# Vulnerabilities published in 2022


- [CVE-2022-23625](https://insights.sbomify.com/CVE-2022-23625/): DoS vulnerability: Malformed Resource Identifiers (medium 6.5)
- [CVE-2022-23624](https://insights.sbomify.com/CVE-2022-23624/): Validation bypass in frourio-express (high 8.1)
- [CVE-2022-23623](https://insights.sbomify.com/CVE-2022-23623/): Validation bypass in frourio (high 8.1)
- [CVE-2022-23622](https://insights.sbomify.com/CVE-2022-23622/): Cross site scripting in registration template in xwiki-platform (high 7.4)
- [CVE-2022-23621](https://insights.sbomify.com/CVE-2022-23621/): Missing authorization in xwiki-platform (medium 5.5)
- [CVE-2022-23620](https://insights.sbomify.com/CVE-2022-23620/): Path traversal in xwiki-platform-skin-skinx (medium 6.8)
- [CVE-2022-2362](https://insights.sbomify.com/CVE-2022-2362/): Download Manager < 3.2.50 - Bypass IP Address Blocking Restriction (high 7.5)
- [CVE-2022-23619](https://insights.sbomify.com/CVE-2022-23619/): Information exposure in xwiki-platform (medium 5.3)
- [CVE-2022-23618](https://insights.sbomify.com/CVE-2022-23618/): Open Redirect in xwiki-platform (medium 4.7)
- [CVE-2022-23617](https://insights.sbomify.com/CVE-2022-23617/): Missing authorization in xwiki-platform (medium 6.5)
- [CVE-2022-23616](https://insights.sbomify.com/CVE-2022-23616/): Remote code execution in xwiki-platform (high 8.8)
- [CVE-2022-23615](https://insights.sbomify.com/CVE-2022-23615/): Partial authorization bypass on document save in xwiki-platform (medium 5.4)
- [CVE-2022-23614](https://insights.sbomify.com/CVE-2022-23614/): Code injection in Twig (high 8.8)
- [CVE-2022-23613](https://insights.sbomify.com/CVE-2022-23613/): Privilege escalation on xrdp (high 7.8)
- [CVE-2022-23612](https://insights.sbomify.com/CVE-2022-23612/): Directory Traversal in OpenMRS Startup Filter (high 7.5)
- [CVE-2022-23611](https://insights.sbomify.com/CVE-2022-23611/): OS command injection in iTunesRPC-Remastered (high 8.1)
- [CVE-2022-23610](https://insights.sbomify.com/CVE-2022-23610/): Improper Verification of Cryptographic Signature in wire-server (critical 9.1)
- [CVE-2022-2361](https://insights.sbomify.com/CVE-2022-2361/): Social Chat < 6.0.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2022-23609](https://insights.sbomify.com/CVE-2022-23609/): Path traveresal in iTunesRPC-Remastered (high 8.3)
- [CVE-2022-23608](https://insights.sbomify.com/CVE-2022-23608/): Use after free in PJSIP (high 8.1)
- [CVE-2022-23607](https://insights.sbomify.com/CVE-2022-23607/): Unsafe handling of user-specified cookies in treq (medium 6.5)
- [CVE-2022-23606](https://insights.sbomify.com/CVE-2022-23606/): Crash when a cluster is deleted in Envoy (medium 4.4)
- [CVE-2022-23605](https://insights.sbomify.com/CVE-2022-23605/): Expired Ephemeral Messages not reliably removed in wire-webapp (medium 4.4)
- [CVE-2022-23604](https://insights.sbomify.com/CVE-2022-23604/): Privilege escalation in Defender (high 8.8)
- [CVE-2022-23603](https://insights.sbomify.com/CVE-2022-23603/): Code injection in iTunesRPC-Remastered (critical 9.9)
- [CVE-2022-23602](https://insights.sbomify.com/CVE-2022-23602/): Nim's rst parser sandboxed mode allows include which can embed any local file (high 7.7)
- [CVE-2022-23601](https://insights.sbomify.com/CVE-2022-23601/): CSRF token missing in Symfony (high 8.1)
- [CVE-2022-23600](https://insights.sbomify.com/CVE-2022-23600/): Limited ability to spoof SAML authentication with missing audience verification (medium 5.3)
- [CVE-2022-23599](https://insights.sbomify.com/CVE-2022-23599/): Cross-site Scripting and Open Redirect in Products.ATContentTypes (medium 4.3)
- [CVE-2022-23598](https://insights.sbomify.com/CVE-2022-23598/): Reflected XSS vulnerability when rendering error messages in laminas-form (medium 6.1)
- [CVE-2022-23597](https://insights.sbomify.com/CVE-2022-23597/): Remote program execution with user interaction (high 8.3)
- [CVE-2022-23596](https://insights.sbomify.com/CVE-2022-23596/): Infinite loop in junrar (high 7.5)
- [CVE-2022-23595](https://insights.sbomify.com/CVE-2022-23595/): Null pointer dereference in TensorFlow (medium 5.3)
- [CVE-2022-23594](https://insights.sbomify.com/CVE-2022-23594/): Out of bounds read in Tensorflow (high 8.8)
