Week 18, 2022

2–8 May 2022

New CVEs: 475
Critical: 36
High: 115
Newly exploited: 5
Advisories: 85
Malicious pkgs: 0

Newly exploited 5

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2019-8506 KEV May 4, 2022 A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Win…
Apple · watchOS · tvOS · Safari

EPSS 16%
High 8.8
CVE-2014-0322 KEV May 4, 2022 Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript…
EPSS 85%
High 8.8
CVE-2021-1789 KEV May 4, 2022 A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Updat…
Apple · macOS · iOS and iPadOS

EPSS 14%
High 7.8
CVE-2014-4113 KEV May 4, 2022 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wi…
EPSS 87%
High 7.5
CVE-2014-0160 KEV May 4, 2022 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to ob…
EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2022-1388 On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all …
F5 · BIG-IP

EPSS 100%
Critical 9.8
CVE-2022-1292 The c_rehash script allows command injection
OpenSSL · OpenSSL

EPSS 83%
Critical 9.8
CVE-2022-1378 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker …
Delta Electronics · DIAEnergie

EPSS 19%
Critical 9.8
CVE-2022-1367 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx. This allows an attacker to …
Delta Electronics · DIAEnergie

EPSS 19%
Critical 9.8
CVE-2022-1366 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to…
Delta Electronics · DIAEnergie

EPSS 19%
Critical 9.9
CVE-2022-20780 Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Cisco · Cisco Enterprise NFV Infrastructure Software

EPSS 11%
Critical 9.9
CVE-2022-20777 Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Cisco · Cisco Enterprise NFV Infrastructure Software

EPSS 11%
Critical 9.9
CVE-2022-20779 Cisco Enterprise NFV Infrastructure Software Vulnerabilities
Cisco · Cisco Enterprise NFV Infrastructure Software

EPSS 10%
Critical 9.0
CVE-2022-30284 Argument injection in python-libnmap
EPSS 5.6%
Critical 9.8
CVE-2022-28118 RCE in SiteServer CMS
EPSS 2.8%
Critical 9.8
CVE-2022-28890 Processing external DTDs
Apache Software Foundation · Apache Jena

EPSS 2.7%
Critical 9.6
CVE-2022-1575 Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio
jgraph · jgraph/drawio

EPSS 2.4%
Critical 9.8
CVE-2022-28470 Code-execution backdoor in marcador
EPSS 2.3%
Critical 9.9
CVE-2022-29176 Unauthorized gem takeover for some gems on rubygems.org
rubygems · rubygems.org

EPSS 1.9%
Critical 9.8
CVE-2022-28111 MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter
EPSS 1.7%

All 36 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DLA-2994-1 firefox-esr - security update 6 CVEs
DSA-5129-1 firefox-esr - security update 6 CVEs
USN-5402-1 openssl, openssl1.0 vulnerabilities 4 CVEs
DLA-2992-1 openvpn - security update 4 CVEs
DSA-5132-1 ecdsautils - security update 1 CVEs
DLA-2997-1 ecdsautils - security update 1 CVEs
ALAS2-2022-1794 Critical: maven-shared-utils security update (Amazon Linux 2) 1 CVEs
VDE-2022-016 TRUMPF: TruTops Fab, TruTops Boost prone to vulnerability 1 CVEs