows arbitrary code execution (medium 5.2)
- [CVE-2022-35975](https://insights.sbomify.com/CVE-2022-35975/): Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode (critical 9.0)
- [CVE-2022-35974](https://insights.sbomify.com/CVE-2022-35974/): Segfault in `QuantizeDownAndShrinkRange` in TensorFlow (medium 5.9)
- [CVE-2022-35973](https://insights.sbomify.com/CVE-2022-35973/): Segfault in `QuantizedMatMul` in TensorFlow (medium 5.9)
- [CVE-2022-35972](https://insights.sbomify.com/CVE-2022-35972/): Segfault in `QuantizedBiasAdd` in TensorFlow (medium 5.9)
- [CVE-2022-35971](https://insights.sbomify.com/CVE-2022-35971/): `CHECK` fail in `FakeQuantWithMinMaxVars` in TensorFlow (medium 5.9)
- [CVE-2022-35970](https://insights.sbomify.com/CVE-2022-35970/): Segfault in `QuantizedInstanceNorm` in TensorFlow (medium 5.9)
- [CVE-2022-3597](https://insights.sbomify.com/CVE-2022-3597/): Memory corruption in libtiff (medium 5.5)
- [CVE-2022-35969](https://insights.sbomify.com/CVE-2022-35969/): `CHECK` fail in `Conv2DBackpropInput` in TensorFlow (medium 5.9)
- [CVE-2022-35968](https://insights.sbomify.com/CVE-2022-35968/): `CHECK` fail in `AvgPoolGrad` in TensorFlow (medium 5.9)
- [CVE-2022-35967](https://insights.sbomify.com/CVE-2022-35967/): Segfault in `QuantizedAdd` in TensorFlow (medium 5.9)
- [CVE-2022-35966](https://insights.sbomify.com/CVE-2022-35966/): Segfault in `QuantizedAvgPool` in TensorFlow (medium 5.9)
- [CVE-2022-35965](https://insights.sbomify.com/CVE-2022-35965/): Segfault in `LowerBound` and `UpperBound` in TensorFlow (medium 5.9)
- [CVE-2022-35964](https://insights.sbomify.com/CVE-2022-35964/): Segfault in `BlockLSTMGradV2` in TensorFlow (medium 5.9)
- [CVE-2022-35963](https://insights.sbomify.com/CVE-2022-35963/): `CHECK` failures in `FractionalAvgPoolGrad` in TensorFlow (medium 5.9)
- [CVE-2022-35962](https://insights.sbomify.com/CVE-2022-35962/): Crafted link in Zulip message can cause disclosure of credentials (high 8.0)
- [CVE-2022-35961](https://insights.sbomify.com/CVE-2022-35961/): ECDSA signature malleability in OpenZeppelin Contracts (high 7.9)
- [CVE-2022-35960](https://insights.sbomify.com/CVE-2022-35960/): `CHECK` failure in `TensorListReserve` in TensorFlow (medium 5.9)
- [CVE-2022-3596](https://insights.sbomify.com/CVE-2022-3596/): Instack-undercloud: rsync leaks information to undercloud (high 7.5)
- [CVE-2022-35959](https://insights.sbomify.com/CVE-2022-35959/): `CHECK` failures in `AvgPool3DGrad` in TensorFlow (medium 5.9)
- [CVE-2022-35957](https://insights.sbomify.com/CVE-2022-35957/): Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin (medium 6.6)
- [CVE-2022-35956](https://insights.sbomify.com/CVE-2022-35956/): update_by_case before 0.1.3 vulnerable to sql injection (medium 5.8)
- [CVE-2022-35954](https://insights.sbomify.com/CVE-2022-35954/): Delimiter injection vulnerability in @actions/core exportVariable (medium 5.0)
- [CVE-2022-35953](https://insights.sbomify.com/CVE-2022-35953/): URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm (high 7.1)
- [CVE-2022-35952](https://insights.sbomify.com/CVE-2022-35952/): `CHECK` failures in `UnbatchGradOp` in TensorFlow (medium 5.9)
- [CVE-2022-35951](https://insights.sbomify.com/CVE-2022-35951/): Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflow (high 7.0)
- [CVE-2022-35950](https://insights.sbomify.com/CVE-2022-35950/): OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item (medium 6.9)
- [CVE-2022-3595](https://insights.sbomify.com/CVE-2022-3595/): Linux Kernel CIFS sess.c sess_free_buffer double free (low 3.5)
