Week 16, 2022
18–24 April 2022
Newly exploited 3
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Critical 9.8
CVE-2019-3568 KEV Apr 19, 2022 A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number…EPSS 30%
Facebook · WhatsApp for Android · WhatsApp Business for Android · WhatsApp for iOS
-
High 7.8
CVE-2022-22718 KEV Apr 19, 2022 Windows Print Spooler Elevation of Privilege VulnerabilityEPSS 18%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Medium 6.1
CVE-2018-6882 KEV Apr 19, 2022 · ransomware Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x b…EPSS 30%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposit…EPSS 100%
-
Critical 9.8
CVE-2022-27924 Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache…EPSS 94%
-
Critical 9.8
CVE-2022-0540 A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atl…EPSS 88%
Atlassian · Jira Service Management Data Center · Jira Service Management Server · Jira Software Data Center
-
Critical 9.8
CVE-2022-26133 SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later …EPSS 71%
-
Critical 9.8
CVE-2022-21445 Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are aff…EPSS 62%
- Critical 9.8 EPSS 3.7%
- Critical 9.9 EPSS 3%
-
Critical 9.8
CVE-2022-0992 SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA SetupEPSS 2.9%
SiteGround · Security Optimizer – The All-In-One Protection Plugin
- Critical 9.8 EPSS 2.8%
-
Critical 10.0
CVE-2020-28617 Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead…EPSS 2.4%
-
Critical 10.0
CVE-2020-28627 Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead…EPSS 2.4%
-
Critical 10.0
CVE-2020-28621 Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead…EPSS 2.4%
-
Critical 10.0
CVE-2020-28620 Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead…EPSS 2.4%
-
Critical 10.0
CVE-2020-28619 Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead…EPSS 2.4%
-
Critical 10.0
CVE-2020-28618 Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead…EPSS 2.4%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.2
CVE-2022-27925 Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with a…EPSS 99%
-
High 8.8
CVE-2022-1329 Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code ExecutionEPSS 93%
-
Medium 6.3
CVE-2022-21490 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and…EPSS 79%
-
Medium 6.3
CVE-2022-21489 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and…EPSS 79%
-
High 7.5
CVE-2022-21449 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a…EPSS 77%
-
Medium 6.8
CVE-2022-28810 Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the…EPSS 71%
- High 7.2 EPSS 64%
-
Medium 4.6
CVE-2022-29548 A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; …EPSS 41%
Advisories
- SUSE / openSUSE Security Updates 621 critical
- BSI CERT-Bund (WID) 181 critical
- CISA ICS & IT advisories 82 critical
- Ubuntu Security Notices (USN) 8
- AlmaLinux Security Advisories 5
- Debian Security (DSA / DLA) 3
- Oracle Linux Security Advisories (ELSA) 3
- Amazon Linux Security Center (ALAS) 2
- Rocky Linux Security Advisories 2
- SICK PSIRT 11 critical
- Siemens ProductCERT 11 critical
- WID-SEC-2024-2180 Oracle Fusion Middleware: Mehrere Schwachstellen 36 CVEs
- ICSA-22-109-05 Elcomplus SmartPTT SCADA Server 5 CVEs
- ICSA-22-109-04 Elcomplus SmartPTT SCADA 4 CVEs
- SCA-2022-0007 Vulnerabilities in SICK MARSIC300 2 CVEs
- SUSE-SU-2022:0844-2 Security update for expat 1 CVEs
- SSA-254054 SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products 1 CVEs