CVEs published May 1, 2022
27 CVEs were published on May 1, 2022: 2 critical, 10 high.
- Published
- 27
- Critical
- 2
- High
- 10
- Medium
- 9
- Low
- 0
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- shopizer-ecommerce Shopizer
- 2
- angular
- 1
- com.alibaba.oneagent:one-java-agent-plugin
- 1
- com.bstek.ureport:ureport2-console
- 1
- com.google.code.gson:gson
- 1
- convict
- 1
- csv-safe
- 1
- dexie
- 1
- dset · org.webjars.npm:dset
- 1
- git-pull-or-clone
- 1
Critical 2
High 10
- CVE-2022-25301Prototype Pollutionjsgui-lang-essentials
- CVE-2022-22143Prototype Pollutionconvict
- CVE-2022-25647Deserialization of Untrusted Datacom.google.code.gson:gson
- CVE-2022-21167Arbitrary Code ExecutionMasuit.Tools.Core
- CVE-2022-23923Sandbox Bypassjailed
- CVE-2022-21189Prototype Pollutiondexie
- CVE-2022-21227Denial of Service (DoS)sqlite3
- CVE-2022-21144Denial of Service (DoS)libxmljs
- CVE-2022-25850Server-side Request Forgery (SSRF)github.com/hoppscotch/proxyscotch
- CVE-2022-1544Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpersluyadev/yii-helpers
Medium, low and unrated 15
- CVE-2022-29849In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privil
- CVE-2021-40822GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.org.geoserver:gs-main
- CVE-2022-28451nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.
- CVE-2021-31673A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inje
- CVE-2021-31674Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascr
- CVE-2022-21149Cross-site Scripting (XSS)s-cart/s-cart · s-cart/core
- CVE-2022-25645Prototype Pollutiondset · org.webjars.npm:dset
- CVE-2022-25349Cross-site Scripting (XSS)materialize-css
- CVE-2022-26068Path Traversalpistacheio/pistache
- CVE-2022-25842Arbitrary File Write via Archive Extraction (Zip Slip)com.alibaba.oneagent:one-java-agent-plugin
- CVE-2022-25844Regular Expression Denial of Service (ReDoS)angular
- CVE-2022-21230Information Exposureorg.nanohttpd:nanohttpd
- CVE-2022-28481CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.csv-safe
- CVE-2022-23061Shopizer - IDOR delete superadminshopizer-ecommerce Shopizer
- CVE-2022-23060Shopizer - Stored XSS in Manage Filesshopizer-ecommerce Shopizer