Skip to content
OpenAdvisories

Archive

1 May 2022

Vulnerabilities first published on this day (UTC), newest first.

← April 2022 2022 / May /1 June 2022 →
  1. 127
  2. 276
  3. 3109
  4. 480
  5. 5129
  6. 672
  7. 74
  8. 85
  9. 945
  10. 10196
  11. 11176
  12. 12159
  13. 1388
  14. 142
  15. 157
  16. 16101
  17. 17111
  18. 1878
  19. 1940
  20. 20107
  21. 218
  22. 221
  23. 2347
  24. 2481
  25. 2562
  26. 26157
  27. 2760
  28. 28 
  29. 295
  30. 3027
  31. 31115
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.5
    CVE-2021-40822 Public exploit Scanner template EPSS 19%

    GeoServer allows SSRF via the option for setting a proxy host

    GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

    org.geoserver:gs-main Maven
  • High 7.7
    CVE-2022-25301

    Prototype Pollution

    All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.

    jsgui-lang-essentials npm
  • High 7.5
    CVE-2022-22143

    Prototype Pollution

    The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-J…

    convict npm
  • High 7.7
    CVE-2022-25647 EPSS 12%

    Deserialization of Untrusted Data

    The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

    openjdk11 openjdk17 trino openjdk15 Debian Ubuntu Alpine Wolfi Maven
  • High 7.5
    CVE-2022-21167

    Arbitrary Code Execution

    All versions of package masuit.tools.core are vulnerable to Arbitrary Code Execution via the ReceiveVarData<T> function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it has bee…

    Masuit.Tools.Core NuGet
  • High 8.6
    CVE-2022-23923

    Sandbox Bypass

    All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.

    jailed npm
  • High 7.3
    CVE-2022-21189

    Prototype Pollution

    The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This ca…

    dexie npm
  • High 7.5
    CVE-2022-21227

    Denial of Service (DoS)

    The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.

    node-sqlite3 sqlite3 node-sqlite3 Debian Ubuntu npm
  • High 7.5
    CVE-2022-21144

    Denial of Service (DoS)

    This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will cr…

    libxmljs npm
  • High 7.5
    CVE-2022-25850

    Server-side Request Forgery (SSRF)

    The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads…

    github.com/hoppscotch/proxyscotch Go
  • High 8.0
    CVE-2022-1544

    Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in luyadev/yii-helpers

    Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remo…

    luyadev luyadev/yii-helpers luyadev/yii-helpers Packagist