Week 2, 2022

10–16 January 2022

New CVEs: 574
Critical: 29
High: 221
Newly exploited: 15
Advisories: 219
Malicious pkgs: 0

Newly exploited 15

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2021-27860 KEV Jan 10, 2022 Arbitrary file upload vulnerability in FatPipe software
FatPipe · WARP · MPVPN · IPVPN

EPSS 40%
Critical 9.8
CVE-2019-7609 KEV Jan 10, 2022 Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion applicatio…
Elastic · Kibana

EPSS 95%
Critical 9.8
CVE-2019-9670 KEV Jan 10, 2022 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au…
EPSS 100%
Critical 9.8
CVE-2015-7450 KEV Jan 10, 2022 Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers …
EPSS 98%
Critical 9.8
CVE-2021-36260 KEV Jan 10, 2022 A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability…
EPSS 100%
Critical 9.8
CVE-2017-1000486 KEV Jan 10, 2022 Inadequate Encryption Strength
EPSS 94%
Critical 9.1
CVE-2018-13382 KEV Jan 10, 2022 · ransomware An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1…
Fortinet · Fortinet FortiOS, FortiProxy

EPSS 82%
Critical 9.0
CVE-2019-10149 KEV Jan 10, 2022 A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead t…
Exim · Exim

EPSS 100%
High 8.8
CVE-2020-6572 KEV Jan 10, 2022 Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Google · Chrome

EPSS 11%
High 8.1
CVE-2019-1579 KEV Jan 10, 2022 · ransomware Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gatew…
EPSS 44%
High 7.8
CVE-2019-1458 KEV Jan 10, 2022 · ransomware An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…
Microsoft · Windows · Windows Server

EPSS 74%
High 7.5
CVE-2019-2725 KEV Jan 10, 2022 · ransomware Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6…
Oracle · Tape Library ACSLS

EPSS 100%
Medium 5.5
CVE-2013-3900 KEV Jan 10, 2022 WinVerifyTrust Signature Validation Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 45%
Medium 5.3
CVE-2021-22017 KEV Jan 10, 2022 Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port…
EPSS 49%
Medium 4.3
CVE-2018-13383 KEV Jan 10, 2022 · ransomware A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and …
Fortinet · Fortinet FortiOS and FortiProxy

EPSS 31%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2022-23131 Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
Zabbix · Frontend

EPSS 96%
Critical 9.8
CVE-2022-21907 HTTP Protocol Stack Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 93%
Critical 9.8
CVE-2022-23227 NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lac…
EPSS 48%
Critical 9.8
CVE-2021-43297 Dubbo Hessian cause RCE when parse error
Apache Software Foundation · Apache Dubbo

EPSS 17%
Critical 9.8
CVE-2022-21849 Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 6.6%
Critical 9.8
CVE-2021-34993 This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to…
Commvault · CommCell

EPSS 5.8%
Critical 9.8
CVE-2022-23218 The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack w…
EPSS 5.7%
Critical 9.8
CVE-2022-23219 The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack …
EPSS 5%
Critical 9.8
CVE-2021-40722 AEM Forms Improper Restriction of XML External Entity Reference
Adobe · Experience Manager

EPSS 3.4%
Critical 9.9
CVE-2022-21675 Bytecode Viewer v2.10.x Zip Slip
Konloch · bytecode-viewer

EPSS 3.2%
Critical 9.8
CVE-2022-22055 Le-yan Co., Ltd. dental management system - SQL Injection
Le-yan · Dental Management System

EPSS 2.5%
Critical 9.8
CVE-2022-22056 Le-yan Co., Ltd. dental management system - Hard-coded Credentials
Le-yan · Dental Management System

EPSS 2.3%
Critical 9.1
CVE-2021-28506 An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a f…
Arista Networks · EOS

EPSS 1.5%
Critical 9.6
CVE-2022-20658 Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability
Cisco · Cisco Unified Contact Center Domain Manager

EPSS 1.4%
Critical 9.8
CVE-2022-22989 Pre-authenticated stack overflow vulnerability on FTP Service
Western Digital · My Cloud

EPSS 1.4%

All 29 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Low 3.7
CVE-2022-23134 Possible view of the setup pages by unauthenticated users if config file already exists
Zabbix · Frontend

EPSS 95%
High 8.8
CVE-2021-34996 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi…
Commvault · CommCell

EPSS 82%
Medium 5.4
CVE-2022-20615 Stored XSS vulnerability in Matrix Project Plugin
Jenkins Project · Jenkins Matrix Project Plugin

EPSS 82%
Unscored
CVE-2022-23178 An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, u…
EPSS 75%
Unscored
CVE-2021-24862 RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection
EPSS 73%
High 8.8
CVE-2021-34995 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi…
Commvault · CommCell

EPSS 69%
High 7.0
CVE-2022-21882 Win32k Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 59%
High 7.8
CVE-2021-44703 Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code execution
Adobe · Acrobat Reader

EPSS 58%

Advisories

DSA-5046-1 chromium - security update 123 CVEs
USN-5229-1 firefox vulnerabilities 13 CVEs
DLA-2880-1 firefox-esr - security update 12 CVEs
DLA-2881-1 thunderbird - security update 12 CVEs
DSA-5045-1 thunderbird - security update 12 CVEs
DSA-5044-1 firefox-esr - security update 12 CVEs
SEVD-2022-011-06 CODESYS V3 Runtime, Development System, and Gateway Vulnerabilities 9 CVEs
VDE-2021-059 PHOENIX CONTACT: BLUEMARK X1 / LED / CLED printers utilizing the Siemens Nucleus RTOS TCP/IP Stack 8 CVEs
USN-5227-1 pillow vulnerabilities 5 CVEs
WID-SEC-2022-1220 GNU libc: Mehrere Schwachstellen ermöglichen Codeausführung und Denial of Service 2 CVEs