Week 20, 2022

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2022-31259 Access control bypass in beego
  EPSS 22%
• Critical 9.8
  CVE-2022-31267 Unescaped control characters in Gitblit
  EPSS 18%
• Critical 9.8
  CVE-2022-22978 Authorization bypass in Spring Security
  EPSS 12%
• Critical 9.1
  CVE-2022-24856 Server-Side Request Forgery in FlyteConsole

  flyteorg · flyteconsole

  EPSS 10%
• Critical 9.8
  CVE-2022-30600 Incorrect Calculation in moodle
  EPSS 5.1%
• Critical 10.0
  CVE-2021-27446 Weintek EasyWeb cMT Code Injection

  Weintek · cMT-FHD · cMT-HDM · cMT-CTRL01

  EPSS 3%
• Critical 9.9
  CVE-2022-1770 Improper Privilege Management in polonel/trudesk

  polonel · polonel/trudesk

  EPSS 2.6%
• Critical 10.0
  CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled

  argoproj · Argo CD

  EPSS 2.1%
• Critical 9.8
  CVE-2021-33318 Improper Input Validation in IpMatcher
  EPSS 2.1%
• Critical 9.0
  CVE-2022-1752 Unrestricted Upload of File with Dangerous Type in polonel/trudesk

  polonel · polonel/trudesk

  EPSS 1.9%
• Critical 9.8
  CVE-2022-1357 Cambium Networks cnMaestro OS Command Injection

  Cambium Networks · cnMaestro

  EPSS 1.8%
• Critical 9.8
  CVE-2020-16209 Fieldcomm Group HART-IP and hipserver - Stack-based Buffer Overflow

  Fieldcomm Group · hipserver · HART-IP Developer Kit

  EPSS 1.5%
• Critical 9.8
  CVE-2022-30599 SQL injection in moodle
  EPSS 1.4%
• Critical 9.8
  CVE-2022-30765 SQL injection in calibreweb
  EPSS 1.2%
• Critical 9.1
  CVE-2022-29186 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise

  rundeck · rundeck

  EPSS 1.2%

All 19 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2022-30781 Shell command injection in gitea
  EPSS 88%
• High 8.0
  CVE-2022-30956 Cross-site Scripting in Jenkins Rundeck Plugin

  Jenkins Project · Jenkins Rundeck Plugin

  EPSS 73%
• High 7.5
  CVE-2022-21500 Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows u…

  Oracle · User Management

  EPSS 72%
• Unscored
  CVE-2022-1386 Fusion Builder < 3.6.2 - Unauthenticated SSRF
  EPSS 71%
• Unscored
  CVE-2022-22972 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious …
  EPSS 56%
• Unscored
  CVE-2022-28955 An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.
  EPSS 40%
• Unscored
  CVE-2022-28927 A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.
  EPSS 34%
• Unscored
  CVE-2022-24108 The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resul…
  EPSS 33%