# CVEs published 2022-05-21

8 CVEs were published on May 21, 2022: 1 critical, 2 high. Days are UTC.

- [CVE-2022-1809](https://cve.now/CVE-2022-1809.md): Access of Uninitialized Pointer in radareorg/radare2 (CVSS 7.4, radareorg/radare2)
- [CVE-2022-31267](https://cve.now/CVE-2022-31267.md): Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an (no CVSS, com.gitblit:gitblit)
- [CVE-2022-31268](https://cve.now/CVE-2022-31268.md): A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-I (no CVSS, com.gitblit:gitblit)
- [CVE-2022-31264](https://cve.now/CVE-2022-31264.md): Solana solana\_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. (no CVSS, solana\_rbpf)
- [CVE-2022-1752](https://cve.now/CVE-2022-1752.md): Unrestricted Upload of File with Dangerous Type in polonel/trudesk (CVSS 9.0, polonel/trudesk)
- [CVE-2022-29215](https://cve.now/CVE-2022-29215.md): Argument Injection in RegionProtect (CVSS 7.5, kaidomc-pm-pl RegionProtect)
- [CVE-2022-29222](https://cve.now/CVE-2022-29222.md): Improper Certificate Validation in Pion DTLS (CVSS 5.9, pion dtls · github.com/pion/dtls +1)
- [CVE-2022-31259](https://cve.now/CVE-2022-31259.md): The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. (no CVSS, github.com/beego/beego/v2 · github.com/beego/beego +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.