Week 1, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2021-42392 RCE in H2 Console

  h2database · h2

  EPSS 83%
• Critical 9.9
  CVE-2021-43779 Remote Command Execution vulnerability

  pluginsGLPI · addressing

  EPSS 9.1%
• Critical 9.8
  CVE-2022-22822 addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
  EPSS 5.5%
• Critical 9.8
  CVE-2021-30351 An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Comput…

  Qualcomm · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wear

  EPSS 4%
• Critical 9.8
  CVE-2022-22823 build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
  EPSS 3.9%
• Critical 9.8
  CVE-2022-22824 defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
  EPSS 3.9%
• Critical 9.1
  CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks

  Apache Software Foundation · Apache James

  EPSS 3.8%
• Critical 9.8
  CVE-2022-22817 Arbitrary expression injection in Pillow
  EPSS 3.6%
• Critical 10.0
  CVE-2021-43832 Improper Access Control in spinnaker

  spinnaker · spinnaker

  EPSS 2.7%
• Critical 9.8
  CVE-2021-25981 Talkyard - Insufficient Session Expiration

  debiki · talkyard

  EPSS 2.5%
• Critical 9.8
  CVE-2021-23543 Sandbox Bypass
  EPSS 1.8%
• Critical 9.8
  CVE-2021-23594 Sandbox Bypass
  EPSS 1.8%
• Critical 9.8
  CVE-2021-24042 The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Bu…

  Facebook · WhatsApp for Android · WhatsApp Business for Android · WhatsApp for iOS

  EPSS 1.3%
• Critical 10.0
  CVE-2022-21643 SQL Injection in USOC

  Aaron-Junker · USOC

  EPSS 1.2%
• Critical 9.1
  CVE-2022-21644 SQL Injection via search in USOC

  Aaron-Junker · USOC

  EPSS 1.1%

All 20 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.0
  CVE-2022-21661 SQL injection in WordPress

  WordPress · wordpress-develop

  EPSS 98%
• Medium
  CVE-2021-45456 Command injection

  Apache Software Foundation · Apache Kylin

  EPSS 89%
• High 8.0
  CVE-2022-21662 Stored XSS in WordPress

  WordPress · wordpress-develop

  EPSS 65%
• Unscored
  CVE-2021-45428 TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CG…
  EPSS 57%
• Unscored
  CVE-2021-43942 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (…

  Atlassian · Jira Server · Jira Data Center

  EPSS 55%
• Unscored
  CVE-2021-43711 The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter n…
  EPSS 38%
• High 7.7
  CVE-2022-21647 Deserialization of Untrusted Data in Codeigniter4

  codeigniter4 · CodeIgniter4

  EPSS 38%
• Unscored
  CVE-2021-31589 A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which al…
  EPSS 26%