# CVEs published 2022-01-01 10 CVEs were published on January 1, 2022: 0 critical, 2 high. Days are UTC. - [CVE-2022-22293](https://cve.now/CVE-2022-22293.md): admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN\_MAX\_DECIMALS\_TOT parameter. (no CVSS, dolibarr/dolibarr) - [CVE-2021-44896](https://cve.now/CVE-2021-44896.md): DMP Roadmap before 3.0.4 allows XSS. (no CVSS) - [CVE-2021-45972](https://cve.now/CVE-2021-45972.md): The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount (no CVSS) - [CVE-2021-45960](https://cve.now/CVE-2021-45960.md): In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbeh (CVSS 8.8) - [CVE-2021-44852](https://cve.now/CVE-2021-44852.md): An issue was discovered in BS\_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. (no CVSS) - [CVE-2021-43333](https://cve.now/CVE-2021-43333.md): The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of confi (no CVSS) - [CVE-2021-41817](https://cve.now/CVE-2021-41817.md): Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. (no CVSS, date) - [CVE-2021-41819](https://cve.now/CVE-2021-41819.md): CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. (CVSS 7.5, cgi) - [CVE-2021-44716](https://cve.now/CVE-2021-44716.md): net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/ (no CVSS, stdlib ยท golang.org/x/net +1) - [CVE-2021-44717](https://cve.now/CVE-2021-44717.md): Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a conse (no CVSS, stdlib) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-01-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.