Week 10, 2022
7–13 March 2022
Newly exploited 11
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 9.8
CVE-2019-11581 KEV Mar 7, 2022 There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker…EPSS 85%
-
Critical 9.8
CVE-2013-0625 KEV Mar 7, 2022 Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code…EPSS 94%
-
Critical 9.8
CVE-2017-6077 KEV Mar 7, 2022 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters…EPSS 69%
-
Critical 9.6
CVE-2022-26486 KEV Mar 7, 2022 An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abu…EPSS 2.4%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
High 8.8
CVE-2016-6277 KEV Mar 7, 2022 NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R730…EPSS 100%
-
High 8.8
CVE-2022-26485 KEV Mar 7, 2022 Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. Th…EPSS 14%
Mozilla · Firefox · Thunderbird · Firefox ESR
-
High 7.5
CVE-2013-0631 KEV Mar 7, 2022 Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.EPSS 66%
-
High 7.5
CVE-2013-0629 KEV Mar 7, 2022 Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as ex…EPSS 66%
-
High 7.2
CVE-2020-8218 KEV Mar 7, 2022 A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the ad…EPSS 32%
-
Medium 6.5
CVE-2009-3960 KEV Mar 7, 2022 · ransomware Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Serv…EPSS 90%
-
Medium 5.3
CVE-2021-21973 KEV Mar 7, 2022 The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malici…EPSS 88%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2022-26143 The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive i…EPSS 87%
- Critical 9.8 EPSS 72%
- Critical 10.0 EPSS 49%
-
Critical 9.1
CVE-2022-0482 Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointmentsEPSS 44%
- Critical 9.8 EPSS 5.5%
- Critical 9.8 EPSS 2.1%
- Critical 9.8 EPSS 1.6%
- Critical 9.1 EPSS 1.6%
- Critical 9.1 EPSS 1.4%
- Critical 9.8 EPSS 1.4%
-
Critical 9.3
CVE-2022-26131 ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497EPSS 1.3%
- Critical 9.4 EPSS 1.3%
- Critical 9.1
- Critical 9.6
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2022-0847 A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe funct…EPSS 93%
- High 7.5 EPSS 89%
- Unscored EPSS 85%
- High 7.2 EPSS 78%
-
Medium 6.5
CVE-2022-23253 Windows Point-to-Point Tunneling Protocol Denial of Service VulnerabilityEPSS 56%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Unscored
CVE-2022-23940 SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by…EPSS 54%
- Medium 4.3 EPSS 42%
-
High 8.8
CVE-2022-23277 Microsoft Exchange Server Remote Code Execution VulnerabilityEPSS 41%
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 11 · Microsoft Exchange Server 2016 Cumulative Update 22
Advisories
- Microsoft Security Response Center 713 critical
- SUSE / openSUSE Security Updates 468 critical
- Debian Security (DSA / DLA) 287 critical
- BSI CERT-Bund (WID) 181 critical
- Oracle Linux Security Advisories (ELSA) 162 critical
- Siemens ProductCERT 154 critical
- CISA ICS & IT advisories 144 critical
- Ubuntu Security Notices (USN) 104 critical
- Rocky Linux Security Advisories 61 critical
- AlmaLinux Security Advisories 51 critical
- Amazon Linux Security Center (ALAS) 51 critical
- Schneider Electric CPCERT 31 critical
- CERT@VDE 1
- SSA-389290 SSA-389290: Third-Party Component Vulnerabilities in SINEC INS 71 CVEs
- ICSA-22-069-09 Siemens SINEC INS 71 CVEs
- RLSA-2022:0818 Critical: firefox security update 10 CVEs
- ALSA-2022:0818 Critical: firefox security update 10 CVEs
- ELSA-2022-0824 Critical: firefox security and bug fix update (Oracle Linux 7) 10 CVEs
- ELSA-2022-0818 Critical: firefox security update (Oracle Linux 8) 10 CVEs
- SUSE-SU-2022:14906-1 Security update for MozillaFirefox 7 CVEs
- USN-5321-1 firefox vulnerabilities 7 CVEs
- ICSA-22-067-01 PTC Axeda agent and Axeda Desktop Server (Update C) 7 CVEs
- SSA-256353 SSA-256353: Third-Party Component Vulnerabilities in RUGGEDCOM ROS 6 CVEs