# Vulnerabilities published in 2022


- [CVE-2022-29212](https://insights.sbomify.com/CVE-2022-29212/): Core dump when loading TFLite models with quantization in TensorFlow (medium 5.5)
- [CVE-2022-29211](https://insights.sbomify.com/CVE-2022-29211/): Segfault in TensorFlow if `tf.histogram_fixed_width` is called with NaN values (medium 5.5)
- [CVE-2022-29210](https://insights.sbomify.com/CVE-2022-29210/): Heap buffer overflow due to incorrect hash function in TensorFlow (medium 5.5)
- [CVE-2022-2921](https://insights.sbomify.com/CVE-2022-2921/): Exposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp (high 8.8)
- [CVE-2022-29209](https://insights.sbomify.com/CVE-2022-29209/): Type confusion leading to `CHECK`-failure based denial of service in TensorFlow (medium 5.5)
- [CVE-2022-29208](https://insights.sbomify.com/CVE-2022-29208/): Segfault and Out-of-bounds Write write due to incomplete validation in TensorFlow (high 7.1)
- [CVE-2022-29207](https://insights.sbomify.com/CVE-2022-29207/): Undefined behavior when users supply invalid resource handles in TensorFlow (medium 5.5)
- [CVE-2022-29206](https://insights.sbomify.com/CVE-2022-29206/): Missing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlow (medium 5.5)
- [CVE-2022-29205](https://insights.sbomify.com/CVE-2022-29205/): Segfault due to missing support for quantized types in TensorFlow (medium 5.5)
- [CVE-2022-29204](https://insights.sbomify.com/CVE-2022-29204/): Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2` (medium 5.5)
- [CVE-2022-29203](https://insights.sbomify.com/CVE-2022-29203/): Integer overflow in `SpaceToBatchND` in TensorFlow (medium 5.5)
- [CVE-2022-29202](https://insights.sbomify.com/CVE-2022-29202/): Denial of service in TensorFlow due to lack of validation in `tf.ragged.constant` (medium 5.5)
- [CVE-2022-29201](https://insights.sbomify.com/CVE-2022-29201/): Missing validation in `QuantizedConv2D` results in undefined behavior in TensorFlow (medium 5.5)
- [CVE-2022-29200](https://insights.sbomify.com/CVE-2022-29200/): Missing validation causes denial of service in TensorFlow via `LSTMBlockCell` (medium 5.5)
- [CVE-2022-29199](https://insights.sbomify.com/CVE-2022-29199/): Missing validation causes denial of service in TensorFlow via `LoadAndRemapMatrix` (medium 5.5)
- [CVE-2022-29198](https://insights.sbomify.com/CVE-2022-29198/): Missing validation causes denial of service in TensorFlow via `SparseTensorToCSRSparseMatrix` (medium 5.5)
- [CVE-2022-29197](https://insights.sbomify.com/CVE-2022-29197/): Missing validation causes denial of service in TensorFlow via `UnsortedSegmentJoin` (medium 5.5)
- [CVE-2022-29196](https://insights.sbomify.com/CVE-2022-29196/): Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2` (medium 5.5)
- [CVE-2022-29195](https://insights.sbomify.com/CVE-2022-29195/): Missing validation causes denial of service in TensorFlow via `StagePeek` (medium 5.5)
- [CVE-2022-29194](https://insights.sbomify.com/CVE-2022-29194/): Missing validation causes denial of service via `DeleteSessionTensor` in TensorFlow (medium 5.5)
- [CVE-2022-29193](https://insights.sbomify.com/CVE-2022-29193/): Missing validation causes `TensorSummaryV2` in TensorFlow to crash (medium 5.5)
- [CVE-2022-29192](https://insights.sbomify.com/CVE-2022-29192/): Missing validation crashes `QuantizeAndDequantizeV4Grad` in TensorFlow (medium 5.5)
- [CVE-2022-29191](https://insights.sbomify.com/CVE-2022-29191/): Missing validation causes denial of service via `GetSessionTensor` in TensorFlow (medium 5.5)
- [CVE-2022-29190](https://insights.sbomify.com/CVE-2022-29190/): Header reconstruction method can be thrown into an infinite loop in Pion DTLS (high 7.5)
- [CVE-2022-29189](https://insights.sbomify.com/CVE-2022-29189/): Buffer for inbound DTLS fragments has no limit (medium 5.3)
- [CVE-2022-29188](https://insights.sbomify.com/CVE-2022-29188/): Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen (medium 5.3)
- [CVE-2022-29187](https://insights.sbomify.com/CVE-2022-29187/): Bypass of safe.directory protections in Git (high 7.8)
- [CVE-2022-29186](https://insights.sbomify.com/CVE-2022-29186/): Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise (critical 9.1)
- [CVE-2022-29185](https://insights.sbomify.com/CVE-2022-29185/): Observable Timing Discrepancy in totp-rs (medium 4.2)
