Week 6, 2022

7–13 February 2022

New CVEs: 616
Critical: 35
High: 129
Newly exploited: 16
Advisories: 149
Malicious pkgs: 0

Newly exploited 16

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2022-22620 KEV Feb 11, 2022 A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (…
Apple · macOS · Safari (v and )

EPSS 16%
Critical 10.0
CVE-2020-0796 KEV Feb 10, 2022 · ransomware A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows S…
Microsoft · Windows 10 Version 1903 for x64-based Systems · Windows Server, version 1903 (Server Core installation) · Windows 10 Version 1903 for ARM64-based Systems

EPSS 100%
Critical 9.8
CVE-2015-1635 KEV Feb 10, 2022 HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute…
EPSS 100%
Critical 9.8
CVE-2017-9791 KEV Feb 10, 2022 Code execution in Apache Struts 1 plugin
Apache Software Foundation · Apache Struts

EPSS 99%
Critical 9.8
CVE-2018-1000861 KEV Feb 10, 2022 Deserialization of Untrusted Data in Jenkins
EPSS 98%
Critical 9.8
CVE-2016-3088 KEV Feb 10, 2022 Improper Input Validation in Apache ActiveMQ
EPSS 98%
High 8.8
CVE-2017-0145 KEV Feb 10, 2022 · ransomware The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…
Microsoft · Windows SMB

EPSS 90%
High 8.8
CVE-2017-0144 KEV Feb 10, 2022 · ransomware The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…
Microsoft · Windows SMB

EPSS 99%
High 8.8
CVE-2015-2051 KEV Feb 10, 2022 The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSetting…
EPSS 97%
High 8.8
CVE-2017-8464 KEV Feb 10, 2022 Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows …
Microsoft · Windows Shell

EPSS 90%
High 7.8
CVE-2014-4404 KEV Feb 10, 2022 Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an…
EPSS 49%
High 7.8
CVE-2017-0263 KEV Feb 10, 2022 The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 1…
Microsoft · Microsoft Windows

EPSS 10%
High 7.8
CVE-2017-0262 KEV Feb 10, 2022 Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in m…
Microsoft · Microsoft Office

EPSS 81%
High 7.8
CVE-2015-1130 KEV Feb 10, 2022 The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified …
EPSS 9.9%
High 7.8
CVE-2021-36934 KEV Feb 10, 2022 Windows Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809 · Windows 10 Version 20H2 · Windows 10 Version 1909

EPSS 67%
High 7.5
CVE-2017-10271 KEV Feb 10, 2022 · ransomware Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6…
Oracle · WebLogic Server

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2022-22536 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for …
SAP · SAP Web Dispatcher · SAP NetWeaver and ABAP Platform · SAP Content Server

EPSS 98%
Critical 9.8
CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header
Apache Software Foundation · Apache APISIX

EPSS 96%
Critical 10.0
CVE-2022-20705 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 80%
Critical 10.0
CVE-2022-20707 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 75%
Critical 10.0
CVE-2022-20699 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 72%
Critical 9.1
CVE-2021-44521 Remote code execution for scripted UDFs
Apache Software Foundation · Apache Cassandra

EPSS 59%
Critical 10.0
CVE-2022-20708 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 15%
Critical 10.0
CVE-2022-20701 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 9.7%
Critical 10.0
CVE-2022-20703 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 9.2%
Critical 9.8
CVE-2022-24977 Path Traversal in ImpressCMS
EPSS 6.4%
Critical 10.0
CVE-2022-20700 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 5.7%
Critical 10.0
CVE-2022-20706 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 5.6%
Critical 10.0
CVE-2022-20711 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 4.9%
Critical 10.0
CVE-2022-20702 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 4.6%
Critical 10.0
CVE-2022-20749 Cisco Small Business RV Series Routers Vulnerabilities
Cisco · Cisco Small Business RV Series Router Firmware

EPSS 4%

All 35 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Unscored
CVE-2022-0306 Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Google · Chrome

EPSS 85%
Unscored
CVE-2021-25114 Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
EPSS 82%
High 7.8
CVE-2022-21971 Windows Runtime Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 54%
High 8.1
CVE-2022-0557 OS Command Injection in microweber/microweber
microweber · microweber/microweber

EPSS 51%
Unscored
CVE-2022-24313 A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code ex…
EPSS 45%
High 7.5
CVE-2022-21993 Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 44%
High 7.8
CVE-2022-21999 Windows Print Spooler Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 41%
Medium 6.1
CVE-2022-24682 An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in Dec…
EPSS 31%

Advisories

DSA-5073-1 expat - security update 10 CVEs
SEVD-2022-039-01 IGSS (Interactive Graphical SCADA System) 8 CVEs
DSA-5074-1 thunderbird - security update 7 CVEs
DSA-5069-1 firefox-esr - security update 7 CVEs
DLA-2916-1 firefox-esr - security update 7 CVEs
SUSE-SU-2022:0355-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-log-metrics, openstack-monasca-log-persister, openstack-monasca-log-transformer, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, venv-openstack-monasca, zookeeper, zookeeper-kit 4 CVEs
SUSE-SU-2022:0354-1 Security update for elasticsearch, elasticsearch-kit, kafka, kafka-kit, logstash, openstack-monasca-agent, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-monasca-thresh, openstack-monasca-thresh-kit, spark, spark-kit, storm, storm-kit, venv-openstack-monasca, zookeeper, zookeeper-kit 4 CVEs
DLA-2915-1 connman - security update 4 CVEs
SEVD-2022-039-04 spaceLYnk, Wiser For KNX, fellerLYnk 4 CVEs
DLA-2919-1 python2.7 - security update 2 CVEs