Week 17, 2022
25 April – 1 May 2022
Newly exploited 7
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
- Critical 9.9 EPSS 74%
-
Critical 9.8
CVE-2022-29464 KEV Apr 25, 2022 · ransomware Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposit…EPSS 100%
-
High 7.8
CVE-2021-41357 KEV Apr 25, 2022 Win32k Elevation of Privilege VulnerabilityEPSS 1.5%
Microsoft · Windows Server 2022 · Windows 11 version 21H2 · Windows 10 Version 20H2
-
High 7.8
CVE-2022-0847 KEV Apr 25, 2022 A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe funct…EPSS 93%
-
High 7.8
CVE-2021-40450 KEV Apr 25, 2022 Win32k Elevation of Privilege VulnerabilityEPSS 1.5%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
High 7.0
CVE-2022-26904 KEV Apr 25, 2022 Windows User Profile Service Elevation of Privilege VulnerabilityEPSS 17%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
High 7.0
CVE-2022-21919 KEV Apr 25, 2022 Windows User Profile Service Elevation of Privilege VulnerabilityEPSS 2.6%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 93%
-
Critical 9.8
CVE-2022-29499 The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Applia…EPSS 55%
- Critical 9.8 EPSS 33%
-
Critical 9.9
CVE-2022-24900 Absolute Path Traversal due to incorrect use of `send_file` call in Piano LED VisualizerEPSS 8.4%
- Critical 9.9 EPSS 4.5%
- Critical 10.0 EPSS 3.8%
- Critical 9.8 EPSS 3.7%
- Critical 9.8 EPSS 3.2%
- Critical 9.1 EPSS 2.8%
- Critical 9.1 EPSS 2.1%
- Critical 9.8 EPSS 1.8%
- Critical 9.8 EPSS 1.6%
- Critical 9.8 EPSS 1.2%
- Critical 9.3 EPSS 1.1%
-
Critical 9.8
CVE-2021-34601 Bender Charge Controller: Hardcoded Credentials in Charge ControllerEPSS 1.1%
Bender / ebee · CC612 · ICC15xx · CC613
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-46422 Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.EPSS 94%
-
Unscored
CVE-2022-29081 Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few R…EPSS 84%
- Unscored EPSS 83%
-
Unscored
CVE-2022-29806 ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to expl…EPSS 67%
-
Unscored
CVE-2021-46442 In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloadin…EPSS 56%
-
Unscored
CVE-2021-46424 Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal fil…EPSS 36%
-
Unscored
CVE-2021-46441 In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute arbitrary system comm…EPSS 33%
-
Unscored
CVE-2021-44596 Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate ov…EPSS 23%
Advisories
- SUSE / openSUSE Security Updates 537 critical
- AlmaLinux Security Advisories 22
- Ubuntu Security Notices (USN) 17
- Oracle Linux Security Advisories (ELSA) 15
- BSI CERT-Bund (WID) 14
- Amazon Linux Security Center (ALAS) 12
- Rocky Linux Security Advisories 12
- Debian Security (DSA / DLA) 81 critical
- CERT@VDE 64 critical
- SICK PSIRT 2
- CISA ICS & IT advisories 2
- VDE-2021-061 Pilz: PMC programming tool 3.x.x affected by multiple vulnerabilities 27 CVEs
- DSA-5125-1 chromium - security update 26 CVEs
- VDE-2021-054 Pilz: Multiple vulnerabilities in CODESYS V2 and V3 runtime system 18 CVEs
- SUSE-FU-2022:1419-1 Feature update for grafana 12 CVEs
- SUSE-SU-2022:1396-1 Security update for SUSE Manager Client Tools 12 CVEs
- VDE-2021-055 Pilz: PMC programming tool 2.x.x affected by multiple vulnerabilities 10 CVEs
- VDE-2021-047 Bender/ebee: Multiple Charge Controller Vulnerabilities 7 CVEs
- SUSE-SU-2022:1462-1 Security update for nodejs14 4 CVEs
- SUSE-SU-2022:1461-1 Security update for nodejs12 4 CVEs
- SUSE-SU-2022:1459-1 Security update for nodejs14 4 CVEs