- [CVE-2022-29184](https://insights.sbomify.com/CVE-2022-29184/): Command Injection/Argument Injection in GoCD (high 8.8)
- [CVE-2022-29183](https://insights.sbomify.com/CVE-2022-29183/): Reflected XSS in GoCD (medium 4.3)
- [CVE-2022-29182](https://insights.sbomify.com/CVE-2022-29182/): DOM-based XSS in GoCD (medium 4.3)
- [CVE-2022-29181](https://insights.sbomify.com/CVE-2022-29181/): Improper Handling of Unexpected Data Type in Nokogiri (high 8.2)
- [CVE-2022-29180](https://insights.sbomify.com/CVE-2022-29180/): Charm vulnerable to server-side request forgery (SSRF) (medium 5.9)
- [CVE-2022-29179](https://insights.sbomify.com/CVE-2022-29179/): Improper Privilege Management in Cilium (high 7.5)
- [CVE-2022-29178](https://insights.sbomify.com/CVE-2022-29178/): Incorrect Default Permissions in Cilium (high 8.8)
- [CVE-2022-29177](https://insights.sbomify.com/CVE-2022-29177/): DoS via malicious p2p message in Go-Ethereum (medium 5.9)
- [CVE-2022-29176](https://insights.sbomify.com/CVE-2022-29176/): Unauthorized gem takeover for some gems on rubygems.org (critical 9.9)
- [CVE-2022-29174](https://insights.sbomify.com/CVE-2022-29174/): Predictable password reset token may lead to account takeover in countly-server (high 8.1)
- [CVE-2022-29173](https://insights.sbomify.com/CVE-2022-29173/): No protection against rollback attacks in go-tuf (high 8.0)
- [CVE-2022-29172](https://insights.sbomify.com/CVE-2022-29172/): HTML injection with additional signup fields (medium 6.1)
- [CVE-2022-29171](https://insights.sbomify.com/CVE-2022-29171/): Remote Code Execution in sourcegraph (medium 6.6)
- [CVE-2022-29170](https://insights.sbomify.com/CVE-2022-29170/): Grafana Enterprise datasource network restrictions bypass via HTTP redirects (medium 6.6)
- [CVE-2022-29169](https://insights.sbomify.com/CVE-2022-29169/): ReDoS on endpoint html5client/useragent in BigBlueButton (high 7.5)
- [CVE-2022-29168](https://insights.sbomify.com/CVE-2022-29168/): Cross Site Scripting in Wire Messages (critical 9.6)
- [CVE-2022-29167](https://insights.sbomify.com/CVE-2022-29167/): ReDoS vulnerability in header parsing in hawk (high 7.4)
- [CVE-2022-29166](https://insights.sbomify.com/CVE-2022-29166/): Improper handling of multiline messages in matrix-appservice-irc (high 8.0)
- [CVE-2022-29165](https://insights.sbomify.com/CVE-2022-29165/): Argo CD will blindly trust JWT claims if anonymous access is enabled (critical 10.0)
- [CVE-2022-29164](https://insights.sbomify.com/CVE-2022-29164/): Privilege Escalation in argo-workflows (high 7.1)
- [CVE-2022-29163](https://insights.sbomify.com/CVE-2022-29163/): Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server (low 3.5)
- [CVE-2022-29162](https://insights.sbomify.com/CVE-2022-29162/): Incorrect Default Permissions in runc (medium 5.9)
- [CVE-2022-29161](https://insights.sbomify.com/CVE-2022-29161/): Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform (medium 5.4)
- [CVE-2022-29160](https://insights.sbomify.com/CVE-2022-29160/): Sensitive files/data exist after deletion of user account in Nextcloud Android (low 2.8)
- [CVE-2022-29159](https://insights.sbomify.com/CVE-2022-29159/): Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck (medium 5.0)
- [CVE-2022-29158](https://insights.sbomify.com/CVE-2022-29158/): Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz (high 7.5)
- [CVE-2022-29156](https://insights.sbomify.com/CVE-2022-29156/): Memory corruption in linux:linux kernel (high 7.8)
- [CVE-2022-29155](https://insights.sbomify.com/CVE-2022-29155/): SQL injection in debian:debian linux (critical 9.8)
- [CVE-2022-29154](https://insights.sbomify.com/CVE-2022-29154/): Path traversal in fedoraproject:fedora (high 7.4)
- [CVE-2022-29153](https://insights.sbomify.com/CVE-2022-29153/): Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector (high 7.5)
- [CVE-2022-29152](https://insights.sbomify.com/CVE-2022-29152/): Cross-site scripting in ericom:powerterm webconnect (medium 6.1)
- [CVE-2022-29151](https://insights.sbomify.com/CVE-2022-29151/): Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29150](https://insights.sbomify.com/CVE-2022-29150/): Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-2915](https://insights.sbomify.com/CVE-2022-2915/): Memory corruption in SMA100 (high 8.8)