- [CVE-2022-23593](https://insights.sbomify.com/CVE-2022-23593/): Segfault in `simplifyBroadcast` in Tensorflow (medium 5.9)
- [CVE-2022-23592](https://insights.sbomify.com/CVE-2022-23592/): Out of bounds read in Tensorflow (high 8.1)
- [CVE-2022-23591](https://insights.sbomify.com/CVE-2022-23591/): Stack overflow in Tensorflow (high 7.5)
- [CVE-2022-23590](https://insights.sbomify.com/CVE-2022-23590/): Crash due to erroneous `StatusOr` in Tensorflow (medium 5.9)
- [CVE-2022-23589](https://insights.sbomify.com/CVE-2022-23589/): Null pointer dereference in Grappler's `IsConstant` in Tensorflow (medium 6.5)
- [CVE-2022-23588](https://insights.sbomify.com/CVE-2022-23588/): `CHECK`-fails due to attempting to build a reference tensor in Tensorflow (medium 6.5)
- [CVE-2022-23587](https://insights.sbomify.com/CVE-2022-23587/): Integer overflow in Tensorflow (high 8.8)
- [CVE-2022-23586](https://insights.sbomify.com/CVE-2022-23586/): Multiple `CHECK`-fails in `function.cc` in Tensorflow (medium 6.5)
- [CVE-2022-23585](https://insights.sbomify.com/CVE-2022-23585/): Memory leak in decoding PNG images in Tensorflow (medium 4.3)
- [CVE-2022-23584](https://insights.sbomify.com/CVE-2022-23584/): Use after free in `DecodePng` in Tensorflow (high 7.6)
- [CVE-2022-23583](https://insights.sbomify.com/CVE-2022-23583/): `CHECK`-failures in binary ops in Tensorflow (medium 6.5)
- [CVE-2022-23582](https://insights.sbomify.com/CVE-2022-23582/): `CHECK`-failures in `TensorByteSize` in Tensorflow (medium 6.5)
- [CVE-2022-23581](https://insights.sbomify.com/CVE-2022-23581/): `CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow (medium 6.5)
- [CVE-2022-23580](https://insights.sbomify.com/CVE-2022-23580/): Abort caused by allocating a vector that is too large in Tensorflow (medium 6.5)
- [CVE-2022-23579](https://insights.sbomify.com/CVE-2022-23579/): `CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow (medium 6.5)
- [CVE-2022-23578](https://insights.sbomify.com/CVE-2022-23578/): Memory leak in Tensorflow (medium 4.3)
- [CVE-2022-23577](https://insights.sbomify.com/CVE-2022-23577/): Null-dereference in Tensorflow (medium 6.5)
- [CVE-2022-23576](https://insights.sbomify.com/CVE-2022-23576/): Integer overflow in Tensorflow (medium 6.5)
- [CVE-2022-23575](https://insights.sbomify.com/CVE-2022-23575/): Integer overflow in Tensorflow (medium 6.5)
- [CVE-2022-23574](https://insights.sbomify.com/CVE-2022-23574/): Out of bounds read and write in Tensorflow (high 8.8)
- [CVE-2022-23573](https://insights.sbomify.com/CVE-2022-23573/): Uninitialized variable access in Tensorflow (high 7.6)
- [CVE-2022-23572](https://insights.sbomify.com/CVE-2022-23572/): Crash when type cannot be specialized in Tensorflow (medium 6.5)
- [CVE-2022-23571](https://insights.sbomify.com/CVE-2022-23571/): Reachable Assertion in Tensorflow (medium 6.5)
- [CVE-2022-23570](https://insights.sbomify.com/CVE-2022-23570/): Null-dereference in Tensorflow (medium 6.5)
- [CVE-2022-2357](https://insights.sbomify.com/CVE-2022-2357/): WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download (high 7.5)
- [CVE-2022-23569](https://insights.sbomify.com/CVE-2022-23569/): `CHECK`-fails when building invalid tensor shapes in Tensorflow (medium 6.5)
- [CVE-2022-23568](https://insights.sbomify.com/CVE-2022-23568/): Integer overflows in Tensorflow (medium 6.5)
- [CVE-2022-23567](https://insights.sbomify.com/CVE-2022-23567/): Integer overflows in Tensorflow (medium 6.5)
- [CVE-2022-23566](https://insights.sbomify.com/CVE-2022-23566/): Out of bounds write in Tensorflow (high 8.8)
- [CVE-2022-23565](https://insights.sbomify.com/CVE-2022-23565/): `CHECK`-failures in Tensorflow (medium 6.5)
- [CVE-2022-23564](https://insights.sbomify.com/CVE-2022-23564/): Reachable Assertion in Tensorflow (medium 6.5)
- [CVE-2022-23563](https://insights.sbomify.com/CVE-2022-23563/): Insecure temporary file in Tensorflow (high 7.1)
- [CVE-2022-23562](https://insights.sbomify.com/CVE-2022-23562/): Integer overflow in Tensorflow (high 7.6)
- [CVE-2022-23561](https://insights.sbomify.com/CVE-2022-23561/): Out of bounds write in TFLite (high 8.8)
- [CVE-2022-23560](https://insights.sbomify.com/CVE-2022-23560/): Read and Write outside of bounds in TFLite (high 8.8)
