Skip to content
OpenAdvisories

Archive

1 May 2022

Vulnerabilities first published on this day (UTC), newest first.

← April 2022 2022 / May /1 June 2022 →
  1. 127
  2. 276
  3. 3109
  4. 480
  5. 5129
  6. 672
  7. 74
  8. 85
  9. 945
  10. 10196
  11. 11176
  12. 12159
  13. 1388
  14. 142
  15. 157
  16. 16101
  17. 17111
  18. 1878
  19. 1940
  20. 20107
  21. 218
  22. 221
  23. 2347
  24. 2481
  25. 2562
  26. 26157
  27. 2760
  28. 28 
  29. 295
  30. 3027
  31. 31115
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-21149

    Cross-site Scripting (XSS)

    The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's acco…

    s-cart/s-cart s-cart/core Packagist
  • Medium 6.5
    CVE-2022-25645

    Prototype Pollution

    All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it …

    dset org.webjars.npm:dset npm Maven
  • Medium 5.4
    CVE-2022-25349

    Cross-site Scripting (XSS)

    All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerabil…

    materialize-css npm
  • Medium 6.5
    CVE-2022-26068

    Path Traversal

    This affects the package pistacheio/pistache before 0.0.3.20220425. It is possible to traverse directories to fetch arbitrary files from the server.

  • Medium 6.9
    CVE-2022-25842 Public exploit

    Arbitrary File Write via Archive Extraction (Zip Slip)

    All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can over…

    com.alibaba.oneagent:one-java-agent-plugin Maven
  • Medium 5.3
    CVE-2022-25844

    Regular Expression Denial of Service (ReDoS)

    The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value…

    angular.js angular.js angular Debian Ubuntu npm
  • Medium 5.5
    CVE-2022-21230

    Information Exposure

    This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure p…

  • Medium 6.5
    CVE-2022-23061

    Shopizer - IDOR delete superadmin

    In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

    shopizer-ecommerce Shopizer
  • Medium 4.8
    CVE-2022-23060

    Shopizer - Stored XSS in Manage Files

    A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab

    shopizer-ecommerce Shopizer