- [CVE-2022-29149](https://insights.sbomify.com/CVE-2022-29149/): Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-29148](https://insights.sbomify.com/CVE-2022-29148/): Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29147](https://insights.sbomify.com/CVE-2022-29147/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (low 3.1)
- [CVE-2022-29146](https://insights.sbomify.com/CVE-2022-29146/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2022-29145](https://insights.sbomify.com/CVE-2022-29145/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2022-29144](https://insights.sbomify.com/CVE-2022-29144/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2022-29143](https://insights.sbomify.com/CVE-2022-29143/): Microsoft SQL Server Remote Code Execution Vulnerability (high 7.5)
- [CVE-2022-29142](https://insights.sbomify.com/CVE-2022-29142/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29141](https://insights.sbomify.com/CVE-2022-29141/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29140](https://insights.sbomify.com/CVE-2022-29140/): Windows Print Spooler Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-29139](https://insights.sbomify.com/CVE-2022-29139/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29138](https://insights.sbomify.com/CVE-2022-29138/): Windows Clustered Shared Volume Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29137](https://insights.sbomify.com/CVE-2022-29137/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29135](https://insights.sbomify.com/CVE-2022-29135/): Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29134](https://insights.sbomify.com/CVE-2022-29134/): Windows Clustered Shared Volume Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-29133](https://insights.sbomify.com/CVE-2022-29133/): Windows Kernel Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2022-29132](https://insights.sbomify.com/CVE-2022-29132/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-29131](https://insights.sbomify.com/CVE-2022-29131/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29130](https://insights.sbomify.com/CVE-2022-29130/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2022-2913](https://insights.sbomify.com/CVE-2022-2913/): Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass (medium 4.3)
- [CVE-2022-29129](https://insights.sbomify.com/CVE-2022-29129/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29128](https://insights.sbomify.com/CVE-2022-29128/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2022-29127](https://insights.sbomify.com/CVE-2022-29127/): BitLocker Security Feature Bypass Vulnerability (medium 4.2)
- [CVE-2022-29126](https://insights.sbomify.com/CVE-2022-29126/): Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29125](https://insights.sbomify.com/CVE-2022-29125/): Windows Push Notifications Apps Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2022-29123](https://insights.sbomify.com/CVE-2022-29123/): Windows Clustered Shared Volume Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-29122](https://insights.sbomify.com/CVE-2022-29122/): Windows Clustered Shared Volume Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-29121](https://insights.sbomify.com/CVE-2022-29121/): Windows WLAN AutoConfig Service Denial of Service Vulnerability (medium 6.5)
- [CVE-2022-29120](https://insights.sbomify.com/CVE-2022-29120/): Windows Clustered Shared Volume Information Disclosure Vulnerability (medium 6.5)
- [CVE-2022-2912](https://insights.sbomify.com/CVE-2022-2912/): Craw Data <= 1.0.0 - Server Side Request Forgery (medium 4.3)
- [CVE-2022-29119](https://insights.sbomify.com/CVE-2022-29119/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29117](https://insights.sbomify.com/CVE-2022-29117/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2022-29116](https://insights.sbomify.com/CVE-2022-29116/): Windows Kernel Information Disclosure Vulnerability (medium 4.7)
- [CVE-2022-29115](https://insights.sbomify.com/CVE-2022-29115/): Windows Fax Service Remote Code Execution Vulnerability (high 7.8)
- [CVE-2022-29114](https://insights.sbomify.com/CVE-2022-29114/): Windows Print Spooler Information Disclosure Vulnerability (medium 5.5)
- [CVE-2022-29113](https://insights.sbomify.com/CVE-2022-29113/): Windows Digital Media Receiver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2022-29112](https://insights.sbomify.com/CVE-2022-29112/): Windows Graphics Component Information Disclosure Vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/335/