- [CVE-2022-2356](https://insights.sbomify.com/CVE-2022-2356/): User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload (medium 6.5)
- [CVE-2022-23559](https://insights.sbomify.com/CVE-2022-23559/): Integer overflow in TFLite (high 8.8)
- [CVE-2022-23558](https://insights.sbomify.com/CVE-2022-23558/): Integer overflow in TFLite array creation (high 7.6)
- [CVE-2022-23557](https://insights.sbomify.com/CVE-2022-23557/): Division by zero in TFLite (medium 6.5)
- [CVE-2022-23556](https://insights.sbomify.com/CVE-2022-23556/): CodeIgniter is vulnerable to IP address spoofing when using proxy (high 7.0)
- [CVE-2022-23555](https://insights.sbomify.com/CVE-2022-23555/): authentik vulnerable to Improper Authentication via invitation URL token reuse (critical 9.4)
- [CVE-2022-23554](https://insights.sbomify.com/CVE-2022-23554/): Authentication bypass in Alpine (medium 6.5)
- [CVE-2022-23553](https://insights.sbomify.com/CVE-2022-23553/): URL access filters bypass in Alpine (high 7.5)
- [CVE-2022-23552](https://insights.sbomify.com/CVE-2022-23552/): Grafana stored XSS in FileUploader component (high 7.3)
- [CVE-2022-23551](https://insights.sbomify.com/CVE-2022-23551/): AAD Pod Identity obtaining token with backslash (medium 5.3)
- [CVE-2022-2355](https://insights.sbomify.com/CVE-2022-2355/): Easy Username Updater < 1.0.5 - Arbitrary Username Update via CSRF (medium 5.7)
- [CVE-2022-23549](https://insights.sbomify.com/CVE-2022-23549/): Discourse vulnerable to bypass of post max_length using HTML comments (medium 5.7)
- [CVE-2022-23548](https://insights.sbomify.com/CVE-2022-23548/): Denial of service in discourse (medium 6.5)
- [CVE-2022-23547](https://insights.sbomify.com/CVE-2022-23547/): Heap buffer overflow in pjproject when decoding STUN message (medium 6.5)
- [CVE-2022-23546](https://insights.sbomify.com/CVE-2022-23546/): Discourse vulnerable to private topic leak via email#send_digest (medium 5.5)
- [CVE-2022-23544](https://insights.sbomify.com/CVE-2022-23544/): Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting (high 7.2)
- [CVE-2022-23543](https://insights.sbomify.com/CVE-2022-23543/): HTML attributes when attaching a YouTube link to the post (medium 6.3)
- [CVE-2022-23542](https://insights.sbomify.com/CVE-2022-23542/): OpenFGA Authorization Bypass (high 7.7)
- [CVE-2022-23541](https://insights.sbomify.com/CVE-2022-23541/): jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC (medium 5.0)
- [CVE-2022-23540](https://insights.sbomify.com/CVE-2022-23540/): jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() (medium 6.4)
- [CVE-2022-2354](https://insights.sbomify.com/CVE-2022-2354/): WP-DBManager < 2.80.8 - Admin+ Remote Command Execution (high 7.2)
- [CVE-2022-23539](https://insights.sbomify.com/CVE-2022-23539/): jsonwebtoken unrestricted key type could lead to legacy keys usage (medium 5.9)
- [CVE-2022-23538](https://insights.sbomify.com/CVE-2022-23538/): User credentials leaked to third-party service via HTTP redirect in scs-library-client (medium 5.2)
- [CVE-2022-23537](https://insights.sbomify.com/CVE-2022-23537/): PJSIP vulnerable to heap buffer overflow when decoding STUN message (medium 6.5)
- [CVE-2022-23536](https://insights.sbomify.com/CVE-2022-23536/): Alertmanager can expose local files content via specially crafted config (medium 6.5)
- [CVE-2022-23535](https://insights.sbomify.com/CVE-2022-23535/): LiteDB contains Deserialization of Untrusted Data (high 7.3)
- [CVE-2022-23532](https://insights.sbomify.com/CVE-2022-23532/): neo4j-apoc-procedures is vulnerable to path traversal (high 7.1)
- [CVE-2022-23531](https://insights.sbomify.com/CVE-2022-23531/): Arbitrary file write when scanning a specially-crafted local PyPI package (medium 5.8)
- [CVE-2022-23530](https://insights.sbomify.com/CVE-2022-23530/): GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package (medium 5.8)
- [CVE-2022-2353](https://insights.sbomify.com/CVE-2022-2353/): Cross-Site Request Forgery (CSRF) in microweber/microweber (medium 6.3)
- [CVE-2022-23527](https://insights.sbomify.com/CVE-2022-23527/): Open Redirect in oidc_validate_redirect_url() (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/381/