# CVEs published 2022-05-01

27 CVEs were published on May 1, 2022: 2 critical, 10 high. Days are UTC.

- [CVE-2022-29849](https://cve.now/CVE-2022-29849.md): In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privil (no CVSS)
- [CVE-2021-40822](https://cve.now/CVE-2021-40822.md): GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host. (no CVSS, org.geoserver:gs-main)
- [CVE-2022-28451](https://cve.now/CVE-2022-28451.md): nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature. (no CVSS)
- [CVE-2021-31673](https://cve.now/CVE-2021-31673.md): A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inje (no CVSS)
- [CVE-2021-31674](https://cve.now/CVE-2021-31674.md): Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascr (no CVSS)
- [CVE-2022-25301](https://cve.now/CVE-2022-25301.md): Prototype Pollution (CVSS 7.7, jsgui-lang-essentials)
- [CVE-2022-21149](https://cve.now/CVE-2022-21149.md): Cross-site Scripting (XSS) (CVSS 5.4, s-cart/s-cart · s-cart/core)
- [CVE-2022-22143](https://cve.now/CVE-2022-22143.md): Prototype Pollution (CVSS 7.5, convict)
- [CVE-2022-25645](https://cve.now/CVE-2022-25645.md): Prototype Pollution (CVSS 6.5, dset · org.webjars.npm:dset)
- [CVE-2022-25767](https://cve.now/CVE-2022-25767.md): Remote Code Execution (CVSS 9.8, com.bstek.ureport:ureport2-console)
- [CVE-2022-25647](https://cve.now/CVE-2022-25647.md): Deserialization of Untrusted Data (CVSS 7.7, com.google.code.gson:gson)
- [CVE-2022-25349](https://cve.now/CVE-2022-25349.md): Cross-site Scripting (XSS) (CVSS 5.4, materialize-css)
- [CVE-2022-21167](https://cve.now/CVE-2022-21167.md): Arbitrary Code Execution (CVSS 7.5, Masuit.Tools.Core)
- [CVE-2022-26068](https://cve.now/CVE-2022-26068.md): Path Traversal (CVSS 6.5, pistacheio/pistache)
- [CVE-2022-25842](https://cve.now/CVE-2022-25842.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 6.9, com.alibaba.oneagent:one-java-agent-plugin)
- [CVE-2022-25844](https://cve.now/CVE-2022-25844.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, angular)
- [CVE-2022-23923](https://cve.now/CVE-2022-23923.md): Sandbox Bypass (CVSS 8.6, jailed)
- [CVE-2022-21189](https://cve.now/CVE-2022-21189.md): Prototype Pollution (CVSS 7.3, dexie)
- [CVE-2022-21227](https://cve.now/CVE-2022-21227.md): Denial of Service (DoS) (CVSS 7.5, sqlite3)
- [CVE-2022-21144](https://cve.now/CVE-2022-21144.md): Denial of Service (DoS) (CVSS 7.5, libxmljs)
- [CVE-2022-21230](https://cve.now/CVE-2022-21230.md): Information Exposure (CVSS 5.5, org.nanohttpd:nanohttpd)
- [CVE-2022-24437](https://cve.now/CVE-2022-24437.md): Command Injection (CVSS 9.8, git-pull-or-clone)
- [CVE-2022-25850](https://cve.now/CVE-2022-25850.md): Server-side Request Forgery (SSRF) (CVSS 7.5, github.com/hoppscotch/proxyscotch)
- [CVE-2022-28481](https://cve.now/CVE-2022-28481.md): CSV-Safe gem \< 3.0.0 doesn't filter out special characters which could trigger CSV Injection. (no CVSS, csv-safe)
- [CVE-2022-23061](https://cve.now/CVE-2022-23061.md): Shopizer - IDOR delete superadmin (CVSS 6.5, shopizer-ecommerce Shopizer)
- [CVE-2022-23060](https://cve.now/CVE-2022-23060.md): Shopizer - Stored XSS in Manage Files (CVSS 4.8, shopizer-ecommerce Shopizer)
- [CVE-2022-1544](https://cve.now/CVE-2022-1544.md): Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers (CVSS 8.0, luyadev/yii-helpers)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.