Week 3, 2022
17–23 January 2022
Newly exploited 17
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
- Critical 9.8 EPSS 76%
-
High 7.8
CVE-2018-8453 KEV Jan 21, 2022 · ransomware An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 70%
Microsoft · Windows Server 2019 · Windows Server 2016 · Windows Server 2012 R2
- High 7.5 EPSS 55%
- Medium 4.3 EPSS 3.6%
-
Critical 9.8
CVE-2021-40870 KEV Jan 18, 2022 An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unaut…EPSS 93%
-
Critical 9.8
CVE-2021-21975 KEV Jan 18, 2022 · ransomware Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Op…EPSS 78%
-
Critical 9.8
CVE-2021-22991 KEV Jan 18, 2022 On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed reques…EPSS 62%
- Critical 9.8 EPSS 100%
-
High 8.8
CVE-2021-25296 KEV Jan 18, 2022 Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi…EPSS 72%
-
High 8.8
CVE-2021-25297 KEV Jan 18, 2022 Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/swi…EPSS 57%
- High 8.8 EPSS 31%
- High 8.8 EPSS 99%
-
High 8.8
CVE-2021-25298 KEV Jan 18, 2022 Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/c…EPSS 74%
- High 8.2 EPSS 91%
-
High 7.5
CVE-2020-14864 KEV Jan 18, 2022 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are…EPSS 97%
-
High 7.3
CVE-2021-33766 KEV Jan 18, 2022 Microsoft Exchange Server Information Disclosure VulnerabilityEPSS 98%
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 8 · Microsoft Exchange Server 2016 Cumulative Update 19
- High 7.1 EPSS 91%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-35587 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0,…EPSS 96%
- Critical 9.8 EPSS 67%
- Critical 9.8 EPSS 65%
- Critical 9.8 EPSS 24%
-
Critical 9.8
CVE-2021-35003 This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 rel.73164(5553) route…EPSS 7.7%
-
Critical 9.8
CVE-2022-21306 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.…EPSS 4.4%
- Critical 9.8 EPSS 2.6%
-
Critical 10.0
CVE-2022-21390 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Webservices Manager). Suppo…EPSS 2.4%
-
Critical 10.0
CVE-2022-21389 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor…EPSS 1.9%
-
Critical 10.0
CVE-2022-21275 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor…EPSS 1.9%
- Critical 9.8 EPSS 1.8%
-
Critical 9.9
CVE-2022-21391 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor…EPSS 1.2%
-
Critical 9.9
CVE-2021-35683 Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported version that is affected is Prior…EPSS 1.2%
-
Critical 9.9
CVE-2022-21276 Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor…EPSS 1.2%
- Critical 10.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2022-21371 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0…EPSS 93%
-
Medium 6.3
CVE-2022-21279 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and…EPSS 79%
-
Medium 6.3
CVE-2022-21280 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.34 and prior, 7.5.24 and…EPSS 77%
- High 8.8 EPSS 64%
-
High 8.8
CVE-2022-23307 A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.EPSS 54%
-
Unscored
CVE-2022-22733 Access-Token in ElasticJob UI causes password disclosureEPSS 38%
Apache Software Foundation · Apache ShardingSphere ElasticJob-UI
-
Unscored
CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-map…EPSS 25%
-
Unscored
CVE-2021-44757 Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive in…EPSS 24%
Advisories
- SUSE / openSUSE Security Updates 588 critical
- Debian Security (DSA / DLA) 182 critical
- Ubuntu Security Notices (USN) 153 critical
- Amazon Linux Security Center (ALAS) 10
- BSI CERT-Bund (WID) 10
- Oracle Linux Security Advisories (ELSA) 8
- Rocky Linux Security Advisories 5
- AlmaLinux Security Advisories 4
- CISA ICS & IT advisories 11 critical
- CERT@VDE 11 critical
- SUSE-SU-2022:0142-1 Security update for webkit2gtk3 71 CVEs
- USN-5248-1 thunderbird vulnerabilities 44 CVEs
- SUSE-SU-2022:0137-1 Security update for MozillaFirefox 14 CVEs
- SUSE-SU-2022:0136-1 Security update for MozillaFirefox 14 CVEs
- openSUSE-SU-2022:0136-1 Security update for MozillaFirefox 14 CVEs
- SUSE-SU-2022:0115-1 Security update for MozillaFirefox 14 CVEs
- USN-5227-2 pillow vulnerabilities 5 CVEs
- ICSA-22-020-01 Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric HMI SCADA (Update B) 4 CVEs
- DLA-2893-1 pillow - security update 3 CVEs
- DSA-5053-1 pillow - security update 3 CVEs