- [CVE-2022-35949](https://insights.sbomify.com/CVE-2022-35949/): `undici.request` vulnerable to SSRF using absolute URL on `pathname` (medium 5.3)
- [CVE-2022-35948](https://insights.sbomify.com/CVE-2022-35948/): CRLF Injection in Nodejs ‘undici’ via Content-Type (medium 5.3)
- [CVE-2022-35947](https://insights.sbomify.com/CVE-2022-35947/): SQL injection in GLPI (critical 10.0)
- [CVE-2022-35946](https://insights.sbomify.com/CVE-2022-35946/): SQL injection through plugin controller in GLPI (medium 5.5)
- [CVE-2022-35945](https://insights.sbomify.com/CVE-2022-35945/): Cross site scripting (XSS) via registration API in GLPI (medium 6.3)
- [CVE-2022-35944](https://insights.sbomify.com/CVE-2022-35944/): October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) (medium 6.2)
- [CVE-2022-35943](https://insights.sbomify.com/CVE-2022-35943/): SameSite may allow cross-site request forgery (CSRF) protection to be bypassed (medium 5.9)
- [CVE-2022-35942](https://insights.sbomify.com/CVE-2022-35942/): loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter (critical 9.3)
- [CVE-2022-35941](https://insights.sbomify.com/CVE-2022-35941/): `CHECK` failure in `AvgPoolOp` in Tensorflow (medium 5.9)
- [CVE-2022-35940](https://insights.sbomify.com/CVE-2022-35940/): Int overflow in `RaggedRangeOp` in Tensoflow (medium 5.9)
- [CVE-2022-3594](https://insights.sbomify.com/CVE-2022-3594/): Linux Kernel BPF r8152.c intr_callback logging of excessive data (medium 5.3)
- [CVE-2022-35939](https://insights.sbomify.com/CVE-2022-35939/): Out of bounds write in `scatter_nd` op in TensorFlow Lite (high 7.0)
- [CVE-2022-35938](https://insights.sbomify.com/CVE-2022-35938/): OOB read in `Gather_nd` op in TensorFlow Lite Micro (high 7.0)
- [CVE-2022-35937](https://insights.sbomify.com/CVE-2022-35937/): OOB read in `Gather_nd` op in TensorFlow Lite (high 7.0)
- [CVE-2022-35936](https://insights.sbomify.com/CVE-2022-35936/): Ethermint DoS through Unintended Contract Selfdestruct (high 8.2)
- [CVE-2022-35935](https://insights.sbomify.com/CVE-2022-35935/): `CHECK` failure in `SobolSample` via missing validation in TensorFlow (medium 5.9)
- [CVE-2022-35934](https://insights.sbomify.com/CVE-2022-35934/): `CHECK` failure in tf.reshape in Tensorflow (medium 5.9)
- [CVE-2022-35933](https://insights.sbomify.com/CVE-2022-35933/): PrestaShop module Product Comments vulnerable to cross-site scripting (XSS) (medium 4.3)
- [CVE-2022-35932](https://insights.sbomify.com/CVE-2022-35932/): Missing rate limit when trying to join a password protected Nextcloud Talk conversation (low 3.5)
- [CVE-2022-35931](https://insights.sbomify.com/CVE-2022-35931/): Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidator (low 2.7)
- [CVE-2022-35930](https://insights.sbomify.com/CVE-2022-35930/): Ability to bypass attestation verification in sigstore PolicyController (high 7.1)
- [CVE-2022-35929](https://insights.sbomify.com/CVE-2022-35929/): False positive signature verification in cosign (high 7.1)
- [CVE-2022-35928](https://insights.sbomify.com/CVE-2022-35928/): AES Crypt for Linux Password Security Vulnerability (high 8.4)
- [CVE-2022-35927](https://insights.sbomify.com/CVE-2022-35927/): Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG (high 8.1)
- [CVE-2022-35926](https://insights.sbomify.com/CVE-2022-35926/): Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG (medium 5.9)
- [CVE-2022-35925](https://insights.sbomify.com/CVE-2022-35925/): Missing rate limit in Authentication in bookwyrm (medium 5.3)
- [CVE-2022-35924](https://insights.sbomify.com/CVE-2022-35924/): Verification requests (magic link) sent to unwanted emails (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/282/