Week 5, 2022
31 January – 6 February 2022
Newly exploited 1
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
High 7.0
CVE-2022-21882 KEV Feb 4, 2022 · ransomware Win32k Elevation of Privilege VulnerabilityEPSS 59%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 4.9%
-
Critical 10.0
CVE-2021-21961 A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network pac…EPSS 2.6%
-
Critical 10.0
CVE-2021-21960 A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted netwo…EPSS 2.6%
- Critical 9.1 EPSS 2.2%
-
Critical 9.0
CVE-2021-21962 A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of spe…EPSS 2%
-
Critical 9.8
CVE-2021-39070 IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authentic…EPSS 1.8%
-
Critical 9.3
CVE-2022-21817 NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can get user t…EPSS 1.7%
- Critical 9.4 EPSS 1.6%
-
Critical 10.0
CVE-2021-40401 A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2…EPSS 1.3%
- Critical 9.8 EPSS 1.3%
- Critical 9.8 EPSS 1.2%
- Critical 9.9
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Unscored EPSS 87%
- High 8.3 EPSS 66%
-
Unscored
CVE-2022-24223 AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.EPSS 62%
-
Unscored
CVE-2022-24260 A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.EPSS 50%
- High 7.5 EPSS 50%
-
Unscored
CVE-2021-34805 An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau file on the operating system without pr…EPSS 25%
-
Unscored
CVE-2022-23357 mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir.EPSS 20%
-
Unscored
CVE-2022-24144 Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows attackers …EPSS 19%
Advisories
- SUSE / openSUSE Security Updates 452 critical
- AlmaLinux Security Advisories 241 critical
- BSI CERT-Bund (WID) 201 critical
- Ubuntu Security Notices (USN) 17
- Debian Security (DSA / DLA) 113 critical
- Oracle Linux Security Advisories (ELSA) 102 critical
- Rocky Linux Security Advisories 71 critical
- CISA ICS & IT advisories 44 critical
- Amazon Linux Security Center (ALAS) 41 critical
- CERT@VDE 1
- ICSA-22-034-02 Airspan Networks Mimosa 7 CVEs
- DLA-2905-1 apache-log4j1.2 - security update 4 CVEs
- SUSE-SU-2022:0330-1 Security update for glibc 3 CVEs
- openSUSE-SU-2022:0330-1 Security update for glibc 3 CVEs
- ALAS2-2022-1746 Critical: samba security update (Amazon Linux 2) 3 CVEs
- DSA-5067-1 ruby2.7 - security update 3 CVEs
- WID-SEC-2022-0466 Samba: Mehrere Schwachstellen 3 CVEs
- ALSA-2022:0332 Critical: samba security and bug fix update 2 CVEs
- DLA-2912-1 libphp-adodb - security update 1 CVEs
- ICSA-22-034-01 Sensormatic PowerManage (Update A) 1 CVEs